* [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
@ 2022-06-03 15:26 Miquel Raynal
2022-06-07 10:00 ` Jincheng Wang
0 siblings, 1 reply; 5+ messages in thread
From: Miquel Raynal @ 2022-06-03 15:26 UTC (permalink / raw)
To: Thomas Petazzoni; +Cc: Joao Marcos Costa, u-boot, Miquel Raynal, Jincheng Wang
Following Jincheng's report, an out-of-band write leading to arbitrary
code execution is possible because on one side the squashfs logic
accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
accepts directory names up to 255 bytes long.
Prevent such an exploit from happening by capping directory name sizes
to 255. Use a define for this purpose so that developers can link the
limitation to its source and eventually kill it some day by dynamically
allocating this array (if ever desired).
Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
---
Hello Jincheng, can you please give this fix a try?
Thanks!
Miquèl
fs/squashfs/sqfs.c | 8 +++++---
include/fs.h | 4 +++-
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index b4484fa17f5..ee6ac8b3e4d 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
int i_number, offset = 0, ret;
struct fs_dirent *dent;
unsigned char *ipos;
+ u16 name_size;
dirs = (struct squashfs_dir_stream *)fs_dirs;
if (!dirs->size) {
@@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
return -SQFS_STOP_READDIR;
}
- /* Set entry name */
- strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);
- dent->name[dirs->entry->name_size + 1] = '\0';
+ /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */
+ name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1);
+ strncpy(dent->name, dirs->entry->name, name_size);
+ dent->name[name_size] = '\0';
offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
dirs->entry_count--;
diff --git a/include/fs.h b/include/fs.h
index b43f16a692f..2195dc172ec 100644
--- a/include/fs.h
+++ b/include/fs.h
@@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
#define FS_DT_REG 8 /* regular file */
#define FS_DT_LNK 10 /* symbolic link */
+#define FS_DIRENT_NAME_LEN 256
+
/**
* struct fs_dirent - directory entry
*
@@ -194,7 +196,7 @@ struct fs_dirent {
/** change_time: time of last modification */
struct rtc_time change_time;
/** name: file name */
- char name[256];
+ char name[FS_DIRENT_NAME_LEN];
};
/* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
2022-06-03 15:26 [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution Miquel Raynal
@ 2022-06-07 10:00 ` Jincheng Wang
2022-06-07 13:43 ` Tom Rini
0 siblings, 1 reply; 5+ messages in thread
From: Jincheng Wang @ 2022-06-07 10:00 UTC (permalink / raw)
Cc: u-boot, thomas.petazzoni, joaomarcos.costa, Miquel Raynal
It works well, thanks for your work.
Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道:
>
> Following Jincheng's report, an out-of-band write leading to arbitrary
> code execution is possible because on one side the squashfs logic
> accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> accepts directory names up to 255 bytes long.
>
> Prevent such an exploit from happening by capping directory name sizes
> to 255. Use a define for this purpose so that developers can link the
> limitation to its source and eventually kill it some day by dynamically
> allocating this array (if ever desired).
>
> Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
> Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> ---
>
> Hello Jincheng, can you please give this fix a try?
>
> Thanks!
> Miquèl
>
> fs/squashfs/sqfs.c | 8 +++++---
> include/fs.h | 4 +++-
> 2 files changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
> index b4484fa17f5..ee6ac8b3e4d 100644
> --- a/fs/squashfs/sqfs.c
> +++ b/fs/squashfs/sqfs.c
> @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
> int i_number, offset = 0, ret;
> struct fs_dirent *dent;
> unsigned char *ipos;
> + u16 name_size;
>
> dirs = (struct squashfs_dir_stream *)fs_dirs;
> if (!dirs->size) {
> @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
> return -SQFS_STOP_READDIR;
> }
>
> - /* Set entry name */
> - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);
> - dent->name[dirs->entry->name_size + 1] = '\0';
> + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */
> + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1);
> + strncpy(dent->name, dirs->entry->name, name_size);
> + dent->name[name_size] = '\0';
>
> offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
> dirs->entry_count--;
> diff --git a/include/fs.h b/include/fs.h
> index b43f16a692f..2195dc172ec 100644
> --- a/include/fs.h
> +++ b/include/fs.h
> @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
> #define FS_DT_REG 8 /* regular file */
> #define FS_DT_LNK 10 /* symbolic link */
>
> +#define FS_DIRENT_NAME_LEN 256
> +
> /**
> * struct fs_dirent - directory entry
> *
> @@ -194,7 +196,7 @@ struct fs_dirent {
> /** change_time: time of last modification */
> struct rtc_time change_time;
> /** name: file name */
> - char name[256];
> + char name[FS_DIRENT_NAME_LEN];
> };
>
> /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
> --
> 2.34.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
2022-06-07 10:00 ` Jincheng Wang
@ 2022-06-07 13:43 ` Tom Rini
2022-06-08 3:37 ` Jincheng Wang
0 siblings, 1 reply; 5+ messages in thread
From: Tom Rini @ 2022-06-07 13:43 UTC (permalink / raw)
To: Jincheng Wang; +Cc: u-boot, thomas.petazzoni, joaomarcos.costa, Miquel Raynal
[-- Attachment #1: Type: text/plain, Size: 3382 bytes --]
On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
> It works well, thanks for your work.
