0108-fs-jfs-Do-not-move-to-leaf-level-if-name-length-is-n.patch 1.1 KB

12345678910111213141516171819202122232425262728293031323334
  1. From ffd5a46f68710e2781899d0be4d701429a5a817d Mon Sep 17 00:00:00 2001
  2. From: Daniel Axtens <dja@axtens.net>
  3. Date: Mon, 18 Jan 2021 14:51:11 +1100
  4. Subject: [PATCH] fs/jfs: Do not move to leaf level if name length is negative
  5. Fuzzing JFS revealed crashes where a negative number would be passed
  6. to le_to_cpu16_copy(). There it would be cast to a large positive number
  7. and the copy would read and write off the end of the respective buffers.
  8. Catch this at the top as well as the bottom of the loop.
  9. Signed-off-by: Daniel Axtens <dja@axtens.net>
  10. Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
  11. Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
  12. ---
  13. grub-core/fs/jfs.c | 2 +-
  14. 1 file changed, 1 insertion(+), 1 deletion(-)
  15. diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c
  16. index d5a6d65..e5bbda6 100644
  17. --- a/grub-core/fs/jfs.c
  18. +++ b/grub-core/fs/jfs.c
  19. @@ -567,7 +567,7 @@ grub_jfs_getent (struct grub_jfs_diropen *diro)
  20. /* Move down to the leaf level. */
  21. nextent = leaf->next;
  22. - if (leaf->next != 255)
  23. + if (leaf->next != 255 && len > 0)
  24. do
  25. {
  26. next_leaf = &diro->next_leaf[nextent];
  27. --
  28. 2.14.2