packages/squashfs-tools
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

update code

Browse Source
This commit is contained in:
zhuchunyi 2019-11-06 19:53:21 +08:00
parent 52ce7434a4
commit c1fb9eca17
21 changed files with 9 additions and 2091 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

160
0000-PAE.patch
View File

@ -1,160 +0,0 @@
From 2d2f935b5bd5d96e979d5c36ba0fb0b87cb0550e Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sat, 17 Aug 2019 20:32:04 -0400
Subject: [PATCH] mksquashfs: fix phys mem calculation for 32-bit processes
onPAE/64-bit kernels
When adding the code to base default memory usage on physical memory
(by default use 25% of physical memory), I made an oversight. I assumed
the process would be able to address 25% of physical memory.
However, for 32-bit processes running on a PAE kernel or 64-bit kernel,
25% of physical memory can easily exceed the addressible memory for a
32-bit process, e.g. if a machine has 24 GB of physical memory, the
code would asume the process could easily use 6 GB.
A 32-bit process by definition can only address 4 GB (32-bit pointers).
But, due to the typical kernel/user-space split (1GB/3GB, or 2GB/2GB)
on PAE kernels, a 32-bit process may only be able to address 2 GB.
So, if Mksquashfs is a 32-bit application running on a PAE/64-bit kernel,
the code assumes it can address much more memory than it really can, which
means it runs out of memory.
The fix is to impose a maximum default limit on 32-bit kernels, or
otherwise to never use a value more than 25% of the address space. If
we assume the maximum address space is 2 GB, then the maximum becomes
512 MB. But, given most kernels used the 1GB/3GB split, that may be
unduely conservative, and 25% of 3 GB (756 MB) may be better. This
patch compromises on 640 MB, which is mid-way between the 512 MB and 756 MB
values. It is also the fixed default value previously used by Mksquashfs.
This patch also alters the code which imposes a maximum size. Previously
it was believed limiting to the physical memory size was adequate. But
obviously this needs to be updated to take into account a 32-bit process
may only be able to address 2 GB. In the process I've also taken the
opportunity to limit all requests to no more than 75% of physical memory.
---
squashfs-tools/mksquashfs.c | 78 ++++++++++++++++++++++++++++++++++++++++-----
1 file changed, 70 insertions(+), 8 deletions(-)
diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
index 86f82bb..ebd7516 100644
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -304,7 +304,7 @@ void restorefs();
struct dir_info *scan1_opendir(char *pathname, char *subpath, int depth);
void write_filesystem_tables(struct squashfs_super_block *sBlk, int nopad);
unsigned short get_checksum_mem(char *buff, int bytes);
-int get_physical_memory();
+void check_usable_phys_mem(int total_mem);
void prep_exit()
@@ -4053,11 +4053,7 @@ void initialise_threads(int readq, int fragq, int bwriteq, int fwriteq,
BAD_ERROR("Queue sizes rediculously too large\n");
total_mem += fwriteq;
- if(total_mem > get_physical_memory()) {
- ERROR("Total queue sizes larger than physical memory.\n");
- ERROR("Mksquashfs will exhaust physical memory and thrash.\n");
- BAD_ERROR("Queues too large\n");
- }
+ check_usable_phys_mem(total_mem);
/*
* convert from queue size in Mbytes to queue size in
@@ -4879,6 +4875,72 @@ int get_physical_memory()
}
+void check_usable_phys_mem(int total_mem)
+{
+ /*
+ * We want to allow users to use as much of their physical
+ * memory as they wish. However, for practical reasons there are
+ * limits which need to be imposed, to protect users from themselves
+ * and to prevent people from using Mksquashfs as a DOS attack by using
+ * all physical memory. Mksquashfs uses memory to cache data from disk
+ * to optimise performance. It is pointless to ask it to use more
+ * than 75% of physical memory, as this causes thrashing and it is thus
+ * self-defeating.
+ */
+ int mem = get_physical_memory();
+
+ mem = (mem >> 1) + (mem >> 2); /* 75% */
+
+ if(total_mem > mem) {
+ ERROR("Total memory requested is more than 75%% of physical "
+ "memory.\n");
+ ERROR("Mksquashfs uses memory to cache data from disk to "
+ "optimise performance.\n");
+ ERROR("It is pointless to ask it to use more than this amount "
+ "of memory, as this\n");
+ ERROR("causes thrashing and it is thus self-defeating.\n");
+ BAD_ERROR("Requested memory size too large\n");
+ }
+
+ if(sizeof(void *) == 4 && total_mem > 2048) {
+ /*
+ * If we're running on a kernel with PAE or on a 64-bit kernel,
+ * then the 75% physical memory limit can still easily exceed
+ * the addressable memory by this process.
+ *
+ * Due to the typical kernel/user-space split (1GB/3GB, or
+ * 2GB/2GB), we have to conservatively assume the 32-bit
+ * processes can only address 2-3GB. So refuse if the user
+ * tries to allocate more than 2GB.
+ */
+ ERROR("Total memory requested may exceed maximum "
+ "addressable memory by this process\n");
+ BAD_ERROR("Requested memory size too large\n");
+ }
+}
+
+
+int get_default_phys_mem()
+{
+ int mem = get_physical_memory() / SQUASHFS_TAKE;
+
+ if(sizeof(void *) == 4 && mem > 640) {
+ /*
+ * If we're running on a kernel with PAE or on a 64-bit kernel,
+ * the default memory usage can exceed the addressable
+ * memory by this process.
+ * Due to the typical kernel/user-space split (1GB/3GB, or
+ * 2GB/2GB), we have to conservatively assume the 32-bit
+ * processes can only address 2-3GB. So limit the default
+ * usage to 640M, which gives room for other data.
+ */
+ mem = 640;
+ }
+
+ return mem;
+}
+
+
void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
int *fwriteq)
{
@@ -4890,7 +4952,7 @@ void calculate_queue_sizes(int mem, int *readq, int *fragq, int *bwriteq,
#define VERSION() \
- printf("mksquashfs version 4.3 (2014/05/12)\n");\
+ printf("mksquashfs version 4.3-git (2014/06/09)\n");\
printf("copyright (C) 2014 Phillip Lougher "\
"<phillip@squashfs.org.uk>\n\n"); \
printf("This program is free software; you can redistribute it and/or"\
@@ -4918,7 +4980,7 @@ int main(int argc, char *argv[])
int fragq;
int bwriteq;
int fwriteq;
- int total_mem = get_physical_memory() / SQUASHFS_TAKE;
+ int total_mem = get_default_phys_mem();
int progress = TRUE;
int force_progress = FALSE;
struct file_buffer **fragment = NULL;
--
1.8.3.1

