fs/ext2: Fix out-of-bounds read for inline extents
authorMichael Chang <mchang@suse.com>
Fri, 31 May 2024 07:14:23 +0000 (15:14 +0800)
committerMiao Wang <shankerwangmiao@gmail.com>
Sun, 15 Feb 2026 13:50:20 +0000 (13:50 +0000)
commit006058f4ffd64bdcc26c7c40276b27ee64d0b983
tree52a0a6e5d13536a34d6e06347fac4cdaa666b4d6
parent7035345081f25246a54fdd5bd7bc28734c0deb6a
fs/ext2: Fix out-of-bounds read for inline extents

When inline extents are used, i.e. the extent tree depth equals zero,
a maximum of four entries can fit into the inode's data block. If the
extent header states a number of entries greater than four the current
ext2 implementation causes an out-of-bounds read. Fix this issue by
capping the number of extents to four when reading inline extents.

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Chang <mchang@suse.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch
grub-core/fs/ext2.c