squashfs: Fix heap corruption in sqfs_search_dir()
authorRichard Weinberger <richard@nod.at>
Fri, 2 Aug 2024 20:05:09 +0000 (22:05 +0200)
committerAndreas Henriksson <andreas@fatal.se>
Tue, 23 Jun 2026 19:07:40 +0000 (21:07 +0200)
commitbc8332a89eab18ed555b036840ee48d5c8e8b219
tree47a79b18cf2a7e7dbf13d607e7f3a5558adebc1a
parent9bcc83bd313a599e2a360d1e1fbbda869eaebdf3
squashfs: Fix heap corruption in sqfs_search_dir()

res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e
Bug: https://www.openwall.com/lists/oss-security/2025/02/17/2
Bug-Debian: https://bugs.debian.org/1098254
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-57259
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2024-57259

Gbp-Pq: Name CVE-2024-57259.patch
fs/squashfs/sqfs.c