Hi Oscar, On 28/10/2026 at 14:44:27 +01, Oscar Deschamps <[email protected]> wrote:
> sqfs_resolve_symlink() can return NULL, on its symlink_size overflow > guard or on an allocation failure. sqfs_read_nest() and sqfs_size_nest() > use the result without checking it, unlike sqfs_search_dir(), and the > NULL reaches sqfs_split_path() which dereferences path[0]. A crafted or > corrupted image can thus crash U-Boot (a NULL read) while reading or > sizing a file through a symlink. > > Check the result in both callers and guard sqfs_split_path() against a > NULL path. Found by fuzzing the SquashFS parser. > > Signed-off-by: Oscar Deschamps <[email protected]> Thanks for the patch! Reviewed-by: Miquel Raynal <[email protected]> Miquèl
