proxmox-mirrors/grub2
1
0
Fork 0
mirror of https://git.proxmox.com/git/grub2 synced 2025-07-25 08:05:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fs/nilfs2: Reject too-large keys

Browse Source 
NILFS2 has up to 7 keys, per the data structure. Do not permit array
indices in excess of that.

This catches some OOB reads. I don't know how controllable the invalidly
read data is or if that could be used later in the program.

Signed-off-by: Daniel Axtens <dja@axtens.net>
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
This commit is contained in:
Daniel Axtens 2021-01-18 16:49:09 +11:00 committed by Daniel Kiper
parent 223120dd83
commit 20ab8cb44b
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
grub-core/fs/nilfs2.c
View File

@ -569,6 +569,11 @@ grub_nilfs2_btree_lookup (struct grub_nilfs2_data *data,
static inline grub_uint64_t
grub_nilfs2_direct_lookup (struct grub_nilfs2_inode *inode, grub_uint64_t key)
{
if (1 + key > 6)
{
grub_error (GRUB_ERR_BAD_FS, "key is too large");
return 0xffffffffffffffff;
}
return grub_le_to_cpu64 (inode->i_bmap[1 + key]);
}
@ -584,7 +589,7 @@ grub_nilfs2_bmap_lookup (struct grub_nilfs2_data *data,
{
grub_uint64_t ptr;
ptr = grub_nilfs2_direct_lookup (inode, key);
if (need_translate)
if (ptr != ((grub_uint64_t) 0xffffffffffffffff) && need_translate)
ptr = grub_nilfs2_dat_translate (data, ptr);
return ptr;
}