fs/jfs: Fix OOB read in jfs_getent()
authorLidong Chen <lidong.chen@oracle.com>
Fri, 22 Nov 2024 06:27:59 +0000 (06:27 +0000)
committerFelix Zielcke <fzielcke@z-51.de>
Thu, 3 Jul 2025 16:35:51 +0000 (18:35 +0200)
commita5a1f020f9fdc87216278b83e7b9f3af51b94e0f
tree0c74be4f1b8107d80750ca7549de5c51a594e5f4
parent37243ccfead93ced1f438a344b12f727c05b8f17
fs/jfs: Fix OOB read in jfs_getent()

The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash
was caused by an invalid leaf nodes count, diro->dirpage->header.count,
which was larger than the maximum number of leaf nodes allowed in an
inode. This fix is to ensure that the leaf nodes count is validated in
grub_jfs_opendir() before calling grub_jfs_getent().

On the occasion replace existing raw numbers with newly defined constant.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-jfs-Fix-OOB-read-in-jfs_getent.patch
grub-core/fs/jfs.c