Merge patch series "fs/squashfs: fix directory table integer overflow"HEADmain

Shahriyar Jalayeri <[email protected]> says:

This fixes an integer overflow in the SquashFS directory-table reader
that leads to a heap out-of-bounds write, and adds a regression test.

sqfs_read_directory_table() sizes the directory table with an int
multiply (metablks_count * SQFS_METADATA_BLOCK_SIZE) that wraps for a
crafted image, under-allocating the buffer that the fill loop then
overruns. It is reached by listing or reading the image (sqfsls /
sqfsload). Patch 1 guards the allocation with __builtin_mul_overflow();
patch 2 adds a test that a crafted image is rejected.

Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.

[trini: As part of the merge, this touches on what commit
 9a9d46cb5e1a ("fs/squashfs: fix heap exhaustion during symlink resolution")
 also handles, but they appear to be separate issues]
Link: https://lore.kernel.org/r/[email protected]

0 files changed, 0 insertions, 0 deletions