Can you please provide a Tested-by? Thanks!
>
>
> Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道:
> >
> > Following Jincheng's report, an out-of-band write leading to arbitrary
> > code execution is possible because on one side the squashfs logic
> > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> > accepts directory names up to 255 bytes long.
> >
> > Prevent such an exploit from happening by capping directory name sizes
> > to 255. Use a define for this purpose so that developers can link the
> > limitation to its source and eventually kill it some day by dynamically
> > allocating this array (if ever desired).
> >
> > Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
> > Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
> > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> > ---
> >
> > Hello Jincheng, can you please give this fix a try?
> >
> > Thanks!
> > Miquèl
> >
> > fs/squashfs/sqfs.c | 8 +++++---
> > include/fs.h | 4 +++-
> > 2 files changed, 8 insertions(+), 4 deletions(-)
> >
> > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
> > index b4484fa17f5..ee6ac8b3e4d 100644
> > --- a/fs/squashfs/sqfs.c
> > +++ b/fs/squashfs/sqfs.c
> > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
> > int i_number, offset = 0, ret;
> > struct fs_dirent *dent;
> > unsigned char *ipos;
> > + u16 name_size;
> >
> > dirs = (struct squashfs_dir_stream *)fs_dirs;
> > if (!dirs->size) {
> > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs, struct fs_dirent **dentp)
> > return -SQFS_STOP_READDIR;
> > }
> >
> > - /* Set entry name */
> > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size + 1);
> > - dent->name[dirs->entry->name_size + 1] = '\0';
> > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a U-Boot limitation) */
> > + name_size = min_t(u16, dirs->entry->name_size, FS_DIRENT_NAME_LEN - 1);
> > + strncpy(dent->name, dirs->entry->name, name_size);
> > + dent->name[name_size] = '\0';
> >
> > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
> > dirs->entry_count--;
> > diff --git a/include/fs.h b/include/fs.h
> > index b43f16a692f..2195dc172ec 100644
> > --- a/include/fs.h
> > +++ b/include/fs.h
> > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr, loff_t offset, loff_t len,
> > #define FS_DT_REG 8 /* regular file */
> > #define FS_DT_LNK 10 /* symbolic link */
> >
> > +#define FS_DIRENT_NAME_LEN 256
> > +
> > /**
> > * struct fs_dirent - directory entry
> > *
> > @@ -194,7 +196,7 @@ struct fs_dirent {
> > /** change_time: time of last modification */
> > struct rtc_time change_time;
> > /** name: file name */
> > - char name[256];
> > + char name[FS_DIRENT_NAME_LEN];
> > };
> >
> > /* Note: fs_dir_stream should be treated as opaque to the user of fs layer */
> > --
> > 2.34.1
> >
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
2022-06-07 13:43 ` Tom Rini
@ 2022-06-08 3:37 ` Jincheng Wang
2022-06-08 7:39 ` Miquel Raynal
0 siblings, 1 reply; 5+ messages in thread
From: Jincheng Wang @ 2022-06-08 3:37 UTC (permalink / raw)
To: Tom Rini, Miquel Raynal, joaomarcos.costa, thomas.petazzoni, u-boot
[-- Attachment #1: Type: text/plain, Size: 4962 bytes --]
To be honest, I don't have experience....
Reference to the article "
https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf"
, I tried to do some work.
1. checkpatch (√)
2. no new compile warnings (√)
3. if bug fix, verify the bug is fixed (√)
I tried some vul-samples, and the patch solved them well.
4. if new feature, feature matches documentation (×)
I try some normal samples, and there is a bug. The dir name or
filename loses a byte. You can use the attachment to check it.
I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to
create the squashfs sample.
```before patch
=> ls host 0
BTRFS: superblock end 69632 is larger than device size 4096
BTRFS: superblock end 69632 is larger than device size 4096
11 hello
BTRFS: superblock end 69632 is larger than device size 4096
BTRFS: superblock end 69632 is larger than device size 4096
1 file(s), 0 dir(s)
```
```after patch
=> ls host 0
BTRFS: superblock end 69632 is larger than device size 4096
BTRFS: superblock end 69632 is larger than device size 4096
11 hell
BTRFS: superblock end 69632 is larger than device size 4096
BTRFS: superblock end 69632 is larger than device size 4096
1 file(s), 0 dir(s)
```
Tom Rini <trini@konsulko.com> 于2022年6月7日周二 21:43写道:
> On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
>
> > It works well, thanks for your work.
