diff --git a/grub-core/fs/jfs.c b/grub-core/fs/jfs.c index e2fe2850c..7a68fcbe3 100644 --- a/grub-core/fs/jfs.c +++ b/grub-core/fs/jfs.c @@ -46,6 +46,7 @@ GRUB_MOD_LICENSE ("GPLv3+"); * https://jfs.sourceforge.net/project/pub/jfslayout.pdf */ #define GRUB_JFS_INODE_INLINE_ENTRIES 8 +#define GRUB_JFS_DIR_MAX_SLOTS 128 struct grub_jfs_sblock { @@ -481,6 +482,14 @@ grub_jfs_opendir (struct grub_jfs_data *data, struct grub_jfs_inode *inode) return 0; } + if (inode->dir.header.sorted[0] >= GRUB_JFS_DIR_MAX_SLOTS) + { + grub_error (GRUB_ERR_BAD_FS, N_("invalid directory slot index")); + grub_free (diro->dirpage); + grub_free (diro); + return 0; + } + blk = grub_le_to_cpu32 (de[inode->dir.header.sorted[0]].ex.blk2); blk <<= (grub_le_to_cpu16 (data->sblock.log2_blksz) - GRUB_DISK_SECTOR_BITS);