fs/ext2: Fix out-of-bounds read for inline extents
authorMichael Chang <mchang@suse.com>
Fri, 31 May 2024 07:14:23 +0000 (15:14 +0800)
committerFelix Zielcke <fzielcke@z-51.de>
Thu, 3 Jul 2025 16:35:51 +0000 (18:35 +0200)
commitd8d20c912ae569866ed0e5a898c50d78611587ef
tree1da2dddb0531f5d0283436194a46d6025b48a5c4
parentb7d14f1fbe4bf01d5553aad798e0585b133b540b
fs/ext2: Fix out-of-bounds read for inline extents

When inline extents are used, i.e. the extent tree depth equals zero,
a maximum of four entries can fit into the inode's data block. If the
extent header states a number of entries greater than four the current
ext2 implementation causes an out-of-bounds read. Fix this issue by
capping the number of extents to four when reading inline extents.

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Chang <mchang@suse.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch
grub-core/fs/ext2.c