This fixes an integer overflow in the SquashFS directory-table reader that leads to a heap out-of-bounds write, and adds a regression test.
sqfs_read_directory_table() sizes the directory table with an int multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a crafted image, under-allocating the buffer that the fill loop then overruns. It is reached by listing or reading the image (sqfsls / sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow(); patch 2 adds a test that a crafted image is rejected. Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. Signed-off-by: shj <[email protected]> --- shj (2): fs/squashfs: fix integer overflow in directory table allocation test: squashfs: add directory table overflow regression test fs/squashfs/sqfs.c | 23 +++++-- .../test_fs/test_squashfs/test_sqfs_overflow.py | 75 ++++++++++++++++++++++ 2 files changed, 94 insertions(+), 4 deletions(-) --- base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1 change-id: 20260723-sqfs-oob-fix-e202a643c3d8 Best regards, -- shj <[email protected]>
