Re: [PATCH v2 0/2] fs/squashfs: fix directory table integer overflow

On Tue, Jul 28, 2026 at 08:55:38AM +0200, Shahriyar Jalayeri wrote:

> This fixes an integer overflow in the SquashFS directory-table reader
> that leads to a heap out-of-bounds write, and adds a regression test.
> 
> sqfs_read_directory_table() sizes the directory table with an int
> multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
> crafted image, under-allocating the buffer that the fill loop then
> overruns. It is reached by listing or reading the image (sqfsls /
> sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
> patch 2 adds a test that a crafted image is rejected.
> 
> Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.
> 
> Signed-off-by: Shahriyar Jalayeri <[email protected]>
> ---
> Changes in v2:
> - Use my real name in the From and Signed-off-by

Any feedback from the squashfs custodians? Thanks!

-- 
Tom

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTzzqh0PWDgGS+bTHor4qD1Cr/kCgUCao9pfQAKCRAr4qD1Cr/k
CrokAP4mPqKpijhJ0Bps75sRAmXdFTiDBRxBGDx1u/l3bxMvowEAr5X7INro10u0
vSJ6MvMr8/WjapFe5WPLSONXksDlXQw=
=Otb0
-----END PGP SIGNATURE-----