33
0001-mem-overflow.patch
View File

@ -1,33 +0,0 @@
From 604b607d8ac91eb8afc0b6e3d917d5c073096103 Mon Sep 17 00:00:00 2001
From: Phillip Lougher <phillip@squashfs.org.uk>
Date: Wed, 11 Jun 2014 04:51:37 +0100
Subject: mksquashfs: ensure value does not overflow a signed int in -mem
option
Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>
diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
index 5370ecf..9676dc8 100644
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -5193,7 +5193,16 @@ print_compressor_options:
argv[0]);
exit(1);
}
- /* convert from bytes to Mbytes */
+
+ /*
+ * convert from bytes to Mbytes, ensuring the value
+ * does not overflow a signed int
+ */
+ if(number >= (1LL << 51)) {
+ ERROR("%s: -mem invalid mem size\n", argv[0]);
+ exit(1);
+ }
+
total_mem = number / 1048576;
if(total_mem < (SQUASHFS_LOWMEM / SQUASHFS_TAKE)) {
ERROR("%s: -mem should be %d Mbytes or "
--
cgit v0.10.1

11
0002-2gb.patch
View File

@ -1,11 +0,0 @@
--- a/squashfs-tools/mksquashfs.c.orig 2014-09-13 11:08:27.352318167 -0500
+++ b/squashfs-tools/mksquashfs.c 2014-09-13 11:09:36.701132044 -0500
@@ -2055,7 +2055,7 @@
inline int is_fragment(struct inode_info *inode)
{
- int file_size = inode->buf.st_size;
+ off_t file_size = inode->buf.st_size;
/*
* If this block is to be compressed differently to the

29
0003-cve-2015-4645.patch
View File

@ -1,29 +0,0 @@
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index ecdaac796f09..2c0cf63daf67 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -31,9 +31,9 @@ static unsigned int *id_table;
int read_fragment_table_4(long long *directory_table_end)
{
int res, i;
- int bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
- int indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
- long long fragment_table_index[indexes];
+ size_t bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
+ size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
+ long long *fragment_table_index;
TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
"from 0x%llx\n", sBlk.s.fragments, indexes,
@@ -44,6 +44,11 @@ int read_fragment_table_4(long long *directory_table_end)
return TRUE;
}
+ fragment_table_index = malloc(indexes*sizeof(long long));
+ if(fragment_table_index == NULL)
+ EXIT_UNSQUASH("read_fragment_table: failed to allocate "
+ "fragment table index\n");
+
fragment_table = malloc(bytes);
if(fragment_table == NULL)
EXIT_UNSQUASH("read_fragment_table: failed to allocate "

