Two out-of-bounds reads reachable from a crafted SquashFS image, found
while auditing fs/squashfs for image-controlled values used as buffer
offsets without validation. Both were reported to the list earlier; these
are the fixes.
Patch 1 covers sqfs_frag_lookup(), where the fragment index is checked
only against a superblock field that is itself part of the image, and
every subsequent access derived from it is unchecked against the buffer
that was actually read.
Patch 2 covers sqfs_dir_offset(). Commit 57e0bb7bf00d ("fs/squashfs: add
sqfs_dir_offset() error checks") addressed the negative return value; the
positive range is still unbounded, and the callers use it to index the
directory table.
Neither patch changes behaviour for well-formed images: the rejected
cases all describe inodes that reference data outside the tables the
superblock declares.
checkpatch-clean, builds for sandbox with no new warnings at W=1, and
test_sqfs_ls and test_sqfs_load both pass against images generated by
mksquashfs 4.6.1 (the default plus the three lzo fragment variants).
Review of the exact bounds is welcome, in particular whether patch 2 is
too strict in rejecting a directory header that would start within the
last SQFS_DIR_HEADER_SIZE bytes of the directory table.
Pranav Rajendran (2):
fs/squashfs: bound fragment table accesses in sqfs_frag_lookup()
fs/squashfs: bound the offset returned by sqfs_dir_offset()
fs/squashfs/sqfs.c | 50 ++++++++++++++++++++++++++++++++++++++++--
fs/squashfs/sqfs_dir.c | 42 ++++++++++++++++++++++++++++++-----
2 files changed, 84 insertions(+), 8 deletions(-)
--
2.50.1 (Apple Git-155)
