Re: [PATCH v1 0/2] fs/squashfs: bounds checks on image-controlled offsets

On Sat, 15 Aug 2026 23:01:13 +0100, Pranav Rajendran wrote:

> Two out-of-bounds reads reachable from a crafted SquashFS image, found
> while auditing fs/squashfs for image-controlled values used as buffer
> offsets without validation. Both were reported to the list earlier; these
> are the fixes.
> 
> Patch 1 covers sqfs_frag_lookup(), where the fragment index is checked
> only against a superblock field that is itself part of the image, and
> every subsequent access derived from it is unchecked against the buffer
> that was actually read.
> 
> [...]

Applied to u-boot/main, thanks!

[1/2] fs/squashfs: bound fragment table accesses in sqfs_frag_lookup()
      commit: fc557ef9fe116b3245265629cf1d3ab4ac7a480c
[2/2] fs/squashfs: bound the offset returned by sqfs_dir_offset()
      commit: e007b43a272edae8a63ad66f0151ceaf8cf003c1
-- 
Tom