>
> Can you please provide a Tested-by? Thanks!
>
> >
> >
> > Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道:
> > >
> > > Following Jincheng's report, an out-of-band write leading to arbitrary
> > > code execution is possible because on one side the squashfs logic
> > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> > > accepts directory names up to 255 bytes long.
> > >
> > > Prevent such an exploit from happening by capping directory name sizes
> > > to 255. Use a define for this purpose so that developers can link the
> > > limitation to its source and eventually kill it some day by dynamically
> > > allocating this array (if ever desired).
> > >
> > > Link:
> https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
> > > Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
> > > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> > > ---
> > >
> > > Hello Jincheng, can you please give this fix a try?
> > >
> > > Thanks!
> > > Miquèl
> > >
> > > fs/squashfs/sqfs.c | 8 +++++---
> > > include/fs.h | 4 +++-
> > > 2 files changed, 8 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
> > > index b4484fa17f5..ee6ac8b3e4d 100644
> > > --- a/fs/squashfs/sqfs.c
> > > +++ b/fs/squashfs/sqfs.c
> > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
> struct fs_dirent **dentp)
> > > int i_number, offset = 0, ret;
> > > struct fs_dirent *dent;
> > > unsigned char *ipos;
> > > + u16 name_size;
> > >
> > > dirs = (struct squashfs_dir_stream *)fs_dirs;
> > > if (!dirs->size) {
> > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
> struct fs_dirent **dentp)
> > > return -SQFS_STOP_READDIR;
> > > }
> > >
> > > - /* Set entry name */
> > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size
> + 1);
> > > - dent->name[dirs->entry->name_size + 1] = '\0';
> > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a
> U-Boot limitation) */
> > > + name_size = min_t(u16, dirs->entry->name_size,
> FS_DIRENT_NAME_LEN - 1);
> > > + strncpy(dent->name, dirs->entry->name, name_size);
> > > + dent->name[name_size] = '\0';
> > >
> > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
> > > dirs->entry_count--;
> > > diff --git a/include/fs.h b/include/fs.h
> > > index b43f16a692f..2195dc172ec 100644
> > > --- a/include/fs.h
> > > +++ b/include/fs.h
> > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr,
> loff_t offset, loff_t len,
> > > #define FS_DT_REG 8 /* regular file */
> > > #define FS_DT_LNK 10 /* symbolic link */
> > >
> > > +#define FS_DIRENT_NAME_LEN 256
> > > +
> > > /**
> > > * struct fs_dirent - directory entry
> > > *
> > > @@ -194,7 +196,7 @@ struct fs_dirent {
> > > /** change_time: time of last modification */
> > > struct rtc_time change_time;
> > > /** name: file name */
> > > - char name[256];
> > > + char name[FS_DIRENT_NAME_LEN];
> > > };
> > >
> > > /* Note: fs_dir_stream should be treated as opaque to the user of fs
> layer */
> > > --
> > > 2.34.1
> > >
>
> --
> Tom
>
[-- Attachment #2: normal.sqfs --]
[-- Type: application/octet-stream, Size: 4096 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution
2022-06-08 3:37 ` Jincheng Wang
@ 2022-06-08 7:39 ` Miquel Raynal
0 siblings, 0 replies; 5+ messages in thread
From: Miquel Raynal @ 2022-06-08 7:39 UTC (permalink / raw)
To: Jincheng Wang; +Cc: Tom Rini, joaomarcos.costa, thomas.petazzoni, u-boot
Hi Jincheng,
jc.w4ng@gmail.com wrote on Wed, 8 Jun 2022 11:37:13 +0800:
> To be honest, I don't have experience....
>
> Reference to the article "
> https://events19.linuxfoundation.org/wp-content/uploads/2018/07/may_be_maintainer-2.pdf"
> , I tried to do some work.
>
> 1. checkpatch (√)
> 2. no new compile warnings (√)
> 3. if bug fix, verify the bug is fixed (√)
> I tried some vul-samples, and the patch solved them well.
> 4. if new feature, feature matches documentation (×)
> I try some normal samples, and there is a bug. The dir name or
> filename loses a byte. You can use the attachment to check it.
> I use command " mksquashfs $dir normal.sqfs -noI -noD -noF -noX" to
> create the squashfs sample.
What we are asking for is just you replying plain text to this thread
with this line: "Tested-by: <you> <youraddress>"
This "tag" will automatically be picked-up by the tools used by the
maintainers when applying the patch, to trace who did what.
