29jm / SnowflakeOS

"It is very special"
https://jmnl.xyz
MIT License
316 stars 18 forks source link

Read out of bounds in ext2 driver #35

Closed 29jm closed 2 years ago

29jm commented 2 years ago

In ext2.c, parse_group_descriptors assumes the group descriptors will fit within one block, and calls memcpy with a size potentially larger than the size kmalloc was called with, leading to the copying of garbage memory.

It should be fixed to compute the size of the descriptor table beforehand and allocate a buffer sized to the next multiple of the block size (see align_to) so that no overflow can happen.

29jm commented 2 years ago

Fixed in 50e3fa64b596488b17a719f0a4204ef681110c13.