diff options
| author | Miquel Raynal <miquel.raynal@bootlin.com> | 2022-06-09 16:02:06 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2022-06-16 15:22:55 -0400 |
| commit | 2ac0baab4aff1a0b45067d0b62f00c15f4e86856 (patch) | |
| tree | 4d2ecceeb23f7a4e7221cf85c98022cec89d50ce /include/fs.h | |
| parent | e744bf3a4ba442a0e9ee1c509c70e1452e3a15d0 (diff) | |
fs/squashfs: sqfs_read: Prevent arbitrary code execution
Following Jincheng's report, an out-of-band write leading to arbitrary
code execution is possible because on one side the squashfs logic
accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes
to 255. Use a define for this purpose so that developers can link the
limitation to its source and eventually kill it some day by dynamically
allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Jincheng Wang <jc.w4ng@gmail.com>
Diffstat (limited to 'include/fs.h')
| -rw-r--r-- | include/fs.h | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/include/fs.h b/include/fs.h index b43f16a692f..2195dc172ec 100644 --- a/include/fs.h +++ b/include/fs.h @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len, #define FS_DT_REG 8 /* regular file */ #define FS_DT_LNK 10 /* symbolic link */ +#define FS_DIRENT_NAME_LEN 256 + /** * struct fs_dirent - directory entry * @@ -194,7 +196,7 @@ struct fs_dirent { /** change_time: time of last modification */ struct rtc_time change_time; /** name: file name */ - char name[256]; + char name[FS_DIRENT_NAME_LEN]; }; /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */ |