On Mon, 13 Jul 2026 16:22:41 +0200, Allan ELKAIM wrote:
> sqfsload fails to load a file through a symlink when the squashfs
> image contains a large number of inodes (e.g. a rootfs that includes
> the tzdata timezone database).
>
> Root cause: sqfs_read_nest() resolves the symlink by calling itself
> recursively without first freeing the parent directory's inode and
> directory table buffers. This causes a temporary double allocation
> that can exhaust the U-Boot heap. When malloc() subsequently fails
> inside sqfs_read_directory_table(), the error goes undetected and
> sqfs_search_dir() is called with a NULL pos_list pointer, leading to:
>
> [...]
Applied to u-boot/main, thanks!
[1/3] fs/squashfs: fix heap exhaustion during symlink resolution
commit: 9a9d46cb5e1a8f600c52f3ddaeaca8d4f28f66ee
[2/3] fs/squashfs: add sqfs_dir_offset() error checks
commit: 57e0bb7bf00dadd7537f93609afb955108ce22c7
[3/3] fs/squashfs: fix dirs->entry leaks on sqfs_search_dir() error paths
commit: 171b604888537dd7112ffddaa13abb16932eabd0
--
Tom
