All of lore.kernel.org
 help / color / mirror / Atom feed
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Eric Kilmer <eric.kilmer@trailofbits.com>
Cc: u-boot@lists.denx.de,  jmcosta944@gmail.com,
	thomas.petazzoni@bootlin.com,  trini@konsulko.com
Subject: Re: [PATCH 1/1] fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup()
Date: Mon, 23 Feb 2026 09:42:19 +0100	[thread overview]
Message-ID: <87zf4zrgus.fsf@bootlin.com> (raw)
In-Reply-To: <20260220194808.1146082-2-eric.kilmer@trailofbits.com> (Eric Kilmer's message of "Fri, 20 Feb 2026 14:48:08 -0500")

On 20/02/2026 at 14:48:08 -05, Eric Kilmer <eric.kilmer@trailofbits.com> wrote:

> sqfs_frag_lookup() reads a 16-bit metadata block header whose lower
> 15 bits encode the data size. Unlike sqfs_read_metablock() in
> sqfs_inode.c, this function does not validate that the decoded size is
> within SQFS_METADATA_BLOCK_SIZE (8192). A malformed SquashFS image can
> set the size field to any value up to 32767, causing memcpy to write
> past the 8192-byte 'entries' heap buffer.
>
> Add the same bounds check used by sqfs_read_metablock(): reject any
> metadata block header with SQFS_METADATA_SIZE(header) exceeding
> SQFS_METADATA_BLOCK_SIZE.
>
> Found by fuzzing with libFuzzer + AddressSanitizer.
>
> Signed-off-by: Eric Kilmer <eric.kilmer@trailofbits.com>

Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>

Thanks!
Miquèl

  reply	other threads:[~2026-02-23 10:02 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-02-20 19:48 [PATCH 0/1] fs/squashfs: fix heap buffer overflow in sqfs_frag_lookup() Eric Kilmer
2026-02-20 19:48 ` [PATCH 1/1] " Eric Kilmer
2026-02-23  8:42   ` Miquel Raynal [this message]
2026-02-23 20:28   ` Tom Rini

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87zf4zrgus.fsf@bootlin.com \
    --to=miquel.raynal@bootlin.com \
    --cc=eric.kilmer@trailofbits.com \
    --cc=jmcosta944@gmail.com \
    --cc=thomas.petazzoni@bootlin.com \
    --cc=trini@konsulko.com \
    --cc=u-boot@lists.denx.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.