squashfs: Fix heap corruption in sqfs_search_dir()
authorRichard Weinberger <richard@nod.at>
Fri, 2 Aug 2024 20:05:09 +0000 (22:05 +0200)
committerDaniel Leidert <dleidert@debian.org>
Sun, 29 Jun 2025 00:33:57 +0000 (02:33 +0200)
commitf07d7af903a8bbad4eb4543fa7b5829418e597a2
treede1bed3fe276b61f9214a0d64a0edd76bfc197b9
parentb0b14d42f7c5a2f51c25b014c75c839dae5aa56b
squashfs: Fix heap corruption in sqfs_search_dir()

res needs to be large enough to store both strings rem and target,
plus the path separator and the terminator.
Currently the space for the path separator is not accounted, so
the heap is corrupted by one byte.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-By: Daniel Leidert <dleidert@debian.org>
Origin: https://source.denx.de/u-boot/u-boot/-/commit/048d795bb5b3d9c5701b4855f5e74bcf6849bf5e
Bug: https://www.openwall.com/lists/oss-security/2025/02/17/2
Bug-Debian: https://bugs.debian.org/1098254
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2024-57259
Bug-Freexian-Security: https://deb.freexian.com/extended-lts/tracker/CVE-2024-57259

Gbp-Pq: Name CVE-2024-57259.patch
fs/squashfs/sqfs.c