squashfs: Fix heap corruption in sqfs_search_dir()
authorRichard Weinberger <richard@nod.at>
Fri, 2 Aug 2024 20:05:09 +0000 (22:05 +0200)
committerRaspbian forward porter <root@raspbian.org>
Mon, 18 May 2026 02:33:18 +0000 (02:33 +0000)
commit3c704d547435db96dd5603e1ba3d1b8fa1a951b9
tree5c817a0cdfa5c47bac8d06911420c1d0f80e4873
parent38a936cc643b13bf592ef334c28ecde21ff8d367
squashfs: Fix heap corruption in sqfs_search_dir()

res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e
Bug: https://www.openwall.com/lists/oss-security/2025/02/17/2
Bug-Debian: https://bugs.debian.org/1098254
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-57259
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2024-57259

Gbp-Pq: Name CVE-2024-57259.patch
fs/squashfs/sqfs.c