leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs/squashfs: sqfs_read: Prevent arbitrary code execution

Browse Source 
Following Jincheng's report, an out-of-band write leading to arbitrary
code execution is possible because on one side the squashfs logic
accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
accepts directory names up to 255 bytes long.

Prevent such an exploit from happening by capping directory name sizes
to 255. Use a define for this purpose so that developers can link the
limitation to its source and eventually kill it some day by dynamically
allocating this array (if ever desired).

Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Jincheng Wang <jc.w4ng@gmail.com>
This commit is contained in:
Miquel Raynal 2022-06-09 16:02:06 +02:00 committed by Tom Rini
parent e744bf3a4b
commit 2ac0baab4a
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
fs/squashfs/sqfs.c
View File

@ -975,6 +975,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
int i_number, offset = 0, ret; int i_number, offset = 0, ret;
struct fs_dirent *dent; struct fs_dirent *dent;
unsigned char *ipos; unsigned char *ipos;
u16 name_size;
dirs = (struct squashfs_dir_stream *)fs_dirs; dirs = (struct squashfs_dir_stream *)fs_dirs;
if (!dirs->size) { if (!dirs->size) {
@ -1057,9 +1058,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
return -SQFS_STOP_READDIR; return -SQFS_STOP_READDIR;
} }
/* Set entry name */ /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */
strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1); name_size = min_t(u16, dirs->entry->name_size + 1, FS_DIRENT_NAME_LEN - 1);
dent->name[dirs->entry->name_size + 1] = '\0'; strncpy(dent->name, dirs->entry->name, name_size);
dent->name[name_size] = '\0';
offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH; offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
dirs->entry_count--; dirs->entry_count--;

4
include/fs.h
View File

@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
#define FS_DT_REG 8 /* regular file */ #define FS_DT_REG 8 /* regular file */
#define FS_DT_LNK 10 /* symbolic link */ #define FS_DT_LNK 10 /* symbolic link */
#define FS_DIRENT_NAME_LEN 256
/** /**
* struct fs_dirent - directory entry * struct fs_dirent - directory entry
* *
@ -194,7 +196,7 @@ struct fs_dirent {
/** change_time: time of last modification */ /** change_time: time of last modification */
struct rtc_time change_time; struct rtc_time change_time;
/** name: file name */ /** name: file name */
char name[256]; char name[FS_DIRENT_NAME_LEN];
}; };
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */ /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */