From: Andrew Hamilton Date: Thu, 20 Mar 2025 23:28:00 +0000 (-0500) Subject: fs/ntfs: Fix NULL pointer dereference and possible infinite loop X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aae2ea619e0f09c353fd6929910f925c92a412c0;p=thirdparty%2Fgrub.git fs/ntfs: Fix NULL pointer dereference and possible infinite loop A regression was introduced recently as a part of the series of filesystem related patches to address some CVEs found in GRUB. This issue may cause either an infinite loop at startup when accessing certain valid NTFS filesystems, or may cause a crash due to a NULL pointer dereference on systems where NULL address is invalid (such as may happen when calling grub-mount from the operating system level). Correct this issue by checking that at->attr_cur is within bounds inside find_attr(). Fixes: https://savannah.gnu.org/bugs/?66855 Fixes: aff263187 (fs/ntfs: Fix out-of-bounds read) Signed-off-by: B Horn Signed-off-by: Andrew Hamilton Reviewed-by: Daniel Kiper --- diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c index 960833a34..b3117bf92 100644 --- a/grub-core/fs/ntfs.c +++ b/grub-core/fs/ntfs.c @@ -387,7 +387,7 @@ find_attr (struct grub_ntfs_attr *at, grub_uint8_t attr) } at->attr_cur = at->attr_nxt; mft_end = at->mft->buf + (at->mft->data->mft_size << GRUB_NTFS_BLK_SHR); - while (at->attr_cur < mft_end && *at->attr_cur != 0xFF) + while (at->attr_cur >= at->mft->buf && at->attr_cur < mft_end && *at->attr_cur != 0xFF) { at->attr_nxt = next_attribute (at->attr_cur, at->end); if (*at->attr_cur == GRUB_NTFS_AT_ATTRIBUTE_LIST)