11
0004-local-cve-fix.patch
View File

@ -1,11 +0,0 @@
--- a/squashfs-tools/unsquash-4.c.orig 2015-06-24 14:23:22.270710744 -0500
+++ b/squashfs-tools/unsquash-4.c 2015-06-24 14:24:13.671243487 -0500
@@ -35,7 +35,7 @@
size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
long long *fragment_table_index;
- TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
+ TRACE("read_fragment_table: %u fragments, reading %zu fragment indexes "
"from 0x%llx\n", sBlk.s.fragments, indexes,
sBlk.s.fragment_table_start);

150
6000-mksquashfs.c-get-inline-functions-work-with-C99.patch
View File

@ -1,150 +0,0 @@
From ac6268e843c43286eebff2a1052182c2393cdb2e Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Mon, 14 Sep 2015 12:31:42 +0800
Subject: [PATCH] mksquashfs.c: get inline functions work with both gnu11 and gnu89
Upstream-Status: Pending
After gcc upgraded to gcc5, and if the codes is compiled without optimization(-O0),
and the below error will happen:
| mksquashfs.o: In function `create_inode':
| git/squashfs-tools/mksquashfs.c:897: undefined reference to `get_inode_no'
| git/squashfs-tools/mksquashfs.c:960: undefined reference to `get_parent_no'
| git/squashfs-tools/mksquashfs.c:983: undefined reference to `get_parent_no'
| mksquashfs.o: In function `reader_read_process':
| git/squashfs-tools/mksquashfs.c:2132: undefined reference to `is_fragment'
| mksquashfs.o: In function `reader_read_file':
| git/squashfs-tools/mksquashfs.c:2228: undefined reference to `is_fragment'
| mksquashfs.o: In function `dir_scan':
| git/squashfs-tools/mksquashfs.c:3101: undefined reference to `create_dir_entry'
gcc5 defaults to -std=gnu11 instead of -std=gnu89, and it requires that exactly one C
source file has the callable copy of the inline function. Consider the following
program:
inline int
foo (void)
{
return 42;
}
int
main (void)
{
return foo ();
}
The program above will not link with the C99 inline semantics, because no out-of-line
function foo is generated. To fix this, either mark the function foo as static, or
add the following declaration:
static inline int foo (void);
more information refer to: https://gcc.gnu.org/gcc-5/porting_to.html;
but the use of "extern inline" will lead to the compilation issue if gcc is not
gcc5, as the commit in oe-core d0af30c92fde [alsa-lib: Change function type to
"static __inline__"]
"extern __inline__ function()" is the inlined version that
can be used in this compilation unit, but there will be another
definition of this function somewhere, so compiler will not emit
any code for the function body. This causes problem in -O0,
where functions are never inlined, the function call is preserved,
but linker can't find the symbol, thus the error happens.
so replace "inline" with "static inline" to make it work with both gnu11 and gnu89
Signed-off-by: Roy Li <rongqing.li@windriver.com>
---
squashfs-tools/mksquashfs.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/squashfs-tools/mksquashfs.c b/squashfs-tools/mksquashfs.c
index c74b3df..e1a0fc6 100644
--- a/squashfs-tools/mksquashfs.c
+++ b/squashfs-tools/mksquashfs.c
@@ -825,13 +825,13 @@ char *subpathname(struct dir_ent *dir_ent)
}
-inline unsigned int get_inode_no(struct inode_info *inode)
+static inline unsigned int get_inode_no(struct inode_info *inode)
{
return inode->inode_number;
}
-inline unsigned int get_parent_no(struct dir_info *dir)
+static inline unsigned int get_parent_no(struct dir_info *dir)
{
return dir->depth ? get_inode_no(dir->dir_ent->inode) : inode_no;
}
@@ -2054,7 +2054,7 @@ struct file_info *duplicate(long long file_size, long long bytes,
}
-inline int is_fragment(struct inode_info *inode)
+static inline int is_fragment(struct inode_info *inode)
{
off_t file_size = inode->buf.st_size;
@@ -3017,20 +3017,20 @@ struct inode_info *lookup_inode2(struct stat *buf, int pseudo, int id)
}
-inline struct inode_info *lookup_inode(struct stat *buf)
+static inline struct inode_info *lookup_inode(struct stat *buf)
{
return lookup_inode2(buf, 0, 0);
}
-inline void alloc_inode_no(struct inode_info *inode, unsigned int use_this)
+static inline void alloc_inode_no(struct inode_info *inode, unsigned int use_this)
{
if (inode->inode_number == 0)
inode->inode_number = use_this ? : inode_no ++;
}
-inline struct dir_ent *create_dir_entry(char *name, char *source_name,
+static inline struct dir_ent *create_dir_entry(char *name, char *source_name,
char *nonstandard_pathname, struct dir_info *dir)
{
struct dir_ent *dir_ent = malloc(sizeof(struct dir_ent));
@@ -3047,7 +3047,7 @@ inline struct dir_ent *create_dir_entry(char *name, char *source_name,
}
-inline void add_dir_entry(struct dir_ent *dir_ent, struct dir_info *sub_dir,
+static inline void add_dir_entry(struct dir_ent *dir_ent, struct dir_info *sub_dir,
struct inode_info *inode_info)
{
struct dir_info *dir = dir_ent->our_dir;
@@ -3063,7 +3063,7 @@ inline void add_dir_entry(struct dir_ent *dir_ent, struct dir_info *sub_dir,
}
-inline void add_dir_entry2(char *name, char *source_name,
+static inline void add_dir_entry2(char *name, char *source_name,
char *nonstandard_pathname, struct dir_info *sub_dir,
struct inode_info *inode_info, struct dir_info *dir)
{
@@ -3075,7 +3075,7 @@ inline void add_dir_entry2(char *name, char *source_name,
}
-inline void free_dir_entry(struct dir_ent *dir_ent)
+static inline void free_dir_entry(struct dir_ent *dir_ent)
{
if(dir_ent->name)
free(dir_ent->name);
@@ -3087,7 +3087,7 @@ inline void free_dir_entry(struct dir_ent *dir_ent)
}
-inline void add_excluded(struct dir_info *dir)
+static inline void add_excluded(struct dir_info *dir)
{
dir->excluded ++;
}

