2ac0baab4a
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang <jc.w4ng@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Tested-by: Jincheng Wang <jc.w4ng@gmail.com> |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| sqfs_decompressor.c | ||
| sqfs_decompressor.h | ||
| sqfs_dir.c | ||
| sqfs_filesystem.h | ||
| sqfs_inode.c | ||
| sqfs_utils.h | ||
| sqfs.c | ||