Re: [PATCH v2 0/2] fs/squashfs: fix directory table integer overflow

On Tue, 28 Jul 2026 08:55:38 +0200, Shahriyar Jalayeri wrote:

> This fixes an integer overflow in the SquashFS directory-table reader
> that leads to a heap out-of-bounds write, and adds a regression test.
> 
> sqfs_read_directory_table() sizes the directory table with an int
> multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
> crafted image, under-allocating the buffer that the fill loop then
> overruns. It is reached by listing or reading the image (sqfsls /
> sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
> patch 2 adds a test that a crafted image is rejected.
> 
> [...]

Applied to u-boot/main, thanks!

[1/2] fs/squashfs: fix integer overflow in directory table allocation
      commit: 561ae28cb56a082cfa90c1c421c4955bc215470b
[2/2] test: squashfs: add directory table overflow regression test
      commit: 4750bcfe857c5a0feda86b54f260a11a4e3222cd
-- 
Tom