>
>
> ```before patch
> => ls host 0
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
> 11 hello
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
> 1 file(s), 0 dir(s)
> ```
>
>
> ```after patch
> => ls host 0
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
> 11 hell
> BTRFS: superblock end 69632 is larger than device size 4096
> BTRFS: superblock end 69632 is larger than device size 4096
>
> 1 file(s), 0 dir(s)
> ```
>
>
>
>
>
>
> Tom Rini <trini@konsulko.com> 于2022年6月7日周二 21:43写道:
>
> > On Tue, Jun 07, 2022 at 06:00:38PM +0800, Jincheng Wang wrote:
> >
> > > It works well, thanks for your work.
> >
> > Can you please provide a Tested-by? Thanks!
> >
> > >
> > >
> > > Miquel Raynal <miquel.raynal@bootlin.com> 于2022年6月3日周五 23:26写道:
> > > >
> > > > Following Jincheng's report, an out-of-band write leading to arbitrary
> > > > code execution is possible because on one side the squashfs logic
> > > > accepts directory names up to 65535 bytes (u16), while U-Boot fs logic
> > > > accepts directory names up to 255 bytes long.
> > > >
> > > > Prevent such an exploit from happening by capping directory name sizes
> > > > to 255. Use a define for this purpose so that developers can link the
> > > > limitation to its source and eventually kill it some day by dynamically
> > > > allocating this array (if ever desired).
> > > >
> > > > Link:
> > https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com
> > > > Reported-by: Jincheng Wang <jc.w4ng@gmail.com>
> > > > Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
> > > > ---
> > > >
> > > > Hello Jincheng, can you please give this fix a try?
> > > >
> > > > Thanks!
> > > > Miquèl
> > > >
> > > > fs/squashfs/sqfs.c | 8 +++++---
> > > > include/fs.h | 4 +++-
> > > > 2 files changed, 8 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
> > > > index b4484fa17f5..ee6ac8b3e4d 100644
> > > > --- a/fs/squashfs/sqfs.c
> > > > +++ b/fs/squashfs/sqfs.c
> > > > @@ -976,6 +976,7 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
> > struct fs_dirent **dentp)
> > > > int i_number, offset = 0, ret;
> > > > struct fs_dirent *dent;
> > > > unsigned char *ipos;
> > > > + u16 name_size;
> > > >
> > > > dirs = (struct squashfs_dir_stream *)fs_dirs;
> > > > if (!dirs->size) {
> > > > @@ -1058,9 +1059,10 @@ int sqfs_readdir(struct fs_dir_stream *fs_dirs,
> > struct fs_dirent **dentp)
> > > > return -SQFS_STOP_READDIR;
> > > > }
> > > >
> > > > - /* Set entry name */
> > > > - strncpy(dent->name, dirs->entry->name, dirs->entry->name_size
> > + 1);
> > > > - dent->name[dirs->entry->name_size + 1] = '\0';
> > > > + /* Set entry name (capped at FS_DIRENT_NAME_LEN which is a
> > U-Boot limitation) */
> > > > + name_size = min_t(u16, dirs->entry->name_size,
> > FS_DIRENT_NAME_LEN - 1);
> > > > + strncpy(dent->name, dirs->entry->name, name_size);
> > > > + dent->name[name_size] = '\0';
> > > >
> > > > offset = dirs->entry->name_size + 1 + SQFS_ENTRY_BASE_LENGTH;
> > > > dirs->entry_count--;
> > > > diff --git a/include/fs.h b/include/fs.h
> > > > index b43f16a692f..2195dc172ec 100644
> > > > --- a/include/fs.h
> > > > +++ b/include/fs.h
> > > > @@ -174,6 +174,8 @@ int fs_write(const char *filename, ulong addr,
> > loff_t offset, loff_t len,
> > > > #define FS_DT_REG 8 /* regular file */
> > > > #define FS_DT_LNK 10 /* symbolic link */
> > > >
> > > > +#define FS_DIRENT_NAME_LEN 256
> > > > +
> > > > /**
> > > > * struct fs_dirent - directory entry
> > > > *
> > > > @@ -194,7 +196,7 @@ struct fs_dirent {
> > > > /** change_time: time of last modification */
> > > > struct rtc_time change_time;
> > > > /** name: file name */
> > > > - char name[256];
> > > > + char name[FS_DIRENT_NAME_LEN];
> > > > };
> > > >
> > > > /* Note: fs_dir_stream should be treated as opaque to the user of fs
> > layer */
> > > > --
> > > > 2.34.1
> > > >
> >
> > --
> > Tom
> >
Thanks,
Miquèl
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-06-08 7:39 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-03 15:26 [PATCH] fs/squashfs: sqfs_read: Prevent arbitrary code execution Miquel Raynal
2022-06-07 10:00 ` Jincheng Wang
2022-06-07 13:43 ` Tom Rini
2022-06-08 3:37 ` Jincheng Wang
2022-06-08 7:39 ` Miquel Raynal
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.