| commit | 18ef5f3b94048ee4e6849d908a1deed015776734 | [log] [tgz] |
|---|---|---|
| author | Richard Weinberger <richard@nod.at> | Fri Aug 02 18:36:44 2024 +0200 |
| committer | Tom Rini <trini@konsulko.com> | Thu Aug 15 16:14:36 2024 -0600 |
| tree | 2e35b6347ffc0135cd9b75c181bd6f482eee641c | |
| parent | 25c5843ad5762d0ccaab03f3c516035cd48d21d1 [diff] |
squashfs: Fix integer overflow in sqfs_resolve_symlink() A carefully crafted squashfs filesystem can exhibit an inode size of 0xffffffff, as a consequence malloc() will do a zero allocation. Later in the function the inode size is again used for copying data. So an attacker can overwrite memory. Avoid the overflow by using the __builtin_add_overflow() helper. Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>