On Thu, Jun 09, 2022 at 04:02:06PM +0200, Miquel Raynal wrote:
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JB... Reported-by: Jincheng Wang jc.w4ng@gmail.com Signed-off-by: Miquel Raynal miquel.raynal@bootlin.com Tested-by: Jincheng Wang jc.w4ng@gmail.com
Applied to u-boot/master, thanks!