tablet/grub
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/tftp: Fix NULL pointer dereference in grub_net_udp_close()

Browse Source 
A NULL pointer dereference can occur in grub_net_udp_close(data->sock)
when handling a malformed TFTP OACK packet.

This issue was discovered via fuzzing. When a malformed OACK packet
contains an invalid file size, "tsize", value tftp_receive() detects
the error and saves it via grub_error_save(&data->save_err). Later,
tftp_open() restores this error and calls grub_net_udp_close(data->sock)
assuming the socket is still valid.

However, the socket may have already been closed and set to NULL after
processing the final data block in tftp_receive() leading to a NULL
pointer dereference when attempting to close it again.

Fix it by checking if the socket is non-NULL before closing.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
This commit is contained in:
Lidong Chen 2025-10-17 18:35:59 +00:00 committed by Daniel Kiper
parent fadc94b919
commit c2cae77abe
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
grub-core/net/tftp.c
View File

@ -412,7 +412,11 @@ tftp_open (struct grub_file *file, const char *filename)
grub_error_load (&data->save_err);
if (grub_errno)
{
grub_net_udp_close (data->sock);
if (data->sock != NULL)
{
grub_net_udp_close (data->sock);
data->sock = NULL;
}
grub_free (data);
file->data = NULL;
return grub_errno;