CVE-2021-3696: Heap overflow in GRUB2 PNG huffman table insertion

Heap out-of-bounds read/write vulnerability in GRUB2's PNG image loader (grub-2.06). The vulnerability occurs in the grub_png_insert_huff_item function when processing dynamic deflate blocks. When reading PNG files with crafted huffman code length data, the function calculates the number of array positions to shift without validating that this count does not exceed the current array size. If the count exceeds array bounds, negative array indices are used, causing heap underflow and potential memory corruption. This affects any PNG with malicious zlib-compressed data, including IDAT chunks and ancillary chunks like iCCP that contain compressed profiles.",antml:parameter> Located the vulnerability through git history (commit 210245129) which explicitly mentions the fix for CVE-2021-3696. The vulnerability is in grub-core/video/readers/png.c, function grub_png_insert_huff_item (lines 402-425). The function processes huffman code lengths from PNG deflate streams (called from grub_png_init_dynamic_block). The calculation of 'n' on lines 415-417 sums existing table entries at code lengths >= target length. When this sum (n) exceeds ht->num_values (current number of values in the table), the array shift operation on line 420 uses negative indices. The vulnerability is triggered by crafted PNG files with deflate streams containing malicious code length values that maximize the shift count.",antml:parameter> The fix adds a bounds check before array manipulation. After calculating 'n' (the number of positions to shift), the code validates that n <= ht->num_values. If this check fails, an error is returned and array access is prevented. The specific patch adds 6 lines of validation code: if (n > ht->num_values) { grub_error(...); return; }. This prevents negative array indices and heap underflow. The fix is minimal, safe, and effective because it rejects invalid huffman table states rather than attempting to handle them. This aligns with existing error handling in the PNG decoder for malformed input.",antml:parameter> The fix was officially applied in GRUB2 commit 210245129c932dc9e1c2748d9d35524fb95b5042 by Daniel Axtens on July 6, 2021. The commit message explicitly states the fix addresses CVE-2021-3696. The vulnerable code path is: PNG file → IDAT processing → grub_png_decode_image_data → dynamic deflate block → grub_png_init_dynamic_block → multiple calls to grub_png_insert_huff_item. The vulnerability requires a specially crafted PNG, but no special execution context—any application that parses PNG images using the vulnerable GRUB2 code is affected. The vulnerability was discovered through fuzzing, indicating it's a real security issue.",antml:parameter> critical