The function grub_get_node_path() could return uninitialized offset with
level == 0 if the block is greater than direct_index + 2 * direct_blks +
2 * indirect_blks + dindirect_blks. The uninitialized offset is then used
by function grub_f2fs_get_block() because level == 0 is valid and
meaningful return to be processed.
The fix is to set level = -1 as return value by grub_get_node_path() to
signify an error that the input block cannot be handled. Any caller
should therefore check level is negative or not before processing the
output.
Reported-by: Neil MacLeod <neil@nmacleod.com>
Signed-off-by: Michael Chang <mchang@suse.com>
Tested-by: Neil MacLeod <neil@nmacleod.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
grub_uint32_t dindirect_blks = indirect_blks * NIDS_PER_BLOCK;
grub_uint32_t direct_index = DEF_ADDRS_PER_INODE;
int n = 0;
- int level = 0;
+ int level = -1;
if (inode->i_inline & F2FS_INLINE_XATTR)
direct_index -= F2FS_INLINE_XATTR_ADDRS;
if (block < direct_index)
{
offset[n] = block;
+ level = 0;
goto got;
}
int level, i;
level = grub_get_node_path (inode, block_ofs, offset, noffset);
+
+ if (level < 0)
+ return -1;
+
if (level == 0)
return grub_le_to_cpu32 (inode->i_addr[offset[0]]);