On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote: > It works well, thanks for your work.
Can you please provide a Tested-by? Thanks! > > > Miquel Raynal <miquel.ray...@bootlin.com> 于2022年6月3日周五 23:26写道： > > > > Following Jincheng's report, an out-of-band write leading to arbitrary > > code execution is possible because on one side the squashfs logic > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic > > accepts directory names up to 255 bytes long. > > > > Prevent such an exploit from happening by capping directory name sizes > > to 255. Use a define for this purpose so that developers can link the > > limitation to its source and eventually kill it some day by dynamically > > allocating this array (if ever desired). > > > > Link: > > https://lore.kernel.org/all/CALO=dhfb+yboxxvr5kcsk0ifdg+e7ywko4-e+72kjbcs8jb...@mail.gmail.com > > Reported-by: Jincheng Wang <jc.w...@gmail.com> > > Signed-off-by: Miquel Raynal <miquel.ray...@bootlin.com> > > --- > > > > Hello Jincheng, can you please give this fix a try? > > > > Thanks! > > Miquèl > > > > fs/squashfs/sqfs.c | 8 +++++--- > > include/fs.h | 4 +++- > > 2 files changed, 8 insertions(+), 4 deletions(-) > > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c > > index b4484fa17f5..ee6ac8b3e4d 100644 > > --- a/fs/squashfs/sqfs.c > > +++ b/fs/squashfs/sqfs.c > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct > > fs_dirent **dentp) > > int i_number, offset = 0, ret; > > struct fs_dirent *dent; > > unsigned char *ipos; > > + u16 name_size; > > > > dirs = (struct squashfs_dir_stream *)fs_dirs; > > if (!dirs->size) { > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, > > struct fs_dirent **dentp) > > return -SQFS_STOP_READDIR; > > } > > > > - /* Set entry name */ > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); > > - dent->name[dirs->entry->name_size + 1] = '\0'; > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot > > limitation) */ > > + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - > > 1); > > + strncpy(dent->name, dirs->entry->name, name_size); > > + dent->name[name_size] = '\0'; > > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; > > dirs->entry_count--; > > diff --git a/include/fs.h b/include/fs.h > > index b43f16a692f..2195dc172ec 100644 > > --- a/include/fs.h > > +++ b/include/fs.h > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t > > offset, loff_t len, > > #define FS_DT_REG 8 /* regular file */ > > #define FS_DT_LNK 10 /* symbolic link */ > > > > +#define FS_DIRENT_NAME_LEN 256 > > + > > /** > > * struct fs_dirent - directory entry > > * > > @@ -194,7 +196,7 @@ struct fs_dirent { > > /** change_time: time of last modification */ > > struct rtc_time change_time; > > /** name: file name */ > > - char name[256]; > > + char name[FS_DIRENT_NAME_LEN]; > > }; > > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs layer > > */ > > -- > > 2.34.1 > > -- Tom
signature.asc
Description: PGP signature
