mirror of
https://github.com/u-boot/u-boot.git
synced 2024-11-27 22:56:49 +08:00
2ac0baab4a
Following Jincheng's report, an out-of-band write leading to arbitrary code execution is possible because on one side the squashfs logic accepts directory names up to 65535 bytes (u16), while U-Boot fs logic accepts directory names up to 255 bytes long. Prevent such an exploit from happening by capping directory name sizes to 255. Use a define for this purpose so that developers can link the limitation to its source and eventually kill it some day by dynamically allocating this array (if ever desired). Link: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com Reported-by: Jincheng Wang <jc.w4ng@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Tested-by: Jincheng Wang <jc.w4ng@gmail.com> |
||
|---|---|---|
| .. | ||
| btrfs | ||
| cbfs | ||
| cramfs | ||
| erofs | ||
| ext4 | ||
| fat | ||
| jffs2 | ||
| reiserfs | ||
| sandbox | ||
| squashfs | ||
| ubifs | ||
| yaffs2 | ||
| zfs | ||
| fs_internal.c | ||
| fs.c | ||
| Kconfig | ||
| Makefile | ||
| semihostingfs.c | ||