[PATCH v2 0/2] fs/squashfs: fix directory table integer overflow

This fixes an integer overflow in the SquashFS directory-table reader
that leads to a heap out-of-bounds write, and adds a regression test.

sqfs_read_directory_table() sizes the directory table with an int
multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
crafted image, under-allocating the buffer that the fill loop then
overruns. It is reached by listing or reading the image (sqfsls /
sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
patch 2 adds a test that a crafted image is rejected.

Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v2:
- Use my real name in the From and Signed-off-by

---
Shahriyar Jalayeri (2):
      fs/squashfs: fix integer overflow in directory table allocation
      test: squashfs: add directory table overflow regression test

 fs/squashfs/sqfs.c                                 | 23 +++++--
 .../test_fs/test_squashfs/test_sqfs_overflow.py    | 75 ++++++++++++++++++++++
 2 files changed, 94 insertions(+), 4 deletions(-)
---
base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1
change-id: 20260723-sqfs-oob-fix-e202a643c3d8

Best regards,
--  
Shahriyar Jalayeri <[email protected]>