fs/jfs: Fix OOB read in jfs_getent()
authorLidong Chen <lidong.chen@oracle.com>
Fri, 22 Nov 2024 06:27:59 +0000 (06:27 +0000)
committerFelix Zielcke <fzielcke@z-51.de>
Wed, 11 Jun 2025 15:42:34 +0000 (17:42 +0200)
commit64c15360f1f18161a172196b080180c8daa370fa
treeabc7dec6b81c197756a466d405f43f047c6afa45
parentd82b41f4e935f930419a706130def0d497a0f32b
fs/jfs: Fix OOB read in jfs_getent()

The JFS fuzzing revealed an OOB read in grub_jfs_getent(). The crash
was caused by an invalid leaf nodes count, diro->dirpage->header.count,
which was larger than the maximum number of leaf nodes allowed in an
inode. This fix is to ensure that the leaf nodes count is validated in
grub_jfs_opendir() before calling grub_jfs_getent().

On the occasion replace existing raw numbers with newly defined constant.

Signed-off-by: Lidong Chen <lidong.chen@oracle.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Reviewed-by: Alec Brown <alec.r.brown@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-jfs-Fix-OOB-read-in-jfs_getent.patch
grub-core/fs/jfs.c