In ext2_vfs_readdir of ext2.c, a directory entry's name_len and rec_len fields are read directly from an on-disk ext2 directory block without validating that the resulting name data actually fits within the bounds of the single malloc()'d block buffer being parsed. A crafted ext2 filesystem image with a manipulated directory entry can cause the parser to read past the end of that heap allocation, leaking adjacent heap memory into the returned directory listing, simply by listing the directory.
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan