Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-30 08:07:59 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

squashfs: Fix integer overflow in sqfs_resolve_symlink()

Browse source 
A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff,
as a consequence malloc() will do a zero allocation.
Later in the function the inode size is again used for copying data.
So an attacker can overwrite memory.
Avoid the overflow by using the __builtin_add_overflow() helper.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Richard Weinberger 2024-08-02 18:36:44 +02:00 • committed by Tom Rini
parent 9b9368b5c4
commit 233945eba6
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
fs/squashfs/sqfs.c
View file

@ -422,8 +422,10 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
char *resolved, *target; char *resolved, *target;
u32 sz; u32 sz;
sz = get_unaligned_le32(&sym->symlink_size); if (__builtin_add_overflow(get_unaligned_le32(&sym->symlink_size), 1, &sz))
target = malloc(sz + 1); return NULL;
target = malloc(sz);
if (!target) if (!target)
return NULL; return NULL;
@ -431,9 +433,9 @@ static char *sqfs_resolve_symlink(struct squashfs_symlink_inode *sym,
* There is no trailling null byte in the symlink's target path, so a * There is no trailling null byte in the symlink's target path, so a
* copy is made and a '\0' is added at its end. * copy is made and a '\0' is added at its end.
*/ */
target[sz] = '\0'; target[sz - 1] = '\0';
/* Get target name (relative path) */ /* Get target name (relative path) */
strncpy(target, sym->symlink, sz); strncpy(target, sym->symlink, sz - 1);
/* Relative -> absolute path conversion */ /* Relative -> absolute path conversion */
resolved = sqfs_get_abs_path(base_path, target); resolved = sqfs_get_abs_path(base_path, target);