86
6001-unsquashfs-Fix-one-off-error-in-name-length-check.patch
View File

@ -1,86 +0,0 @@
From 8f542d9f0222302b44fca861031ccf09e78d9be5 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:01:03 -0400
Subject: [PATCH 1/8] unsquashfs-Fix-one-off-error-in-name-length-check
---
squashfs-tools/unsquash-1.c | 6 +++---
squashfs-tools/unsquash-3.c | 6 +++---
squashfs-tools/unsquash-4.c | 6 +++---
3 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
index c2e7d38..6209243 100644
--- a/squashfs-tools/unsquash-1.c
+++ b/squashfs-tools/unsquash-1.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012
+ * Copyright (c) 2009, 2010, 2011, 2012, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -278,8 +278,8 @@ struct dir *squashfs_opendir_1(unsigned int block_start, unsigned int offset,
sizeof(*dire));
bytes += sizeof(*dire);
- /* size should never be larger than SQUASHFS_NAME_LEN */
- if(dire->size > SQUASHFS_NAME_LEN)
+ /* size should never be SQUASHFS_NAME_LEN or larger */
+ if(dire->size >= SQUASHFS_NAME_LEN)
goto corrupted;
memcpy(dire->name, directory_table + bytes,
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index d5af57a..92e18c5 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -356,8 +356,8 @@ struct dir *squashfs_opendir_3(unsigned int block_start, unsigned int offset,
sizeof(*dire));
bytes += sizeof(*dire);
- /* size should never be larger than SQUASHFS_NAME_LEN */
- if(dire->size > SQUASHFS_NAME_LEN)
+ /* size should never be SQUASHFS_NAME_LEN or larger */
+ if(dire->size >= SQUASHFS_NAME_LEN)
goto corrupted;
memcpy(dire->name, directory_table + bytes,
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 9414016..cf30ec1 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2011, 2012, 2013
+ * Copyright (c) 2009, 2010, 2011, 2012, 2013, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -319,8 +319,8 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
bytes += sizeof(*dire);
- /* size should never be larger than SQUASHFS_NAME_LEN */
- if(dire->size > SQUASHFS_NAME_LEN)
+ /* size should never be SQUASHFS_NAME_LEN or larger */
+ if(dire->size >= SQUASHFS_NAME_LEN)
goto corrupted;
memcpy(dire->name, directory_table + bytes,
--
1.8.3.1

