Bug 2527996

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca((height + 1) * sizeof(*metalist)) where height is the i_height field from the on-disk inode (uint16, max 65535, valid range 0-10). No bounds validation is performed before the alloca call. An attacker can craft a GFS2 filesystem image with a large i_height value to cause excessive stack allocation (~1MB for i_height=65535 with sizeof(osi_list_t)=16), leading to stack exhaustion and a denial of service (SIGSEGV). The metadata walk in metawalk.c involves recursive traversal, and each level could invoke this alloca, compounding the stack usage. The Linux kernel GFS2 driver validates i_height against sd_max_height in gfs2_dinode_in() and stores it as u8, but the userspace gfs2-utils performs no equivalent validation.