In the btrfs mount routine of btrfs.c, the sys_chunk_array_size field of an on-disk btrfs superblock is passed directly as the walk bound to btrfs_parse_sys_chunk_array without being validated against the actual size of the fixed 2048-byte sys_chunk_array member it indexes into. A crafted btrfs filesystem image with an oversized sys_chunk_array_size value causes the parser to read past the end of the superblock's heap allocation, potentially leaking adjacent heap memory into the filesystem's internal chunk-mapping table and causing further out-of-bounds disk reads derived from the corrupted mapping. This is reachable simply by mounting an attacker-supplied btrfs disk image.
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan