On Tue, Jul 28, 2026 at 08:55:38AM +0200, Shahriyar Jalayeri wrote: > This fixes an integer overflow in the SquashFS directory-table reader > that leads to a heap out-of-bounds write, and adds a regression test. > > sqfs_read_directory_table() sizes the directory table with an int > multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a > crafted image, under-allocating the buffer that the fill loop then > overruns. It is reached by listing or reading the image (sqfsls / > sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow(); > patch 2 adds a test that a crafted image is rejected. > > Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request. > > Signed-off-by: Shahriyar Jalayeri <[email protected]> > --- > Changes in v2: > - Use my real name in the From and Signed-off-by
Any feedback from the squashfs custodians? Thanks! -- Tom
signature.asc
Description: PGP signature
