]> git.ipfire.org Git - thirdparty/grub.git/commit
fs/jfs: Fix OOB read in jfs_getent()
authorLidong Chen <lidong.chen@oracle.com>
Fri, 22 Nov 2024 06:27:59 +0000 (06:27 +0000)
committerDaniel Kiper <daniel.kiper@oracle.com>
Thu, 23 Jan 2025 15:22:46 +0000 (16:22 +0100)
commit66175696f3a385b14bdf1ebcda7755834bd2d5fb
tree0c8752cbea7da45800aac63f44f0fd4c16f9ea91
parent1443833a9535a5873f7de3798cf4d8389f366611
fs/jfs: Fix OOB read in jfs_getent()

The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash
was caused by an invalid leaf nodes count, diro->dirpage->header.count,
which was larger than the maximum number of leaf nodes allowed in an
inode. This fix is to ensure that the leaf nodes count is validated in
grub_jfs_opendir() before calling grub_jfs_getent().

On the occasion replace existing raw numbers with newly defined constant.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
grub-core/fs/jfs.c