Re: [PATCH v1 0/2] fs/squashfs: bounds checks on image-controlled offsets

Le 16/08/2026 à 00:01, Pranav Rajendran a écrit :
> Two out-of-bounds reads reachable from a crafted SquashFS image, found
> while auditing fs/squashfs for image-controlled values used as buffer
> offsets without validation. Both were reported to the list earlier; these
> are the fixes.
> 
> Patch 1 covers sqfs_frag_lookup(), where the fragment index is checked
> only against a superblock field that is itself part of the image, and
> every subsequent access derived from it is unchecked against the buffer
> that was actually read.
> 
> Patch 2 covers sqfs_dir_offset(). Commit 57e0bb7bf00d ("fs/squashfs: add
> sqfs_dir_offset() error checks") addressed the negative return value; the
> positive range is still unbounded, and the callers use it to index the
> directory table.
> 
> Neither patch changes behaviour for well-formed images: the rejected
> cases all describe inodes that reference data outside the tables the
> superblock declares.
> 
> checkpatch-clean, builds for sandbox with no new warnings at W=1, and
> test_sqfs_ls and test_sqfs_load both pass against images generated by
> mksquashfs 4.6.1 (the default plus the three lzo fragment variants).
> 
> Review of the exact bounds is welcome, in particular whether patch 2 is
> too strict in rejecting a directory header that would start within the
> last SQFS_DIR_HEADER_SIZE bytes of the directory table.
> 
> Pranav Rajendran (2):
>    fs/squashfs: bound fragment table accesses in sqfs_frag_lookup()
>    fs/squashfs: bound the offset returned by sqfs_dir_offset()
> 
>   fs/squashfs/sqfs.c     | 50 ++++++++++++++++++++++++++++++++++++++++--
>   fs/squashfs/sqfs_dir.c | 42 ++++++++++++++++++++++++++++++-----
>   2 files changed, 84 insertions(+), 8 deletions(-)
> 
Seems all good!

Reviewed-by: Richard Genoud <[email protected]>

Thanks!