mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-23 15:49:23 +00:00
getblk() implicitly trusts that treehead->count is an accurate count of the number of extents. However, that value is read from disk and is not trustworthy, leading to OOB reads and crashes. I am not sure to what extent the data read from OOB can influence subsequent program execution. Require callers to pass in the maximum number of extents for which they have storage. Signed-off-by: Daniel Axtens <dja@axtens.net> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>