On 29/10/2026 at 16:39:40 +01, Oscar Deschamps <[email protected]> wrote:
> The three directory-search loops in sqfs.c use the local `ret` to tell > whether the requested name was found. When the loop runs zero times > `ret` keeps the 0 left by the preceding sqfs_opendir_nest(), > so the "not found" check is skipped and the NULL dirs->entry > is dereferenced (dirs->entry->inode_offset). A crafted or corrupted image > can thus crash U-Boot (a NULL read) while resolving, > reading or sizing a path. > > Treat a loop that produced no entry as "not found" in sqfs_search_dir(), > sqfs_read_nest() and sqfs_size_nest(). Found by fuzzing the SquashFS > parser. > > Signed-off-by: Oscar Deschamps <[email protected]> Reviewed-by: Miquel Raynal <[email protected]>