74
6002-unsquashfs-add-definition-for-SQUASHFS_DIR_COUNT.patch
View File

@ -1,74 +0,0 @@
From 6f10093abf055508d0b7c65b2e2135b95c0ecc02 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:03:58 -0400
Subject: [PATCH 2/8] unsquashfs-add-definition-for-SQUASHFS_DIR_COUNT
---
squashfs-tools/squashfs_fs.h | 3 +++
squashfs-tools/unsquash-1.c | 4 ++--
squashfs-tools/unsquash-3.c | 4 ++--
squashfs-tools/unsquash-4.c | 4 ++--
4 files changed, 9 insertions(+), 6 deletions(-)
diff --git a/squashfs-tools/squashfs_fs.h b/squashfs-tools/squashfs_fs.h
index 791fe12..5407597 100644
--- a/squashfs-tools/squashfs_fs.h
+++ b/squashfs-tools/squashfs_fs.h
@@ -47,6 +47,9 @@
/* Max length of filename (not 255) */
#define SQUASHFS_NAME_LEN 256
+/* Max value for directory header count */
+#define SQUASHFS_DIR_COUNT 256
+
#define SQUASHFS_INVALID ((long long) 0xffffffffffff)
#define SQUASHFS_INVALID_FRAG ((unsigned int) 0xffffffff)
#define SQUASHFS_INVALID_XATTR ((unsigned int) 0xffffffff)
diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
index 6209243..1cbf1b1 100644
--- a/squashfs-tools/unsquash-1.c
+++ b/squashfs-tools/unsquash-1.c
@@ -263,8 +263,8 @@ struct dir *squashfs_opendir_1(unsigned int block_start, unsigned int offset,
"%d, %d directory entries\n", bytes, dir_count);
bytes += sizeof(dirh);
- /* dir_count should never be larger than 256 */
- if(dir_count > 256)
+ /* dir_count should never be larger than SQUASHFS_DIR_COUNT */
+ if(dir_count > SQUASHFS_DIR_COUNT)
goto corrupted;
while(dir_count--) {
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index 92e18c5..dc530bb 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -341,8 +341,8 @@ struct dir *squashfs_opendir_3(unsigned int block_start, unsigned int offset,
"%d, %d directory entries\n", bytes, dir_count);
bytes += sizeof(dirh);
- /* dir_count should never be larger than 256 */
- if(dir_count > 256)
+ /* dir_count should never be larger than SQUASHFS_DIR_COUNT */
+ if(dir_count > SQUASHFS_DIR_COUNT)
goto corrupted;
while(dir_count--) {
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index cf30ec1..58eb17d 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -310,8 +310,8 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
"%d, %d directory entries\n", bytes, dir_count);
bytes += sizeof(dirh);
- /* dir_count should never be larger than 256 */
- if(dir_count > 256)
+ /* dir_count should never be larger than SQUASHFS_DIR_COUNT */
+ if(dir_count > SQUASHFS_DIR_COUNT)
goto corrupted;
while(dir_count--) {
--
1.8.3.1

