Blame SOURCES/0446-fs-nilfs2-Reject-too-large-keys.patch

9723a8
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
9723a8
From: Daniel Axtens <dja@axtens.net>
9723a8
Date: Mon, 18 Jan 2021 16:49:09 +1100
9723a8
Subject: [PATCH] fs/nilfs2: Reject too-large keys
9723a8
9723a8
NILFS2 has up to 7 keys, per the data structure. Do not permit array
9723a8
indices in excess of that.
9723a8
9723a8
This catches some OOB reads. I don't know how controllable the invalidly
9723a8
read data is or if that could be used later in the program.
9723a8
9723a8
Signed-off-by: Daniel Axtens <dja@axtens.net>
9723a8
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
9723a8
---
9723a8
 grub-core/fs/nilfs2.c | 7 ++++++-
9723a8
 1 file changed, 6 insertions(+), 1 deletion(-)
9723a8
9723a8
diff --git a/grub-core/fs/nilfs2.c b/grub-core/fs/nilfs2.c
9723a8
index 598a2a55baf..61e8af9ff7b 100644
9723a8
--- a/grub-core/fs/nilfs2.c
9723a8
+++ b/grub-core/fs/nilfs2.c
9723a8
@@ -569,6 +569,11 @@ grub_nilfs2_btree_lookup (struct grub_nilfs2_data *data,
9723a8
 static inline grub_uint64_t
9723a8
 grub_nilfs2_direct_lookup (struct grub_nilfs2_inode *inode, grub_uint64_t key)
9723a8
 {
9723a8
+  if (1 + key > 6)
9723a8
+    {
9723a8
+      grub_error (GRUB_ERR_BAD_FS, "key is too large");
9723a8
+      return 0xffffffffffffffff;
9723a8
+    }
9723a8
   return grub_le_to_cpu64 (inode->i_bmap[1 + key]);
9723a8
 }
9723a8
 
9723a8
@@ -584,7 +589,7 @@ grub_nilfs2_bmap_lookup (struct grub_nilfs2_data *data,
9723a8
     {
9723a8
       grub_uint64_t ptr;
9723a8
       ptr = grub_nilfs2_direct_lookup (inode, key);
9723a8
-      if (need_translate)
9723a8
+      if (ptr != ((grub_uint64_t) 0xffffffffffffffff) && need_translate)
9723a8
 	ptr = grub_nilfs2_dat_translate (data, ptr);
9723a8
       return ptr;
9723a8
     }