Re: [PATCH v2 0/2] fs/squashfs: fix directory table integer overflow

[Tom Rini <trini@konsulko.com>]

[-- Attachment #1: Type: text/plain, Size: 923 bytes --]

On Tue, Jul 28, 2026 at 08:55:38AM +0200, Shahriyar Jalayeri wrote:

> This fixes an integer overflow in the SquashFS directory-table reader
> that leads to a heap out-of-bounds write, and adds a regression test.
> 
> sqfs_read_directory_table() sizes the directory table with an int
> multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
> crafted image, under-allocating the buffer that the fill loop then
> overruns. It is reached by listing or reading the image (sqfsls /
> sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
> patch 2 adds a test that a crafted image is rejected.
> 
> Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.
> 
> Signed-off-by: Shahriyar Jalayeri <shahriyar@byteray.co.uk>
> ---
> Changes in v2:
> - Use my real name in the From and Signed-off-by

Any feedback from the squashfs custodians? Thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]