98
6003-unsquashfs-Be-more-explicit-when-file-system-corrupt.patch
View File

@ -1,98 +0,0 @@
From 05fe97fcc7fb34110fb2ddd338cedc7477e41300 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:04:50 -0400
Subject: [PATCH 3/8] unsquashfs-Be-more-explicit-when-file-system-corrupt
---
squashfs-tools/unsquash-1.c | 8 ++++++--
squashfs-tools/unsquash-3.c | 8 ++++++--
squashfs-tools/unsquash-4.c | 8 ++++++--
3 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
index 1cbf1b1..41888fb 100644
--- a/squashfs-tools/unsquash-1.c
+++ b/squashfs-tools/unsquash-1.c
@@ -264,8 +264,10 @@ struct dir *squashfs_opendir_1(unsigned int block_start, unsigned int offset,
bytes += sizeof(dirh);
/* dir_count should never be larger than SQUASHFS_DIR_COUNT */
- if(dir_count > SQUASHFS_DIR_COUNT)
+ if(dir_count > SQUASHFS_DIR_COUNT) {
+ ERROR("File system corrupted: too many entries in directory\n");
goto corrupted;
+ }
while(dir_count--) {
if(swap) {
@@ -279,8 +281,10 @@ struct dir *squashfs_opendir_1(unsigned int block_start, unsigned int offset,
bytes += sizeof(*dire);
/* size should never be SQUASHFS_NAME_LEN or larger */
- if(dire->size >= SQUASHFS_NAME_LEN)
+ if(dire->size >= SQUASHFS_NAME_LEN) {
+ ERROR("File system corrupted: filename too long\n");
goto corrupted;
+ }
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index dc530bb..ac04a6a 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -342,8 +342,10 @@ struct dir *squashfs_opendir_3(unsigned int block_start, unsigned int offset,
bytes += sizeof(dirh);
/* dir_count should never be larger than SQUASHFS_DIR_COUNT */
- if(dir_count > SQUASHFS_DIR_COUNT)
+ if(dir_count > SQUASHFS_DIR_COUNT) {
+ ERROR("File system corrupted: too many entries in directory\n");
goto corrupted;
+ }
while(dir_count--) {
if(swap) {
@@ -357,8 +359,10 @@ struct dir *squashfs_opendir_3(unsigned int block_start, unsigned int offset,
bytes += sizeof(*dire);
/* size should never be SQUASHFS_NAME_LEN or larger */
- if(dire->size >= SQUASHFS_NAME_LEN)
+ if(dire->size >= SQUASHFS_NAME_LEN) {
+ ERROR("File system corrupted: filename too long\n");
goto corrupted;
+ }
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 58eb17d..05b0c5d 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -311,8 +311,10 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
bytes += sizeof(dirh);
/* dir_count should never be larger than SQUASHFS_DIR_COUNT */
- if(dir_count > SQUASHFS_DIR_COUNT)
+ if(dir_count > SQUASHFS_DIR_COUNT) {
+ ERROR("File system corrupted: too many entries in directory\n");
goto corrupted;
+ }
while(dir_count--) {
SQUASHFS_SWAP_DIR_ENTRY(directory_table + bytes, dire);
@@ -320,8 +322,10 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
bytes += sizeof(*dire);
/* size should never be SQUASHFS_NAME_LEN or larger */
- if(dire->size >= SQUASHFS_NAME_LEN)
+ if(dire->size >= SQUASHFS_NAME_LEN) {
+ ERROR("File system corrupted: filename too long\n");
goto corrupted;
+ }
memcpy(dire->name, directory_table + bytes,
dire->size + 1);
--
1.8.3.1

