tOS EXT2 Driver — Heap Out-of-Bounds Read via Directory Listing
In ext2_vfs_readdir of ext2.c, a directory entry's name_len and rec_len fields are read directly from an on-disk ext2 directory block without validating that the resulting name data actually fits within the bounds of the single malloc()'d block buffer being parsed. A crafted ext2 filesystem image with a manipulated directory entry can cause the parser to read past the end of that heap allocation, leaking adjacent heap memory into the returned directory listing, simply by listing the directory.
After finding the bounds-checking issue in the NTFS driver in ASI-2026-0006, we reviewed the EXT2 driver to see whether the same directory-parsing pattern repeated elsewhere. In ext2_vfs_readdir, we found that the directory entry's name_len was clamped against the destination buffer, but never validated against the single source block buffer actually being parsed.
A directory entry's name_len and rec_len fields are read directly from an on-disk ext2 directory block. name_len was clamped only against the destination VFS_NAME_LEN buffer, but never against the remaining space in the single malloc(block_size) source buffer being parsed. rec_len was never validated against the block buffer at all. This allowed the parser to walk and read past the end of that allocation.
An attacker prepares a malicious ext2 filesystem image containing a directory entry with manipulated name_len and/or rec_len fields. The victim mounts this image and lists a directory on it (e.g. with ls). During this operation, the parser reads past the bounds of the single block buffer allocation, leaking adjacent heap memory into the returned directory listing. Exploitation requires physical access (mounting the image) and listing the directory.
name_len was clamped only against the destination VFS_NAME_LEN buffer, never against the remaining space in the single malloc(block_size) source buffer being parsed, and rec_len was never validated against the block buffer either, allowing the parser to walk and read past the allocation.
Both name_len and rec_len are now bounds-checked against the actual directory block buffer size before any read or memcpy is performed.
CWE-125, CWE-20
Artfical DT Developer Talha Berk Arslan