Re: [PATCH 0/2] fs/squashfs: fix two out-of-bounds reads on crafted images

On Fri, 12 Jun 2026 13:24:22 +0530, Piyush Paliwal wrote:

> Two independent out-of-bounds reads in the SquashFS driver, both reachable
> by pointing U-Boot at an attacker-supplied image (e.g. ls/load on a crafted
> USB/SD/netboot rootfs). Either one crashes the bootloader (DoS); patch 2 can
> also copy adjacent heap memory into the loaded file (information disclosure).
> 
>   1/2 sqfs_find_inode()/sqfs_inode_size() walk the decompressed inode table
>       using on-disk sizes with no check that the cursor stays inside the
>       buffer -> wild read / SEGV, e.g. from a simple "ls".
>   2/2 sqfs_read_nest() uses the on-disk fragment offset as an unbounded
>       source index into the fragment block -> out-of-bounds heap read when
>       loading a fragment-backed file.
> 
> [...]

Applied to u-boot/main, thanks!

[1/2] fs/squashfs: bound the inode table walk in sqfs_find_inode()
      commit: 73ada2f433a99fb2f443bb76268f5ab023b11868
[2/2] fs/squashfs: bound fragment offset/size in sqfs_read_nest()
      commit: 923f05ed3e231c51f259bee6e2ac823bdaf1c566
-- 
Tom