332
6004-unsquashfs-move-fs-table-reading-into-the-version-sp.patch
View File

@ -1,332 +0,0 @@
From 901a2e2652c2a45837bd155aa2c028c68bc8ad48 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:11:24 -0400
Subject: [PATCH 4/8] unsquashfs-move-fs-table-reading-into-the-version-sp
---
squashfs-tools/unsquash-1.c | 25 +++++++++++++++++--------
squashfs-tools/unsquash-2.c | 24 +++++++++++++++++++++++-
squashfs-tools/unsquash-3.c | 22 ++++++++++++++++++++++
squashfs-tools/unsquash-4.c | 29 +++++++++++++++++++++++++++++
squashfs-tools/unsquashfs.c | 34 ++++++----------------------------
squashfs-tools/unsquashfs.h | 15 +++++++++------
6 files changed, 106 insertions(+), 43 deletions(-)
diff --git a/squashfs-tools/unsquash-1.c b/squashfs-tools/unsquash-1.c
index 41888fb..bf3589d 100644
--- a/squashfs-tools/unsquash-1.c
+++ b/squashfs-tools/unsquash-1.c
@@ -46,14 +46,6 @@ void read_block_list_1(unsigned int *block_list, char *block_ptr, int blocks)
}
-int read_fragment_table_1(long long *directory_table_end)
-{
- TRACE("read_fragment_table\n");
- *directory_table_end = sBlk.s.fragment_table_start;
- return TRUE;
-}
-
-
struct inode *read_inode_1(unsigned int start_block, unsigned int offset)
{
static union squashfs_inode_header_1 header;
@@ -359,3 +351,20 @@ int read_uids_guids_1()
return TRUE;
}
+
+
+int read_filesystem_tables_1()
+{
+ if(read_uids_guids_1() == FALSE)
+ return FALSE;
+
+ if(read_inode_table(sBlk.s.inode_table_start,
+ sBlk.s.directory_table_start) == FALSE)
+ return FALSE;
+
+ if(read_directory_table(sBlk.s.directory_table_start,
+ sBlk.uid_start) == FALSE)
+ return FALSE;
+
+ return TRUE;
+}
diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
index 0f2bfe8..9b4ade4 100644
--- a/squashfs-tools/unsquash-2.c
+++ b/squashfs-tools/unsquash-2.c
@@ -2,7 +2,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013
+ * Copyright (c) 2009, 2010, 2013, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -268,3 +268,25 @@ struct inode *read_inode_2(unsigned int start_block, unsigned int offset)
}
return &i;
}
+
+
+int read_filesystem_tables_2()
+{
+ long long directory_table_end;
+
+ if(read_uids_guids_1() == FALSE)
+ return FALSE;
+
+ if(read_fragment_table_2(&directory_table_end) == FALSE)
+ return FALSE;
+
+ if(read_inode_table(sBlk.s.inode_table_start,
+ sBlk.s.directory_table_start) == FALSE)
+ return FALSE;
+
+ if(read_directory_table(sBlk.s.directory_table_start,
+ directory_table_end) == FALSE)
+ return FALSE;
+
+ return TRUE;
+}
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index ac04a6a..622ce1e 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -395,3 +395,25 @@ corrupted:
free(dir);
return NULL;
}
+
+
+int read_filesystem_tables_3()
+{
+ long long directory_table_end;
+
+ if(read_uids_guids_1() == FALSE)
+ return FALSE;
+
+ if(read_fragment_table_3(&directory_table_end) == FALSE)
+ return FALSE;
+
+ if(read_inode_table(sBlk.s.inode_table_start,
+ sBlk.s.directory_table_start) == FALSE)
+ return FALSE;
+
+ if(read_directory_table(sBlk.s.directory_table_start,
+ directory_table_end) == FALSE)
+ return FALSE;
+
+ return TRUE;
+}
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 05b0c5d..0f51888 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -24,6 +24,7 @@
#include "unsquashfs.h"
#include "squashfs_swap.h"
+#include "xattr.h"
static struct squashfs_fragment_entry *fragment_table;
static unsigned int *id_table;
@@ -399,3 +400,31 @@ int read_uids_guids_4()
return TRUE;
}
+
+
+int read_filesystem_tables_4()
+{
+ long long directory_table_end;
+
+ if(read_uids_guids_4() == FALSE)
+ return FALSE;
+
+ if(read_fragment_table_4(&directory_table_end) == FALSE)
+ return FALSE;
+
+ if(read_inode_table(sBlk.s.inode_table_start,
+ sBlk.s.directory_table_start) == FALSE)
+ return FALSE;
+
+ if(read_directory_table(sBlk.s.directory_table_start,
+ directory_table_end) == FALSE)
+ return FALSE;
+
+ if(no_xattrs)
+ sBlk.s.xattr_id_table_start = SQUASHFS_INVALID_BLK;
+
+ if(read_xattrs_from_disk(fd, &sBlk.s) == 0)
+ return FALSE;
+
+ return TRUE;
+}
diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
index 57cf2bc..875a6cd 100644
--- a/squashfs-tools/unsquashfs.c
+++ b/squashfs-tools/unsquashfs.c
@@ -1788,12 +1788,11 @@ int read_super(char *source)
if(sBlk_4.s_magic == SQUASHFS_MAGIC && sBlk_4.s_major == 4 &&
sBlk_4.s_minor == 0) {
+ s_ops.read_filesystem_tables = read_filesystem_tables_4;
s_ops.squashfs_opendir = squashfs_opendir_4;
s_ops.read_fragment = read_fragment_4;
- s_ops.read_fragment_table = read_fragment_table_4;
s_ops.read_block_list = read_block_list_2;
s_ops.read_inode = read_inode_4;
- s_ops.read_uids_guids = read_uids_guids_4;
memcpy(&sBlk, &sBlk_4, sizeof(sBlk_4));
/*
@@ -1861,28 +1860,25 @@ int read_super(char *source)
if(sBlk.s.s_major == 1) {
sBlk.s.block_size = sBlk_3.block_size_1;
