From 000e48b42c7e41d0f75cb7c6d5bcc76f8df6311f Mon Sep 17 00:00:00 2001 From: Andrew Hamilton Date: Sun, 1 Jun 2025 10:52:22 -0500 Subject: [PATCH] fs/ntfs: Correct next_attribute validation Improved ad-hoc fuzzing coverage revealed a possible access violation around line 342 of grub-core/fs/ntfs.c when accessing the attr_cur pointer due to possibility of moving pointer "next" beyond of the end of the valid buffer inside next_attribute. Prevent this for cases where full attribute validation is not performed (such as on attribute lists) by performing a sanity check on the newly calculated next pointer. Fixes: 06914b614 (fs/ntfs: Correct attribute vs attribute list validation) Signed-off-by: Andrew Hamilton Reviewed-by: Daniel Kiper --- grub-core/fs/ntfs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/grub-core/fs/ntfs.c b/grub-core/fs/ntfs.c index 5b0a18f3d..bb3cec4e6 100644 --- a/grub-core/fs/ntfs.c +++ b/grub-core/fs/ntfs.c @@ -233,7 +233,12 @@ next_attribute (grub_uint8_t *curr_attribute, void *end, bool validate) return NULL; next += u16at (curr_attribute, 4); - if (validate && validate_attribute (next, end) == false) + if (validate) + { + if (validate_attribute (next, end) == false) + return NULL; + } + else if (next >= (grub_uint8_t *) end) return NULL; return next; -- 2.47.3