ntfs: fix runlist marker allocation and count

The marker path can append an unmapped element and an ENOENT
terminator after the merge helpers have already computed the resulting
runlist count. In that case, allocating ds + 2 elements leaves no room
for the terminator at ds + 2. The path also increments new_rl_count even
though the merge helper already accounted for the final runlist size,
causing a later merge to start past the terminator.

Allocate space through ds + 2, and derive new_rl_count from the final
terminator index instead of incrementing the count a second time.

A crafted NTFS image can reach this path through a normal read after the
image has been mounted and trigger out-of-bounds kernel heap accesses.

Fixes: 11ccc9107dc4 ("ntfs: update runlist handling and cluster allocator")

Assisted-by: OpenAI Codex:GPT-5
Signed-off-by: pwngets <2605452642@qq.com>
Reviewed-by: Baolin Liu <liubaolin@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions