On Thu, Jun 09, 2022 at 04:02:06PM +0200, Miquel Raynal wrote: > Following Jincheng's report, an out-of-band write leading to arbitrary > code execution is possible because on one side the squashfs logic > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > accepts directory names up to 255 bytes long. > > Prevent such an exploit from happening by capping directory name sizes > to 255. Use a define for this purpose so that developers can link the > limitation to its source and eventually kill it some day by dynamically > allocating this array (if ever desired). > > Link: > https://lore.kernel.org/all/CALO=dhfb+yboxxvr5kcsk0ifdg+e7ywko4-e+72kjbcs8jb...@mail.gmail.com > Reported-by: Jincheng Wang <jc.w...@gmail.com> > Signed-off-by: Miquel Raynal <miquel.ray...@bootlin.com> > Tested-by: Jincheng Wang <jc.w...@gmail.com>
Applied to u-boot/master, thanks! -- Tom
signature.asc
Description: PGP signature
