Le 16/08/2026 à 00:01, Pranav Rajendran a écrit :
Two out-of-bounds reads reachable from a crafted SquashFS image, found while auditing fs/squashfs for image-controlled values used as buffer offsets without validation. Both were reported to the list earlier; these are the fixes.Patch 1 covers sqfs_frag_lookup(), where the fragment index is checked only against a superblock field that is itself part of the image, and every subsequent access derived from it is unchecked against the buffer that was actually read. Patch 2 covers sqfs_dir_offset(). Commit 57e0bb7bf00d ("fs/squashfs: add sqfs_dir_offset() error checks") addressed the negative return value; the positive range is still unbounded, and the callers use it to index the directory table. Neither patch changes behaviour for well-formed images: the rejected cases all describe inodes that reference data outside the tables the superblock declares. checkpatch-clean, builds for sandbox with no new warnings at W=1, and test_sqfs_ls and test_sqfs_load both pass against images generated by mksquashfs 4.6.1 (the default plus the three lzo fragment variants). Review of the exact bounds is welcome, in particular whether patch 2 is too strict in rejecting a directory header that would start within the last SQFS_DIR_HEADER_SIZE bytes of the directory table. Pranav Rajendran (2): fs/squashfs: bound fragment table accesses in sqfs_frag_lookup() fs/squashfs: bound the offset returned by sqfs_dir_offset() fs/squashfs/sqfs.c | 50 ++++++++++++++++++++++++++++++++++++++++-- fs/squashfs/sqfs_dir.c | 42 ++++++++++++++++++++++++++++++----- 2 files changed, 84 insertions(+), 8 deletions(-)
Seems all good! Reviewed-by: Richard Genoud <[email protected]> Thanks!
