In xfs_vfs_readdir of xfs.c, the XFS_DINODE_FMT_LOCAL (shortform directory) code path parses on-disk directory entries without validating the entry pointer or its derived name length against the bounds of the inode buffer being parsed, unlike the sibling XFS_DINODE_FMT_EXTENTS path which performs an equivalent check. A crafted XFS filesystem image with an oversized namelen or ncount field in a shortform directory inode can cause the parser to read past the end of the inode buffer's heap allocation, leaking adjacent heap memory into the returned directory listing, simply by listing the directory.
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan