fs/squashfs: sqfs_read: Prevent arbitrary code execution
Following Jincheng's report, an out-of-band write leading to arbitrary
code execution is possible because on one side the squashfs logic
accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes
to 255. Use a define for this purpose so that developers can link the
limitation to its source and eventually kill it some day by dynamically
allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Jincheng Wang <jc.w4ng@gmail.com>
diff --git a/include/fs.h b/include/fs.h
index b43f16a..2195dc1 100644
--- a/include/fs.h
+++ b/include/fs.h
@@ -174,6 +174,8 @@
#define FS_DT_REG 8 /* regular file */
#define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
+
/**
* struct fs_dirent - directory entry
*
@@ -194,7 +196,7 @@
/** change_time: time of last modification */
struct rtc_time change_time;
/** name: file name */
- char name[256];
+ char name[FS_DIRENT_NAME_LEN];
};
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */