fs/jfs: Fix OOB read in jfs_getent()
authorLidong Chen <lidong.chen@oracle.com>
Fri, 22 Nov 2024 06:27:59 +0000 (06:27 +0000)
committerMiao Wang <shankerwangmiao@gmail.com>
Sun, 15 Feb 2026 13:50:20 +0000 (13:50 +0000)
commit06dfe0169a8c549d399852bf810ee6ca24d477b7
treeb3c180fe39a7f5cc1f2c264d467a2d8c7dc6f456
parenta633e817aefeb9affef946c2e7e40a066a962e9f
fs/jfs: Fix OOB read in jfs_getent()

The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash
was caused by an invalid leaf nodes count, diro->dirpage->header.count,
which was larger than the maximum number of leaf nodes allowed in an
inode. This fix is to ensure that the leaf nodes count is validated in
grub_jfs_opendir() before calling grub_jfs_getent().

On the occasion replace existing raw numbers with newly defined constant.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-jfs-Fix-OOB-read-in-jfs_getent.patch
grub-core/fs/jfs.c