fs/ext2: Fix out-of-bounds read for inline extents
authorMichael Chang <mchang@suse.com>
Fri, 31 May 2024 07:14:23 +0000 (15:14 +0800)
committerFelix Zielcke <fzielcke@z-51.de>
Wed, 11 Jun 2025 15:42:34 +0000 (17:42 +0200)
commit85e99d4d9771a85f0b83cd7694c2311034388362
tree6a8a0941ce57269ad581775e2a2ac941636f469a
parent078b6b3aeade3826a0e53f0ae1362d6c9c7cbbd5
fs/ext2: Fix out-of-bounds read for inline extents

When inline extents are used, i.e. the extent tree depth equals zero,
a maximum of four entries can fit into the inode's data block. If the
extent header states a number of entries greater than four the current
ext2 implementation causes an out-of-bounds read. Fix this issue by
capping the number of extents to four when reading inline extents.

Reported-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Michael Chang <mchang@suse.com>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
Gbp-Pq: Topic cve-2025-jan
Gbp-Pq: Name fs-ext2-Fix-out-of-bounds-read-for-inline-extents.patch
grub-core/fs/ext2.c