Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix processing SQUASHFS_LREG_TYPE entries #15

Merged
merged 1 commit into from
Aug 28, 2019

Conversation

darktemplarbasealt
Copy link
Contributor

When processing SQUASHFS_LREG_TYPE entries, excessive read of 4 bytes is made, which leads to detecting incorrect block offsets

@nigels-com
Copy link
Collaborator

If I follow the reasoning the block list is variable length and the fix is to take the rest of the buffer rather than just the first uint32_t ?

@matteomattei matteomattei merged commit 5dea569 into matteomattei:master Aug 28, 2019
@darktemplarbasealt
Copy link
Contributor Author

Few lines earlier, in function reg_header block_list is defined similar way. I've changed it here to make it same and not sure if it's actually used anywhere.

The issue is that the self.block_list,offset = self.autoMakeBufInteger(buff,offset,4) line increments offset by 4 bytes, and the modified offset is returned. After that on line 849 incorrect offset is saved to block_ptr variable, and later it's used in function read_block_list and invalid blocks list is returned. For example, instead of block list [ value1, value2, value3 ] I'm receiving block list [ value2, value3, invalid_value ]. After that, since block is compressed, decompressor raises exception about invalid data block.

The issue was discovered when processing altinst squashfs file inside following iso (iso file is almost 7Gb in size, but squashfs altinst is only 370Mb):

http://ftp.altlinux.org/pub/distributions/ALTLinux/images/p9/education/x86_64/alt-education-9.0beta2-20190821-x86_64.iso

When using this python module decompression errors were encountered, while squashfs-tools handled that file without any issues. First file I'm getting this issue for is squashfs-root/usr/lib/locale/C.utf8/LC_CTYPE from mentioned altinst squashfs from linked iso.

@darktemplarbasealt darktemplarbasealt deleted the fix_lreg_type branch August 28, 2019 13:21
@nigels-com
Copy link
Collaborator

Indeed confirming this fixes our problem too.

Much appreciated!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants