Re: [PATCH v2 0/2] fs/squashfs: fix directory table integer overflow

[Richard GENOUD <richard.genoud@bootlin.com>]

Le 27/08/2026 à 00:32, Tom Rini a écrit :
> On Tue, Jul 28, 2026 at 08:55:38AM +0200, Shahriyar Jalayeri wrote:
> 
>> This fixes an integer overflow in the SquashFS directory-table reader
>> that leads to a heap out-of-bounds write, and adds a regression test.
>>
>> sqfs_read_directory_table() sizes the directory table with an int
>> multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
>> crafted image, under-allocating the buffer that the fill loop then
>> overruns. It is reached by listing or reading the image (sqfsls /
>> sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
>> patch 2 adds a test that a crafted image is rejected.
>>
>> Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.
>>
>> Signed-off-by: Shahriyar Jalayeri <shahriyar@byteray.co.uk>
>> ---
>> Changes in v2:
>> - Use my real name in the From and Signed-off-by
> 
> Any feedback from the squashfs custodians? Thanks!
> 
Nice patch, looks great!

Reviewed-by: Richard Genoud <richard.genoud@bootlin.com>