Messages in this thread | | | Date | Thu, 25 Apr 2024 18:04:48 +0100 | From | Matthew Wilcox <> | Subject | Re: [PATCH] jfs: Fix array-index-out-of-bounds in diFree |
| |
On Thu, Apr 25, 2024 at 11:24:34PM +0900, Jeongjun Park wrote: > Matthew Wilcox wrote: > > It should be checked earlier than this. There's this code in > > dbMount(). Why isn't this catching it? > > This vulnerability occurs because a very large value can be passed > to iagp->agstart. So that code doesn't prevent the vulnerability.
In your earlier mail, you said the large value was found in db_agl2size. If the problem is in agstart then diRead() is the right place to check it.
| |