From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Tue, 1 Dec 2020 23:41:24 +0000 Subject: [PATCH] commands/hashsum: Fix a memory leak check_list() uses grub_file_getline(), which allocates a buffer. If the hash list file contains invalid lines, the function leaks this buffer when it returns an error. Fixes: CID 176635 Signed-off-by: Chris Coulson Reviewed-by: Daniel Kiper --- grub-core/commands/hashsum.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/grub-core/commands/hashsum.c b/grub-core/commands/hashsum.c index 456ba908b..b8a22b0c8 100644 --- a/grub-core/commands/hashsum.c +++ b/grub-core/commands/hashsum.c @@ -128,11 +128,17 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, high = hextoval (*p++); low = hextoval (*p++); if (high < 0 || low < 0) - return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); + { + grub_free (buf); + return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); + } expected[i] = (high << 4) | low; } if ((p[0] != ' ' && p[0] != '\t') || (p[1] != ' ' && p[1] != '\t')) - return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); + { + grub_free (buf); + return grub_error (GRUB_ERR_BAD_FILE_TYPE, "invalid hash list"); + } p += 2; if (prefix) { @@ -140,7 +146,10 @@ check_list (const gcry_md_spec_t *hash, const char *hashfilename, filename = grub_xasprintf ("%s/%s", prefix, p); if (!filename) - return grub_errno; + { + grub_free (buf); + return grub_errno; + } file = grub_file_open (filename, GRUB_FILE_TYPE_TO_HASH | (!uncompress ? GRUB_FILE_TYPE_NO_DECOMPRESS : GRUB_FILE_TYPE_NONE));