squashfs: more metadata hardening

Anatoly reports another squashfs fuzzing issue, where the decompression parameters themselves are in a compressed block. This causes squashfs_read_data() to be called in order to read the decompression options before the decompression stream having been set up, making squashfs go sideways. Reported-by: Anatoly Trosinenko <[email protected]> Acked-by: Phillip Lougher <[email protected]> Cc: [email protected] Signed-off-by: Linus Torvalds <[email protected]>
adn770 · Jul 31, 2018 · d512584 · d512584
1 parent 527838d
commit d512584
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c
@@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length,
 	}
 
 	if (compressed) {
+		if (!msblk->stream)
+			goto read_failure;
 		length = squashfs_decompress(msblk, bh, b, offset, length,
 			output);
 		if (length < 0)