* [PATCH] squashfs: Fix heap corruption in sqfs_search_dir()
@ 2024-08-02 20:05 Richard Weinberger
2024-08-12 7:52 ` Miquel Raynal
2024-08-16 3:47 ` Tom Rini
0 siblings, 2 replies; 3+ messages in thread
From: Richard Weinberger @ 2024-08-02 20:05 UTC (permalink / raw)
To: u-boot
Cc: upstream+uboot, trini, miquel.raynal, thomas.petazzoni,
jmcosta944, Richard Weinberger
res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.
Signed-off-by: Richard Weinberger <richard@nod.at>
---
fs/squashfs/sqfs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index af7ff80a7b..b9314019b1 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -567,8 +567,11 @@ static int sqfs_search_dir(struct squashfs_dir_stream *dirs, char **token_list,
ret = -ENOMEM;
goto out;
}
- /* Concatenate remaining tokens and symlink's target */
- res = malloc(strlen(rem) + strlen(target) + 1);
+ /*
+ * Concatenate remaining tokens and symlink's target.
+ * Allocate enough space for rem, target, '/' and '\0'.
+ */
+ res = malloc(strlen(rem) + strlen(target) + 2);
if (!res) {
ret = -ENOMEM;
goto out;
--
2.35.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] squashfs: Fix heap corruption in sqfs_search_dir()
2024-08-02 20:05 [PATCH] squashfs: Fix heap corruption in sqfs_search_dir() Richard Weinberger
@ 2024-08-12 7:52 ` Miquel Raynal
2024-08-16 3:47 ` Tom Rini
1 sibling, 0 replies; 3+ messages in thread
From: Miquel Raynal @ 2024-08-12 7:52 UTC (permalink / raw)
To: Richard Weinberger
Cc: u-boot, upstream+uboot, trini, thomas.petazzoni, jmcosta944
Hi Richard,
richard@nod.at wrote on Fri, 2 Aug 2024 22:05:09 +0200:
> res needs to be large enough to store both strings rem and target,
> plus the path separator and the terminator.
> Currently the space for the path separator is not accounted, so
> the heap is corrupted by one byte.
Mmm, subtle.
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Thanks for the fix!
Miquèl
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] squashfs: Fix heap corruption in sqfs_search_dir()
2024-08-02 20:05 [PATCH] squashfs: Fix heap corruption in sqfs_search_dir() Richard Weinberger
2024-08-12 7:52 ` Miquel Raynal
@ 2024-08-16 3:47 ` Tom Rini
1 sibling, 0 replies; 3+ messages in thread
From: Tom Rini @ 2024-08-16 3:47 UTC (permalink / raw)
To: u-boot, Richard Weinberger
Cc: upstream+uboot, miquel.raynal, thomas.petazzoni, jmcosta944
On Fri, 02 Aug 2024 22:05:09 +0200, Richard Weinberger wrote:
> res needs to be large enough to store both strings rem and target,
> plus the path separator and the terminator.
> Currently the space for the path separator is not accounted, so
> the heap is corrupted by one byte.
>
>
Applied to u-boot/next, thanks!
--
Tom
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-08-16 3:48 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-08-02 20:05 [PATCH] squashfs: Fix heap corruption in sqfs_search_dir() Richard Weinberger
2024-08-12 7:52 ` Miquel Raynal
2024-08-16 3:47 ` Tom Rini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox