Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()

Browse Source 
sqfs_frag_lookup() reads a 16-bit metadata block header whose lower
15 bits encode the data size. Unlike sqfs_read_metablock() in
sqfs_inode.c, this function does not validate that the decoded size is
within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can
set the size field to any value up to 32767, causing memcpy to write
past the 8192-byte 'entries' heap buffer.

Add the same bounds check used by sqfs_read_metablock(): reject any
metadata block header with SQFS_METADATA_SIZE(header) exceeding
SQFS_METADATA_BLOCK_SIZE.

Found by fuzzing with libFuzzer + AddressSanitizer.

Signed-off-by: Eric Kilmer <eric.kilmer@trailofbits.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Eric Kilmer
2026-02-20 14:48:08 -05:00
committed by Tom Rini
parent 30b8c03d8c
commit e365a269df
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
fs/squashfs/sqfs.c
View File

@@ -178,6 +178,11 @@ static int sqfs_frag_lookup(u32 inode_fragment_index,
goto out;
}
if (SQFS_METADATA_SIZE(header) > SQFS_METADATA_BLOCK_SIZE) {
ret = -EINVAL;
goto out;
}
entries = malloc(SQFS_METADATA_BLOCK_SIZE);
if (!entries) {
ret = -ENOMEM;