Le 27/08/2026 à 00:32, Tom Rini a écrit :
On Tue, Jul 28, 2026 at 08:55:38AM +0200, Shahriyar Jalayeri wrote:
This fixes an integer overflow in the SquashFS directory-table reader
that leads to a heap out-of-bounds write, and adds a regression test.
sqfs_read_directory_table() sizes the directory table with an int
multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
crafted image, under-allocating the buffer that the fill loop then
overruns. It is reached by listing or reading the image (sqfsls /
sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
patch 2 adds a test that a crafted image is rejected.
Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.
Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v2:
- Use my real name in the From and Signed-off-by
Any feedback from the squashfs custodians? Thanks!
Nice patch, looks great!
Reviewed-by: Richard Genoud <[email protected]>