sBlk.s.fragment_table_start = sBlk.uid_start;
+ s_ops.read_filesystem_tables = read_filesystem_tables_1;
s_ops.squashfs_opendir = squashfs_opendir_1;
- s_ops.read_fragment_table = read_fragment_table_1;
s_ops.read_block_list = read_block_list_1;
s_ops.read_inode = read_inode_1;
- s_ops.read_uids_guids = read_uids_guids_1;
} else {
sBlk.s.fragment_table_start =
sBlk_3.fragment_table_start_2;
+ s_ops.read_filesystem_tables = read_filesystem_tables_2;
s_ops.squashfs_opendir = squashfs_opendir_1;
s_ops.read_fragment = read_fragment_2;
- s_ops.read_fragment_table = read_fragment_table_2;
s_ops.read_block_list = read_block_list_2;
s_ops.read_inode = read_inode_2;
- s_ops.read_uids_guids = read_uids_guids_1;
}
} else if(sBlk.s.s_major == 3) {
+ s_ops.read_filesystem_tables = read_filesystem_tables_3;
s_ops.squashfs_opendir = squashfs_opendir_3;
s_ops.read_fragment = read_fragment_3;
- s_ops.read_fragment_table = read_fragment_table_3;
s_ops.read_block_list = read_block_list_2;
s_ops.read_inode = read_inode_3;
- s_ops.read_uids_guids = read_uids_guids_1;
} else {
ERROR("Filesystem on %s is (%d:%d), ", source, sBlk.s.s_major,
sBlk.s.s_minor);
@@ -2501,7 +2497,6 @@ int main(int argc, char *argv[])
int n;
struct pathnames *paths = NULL;
struct pathname *path = NULL;
- long long directory_table_end;
int fragment_buffer_size = FRAGMENT_BUFFER_DEFAULT;
int data_buffer_size = DATA_BUFFER_DEFAULT;
@@ -2757,25 +2752,8 @@ options:
memset(created_inode, 0, sBlk.s.inodes * sizeof(char *));
- if(s_ops.read_uids_guids() == FALSE)
- EXIT_UNSQUASH("failed to uid/gid table\n");
-
- if(s_ops.read_fragment_table(&directory_table_end) == FALSE)
- EXIT_UNSQUASH("failed to read fragment table\n");
-
- if(read_inode_table(sBlk.s.inode_table_start,
- sBlk.s.directory_table_start) == FALSE)
- EXIT_UNSQUASH("failed to read inode table\n");
-
- if(read_directory_table(sBlk.s.directory_table_start,
- directory_table_end) == FALSE)
- EXIT_UNSQUASH("failed to read directory table\n");
-
- if(no_xattrs)
- sBlk.s.xattr_id_table_start = SQUASHFS_INVALID_BLK;
-
- if(read_xattrs_from_disk(fd, &sBlk.s) == 0)
- EXIT_UNSQUASH("failed to read the xattr table\n");
+ if(s_ops.read_filesystem_tables() == FALSE)
+ EXIT_UNSQUASH("failed to read file system tables\n");
if(path) {
paths = init_subdir();
diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
index ecd0bb4..f9c49ac 100644
--- a/squashfs-tools/unsquashfs.h
+++ b/squashfs-tools/unsquashfs.h
@@ -4,7 +4,7 @@
* Unsquash a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2009, 2010, 2013, 2014
+ * Copyright (c) 2009, 2010, 2013, 2014, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -102,12 +102,11 @@ typedef struct squashfs_operations {
unsigned int offset, struct inode **i);
void (*read_fragment)(unsigned int fragment, long long *start_block,
int *size);
- int (*read_fragment_table)(long long *);
void (*read_block_list)(unsigned int *block_list, char *block_ptr,
int blocks);
struct inode *(*read_inode)(unsigned int start_block,
unsigned int offset);
- int (*read_uids_guids)();
+ int (*read_filesystem_tables)();
} squashfs_operations;
struct test {
@@ -235,10 +234,13 @@ extern int progress_enabled;
extern int inode_number;
extern int lookup_type[];
extern int fd;
+extern int no_xattrs;
extern struct queue *to_reader, *to_inflate, *to_writer;
extern struct cache *fragment_cache, *data_cache;
/* unsquashfs.c */
+extern int read_inode_table(long long, long long);
+extern int read_directory_table(long long, long long);
extern int lookup_entry(struct hash_table_entry **, long long);
extern int read_fs_bytes(int fd, long long, int, void *);
extern int read_block(int, long long, long long *, int, void *);
@@ -249,7 +251,7 @@ extern void dump_cache(struct cache *);
/* unsquash-1.c */
extern void read_block_list_1(unsigned int *, char *, int);
-extern int read_fragment_table_1(long long *);
+extern int read_filesystem_tables_1();
extern struct inode *read_inode_1(unsigned int, unsigned int);
extern struct dir *squashfs_opendir_1(unsigned int, unsigned int,
struct inode **);
@@ -257,12 +259,13 @@ extern int read_uids_guids_1();
/* unsquash-2.c */
extern void read_block_list_2(unsigned int *, char *, int);
-extern int read_fragment_table_2(long long *);
+extern int read_filesystem_tables_2();
extern void read_fragment_2(unsigned int, long long *, int *);
extern struct inode *read_inode_2(unsigned int, unsigned int);
/* unsquash-3.c */
extern int read_fragment_table_3(long long *);
+extern int read_filesystem_tables_3();
extern void read_fragment_3(unsigned int, long long *, int *);
extern struct inode *read_inode_3(unsigned int, unsigned int);
extern struct dir *squashfs_opendir_3(unsigned int, unsigned int,
@@ -270,9 +273,9 @@ extern struct dir *squashfs_opendir_3(unsigned int, unsigned int,
/* unsquash-4.c */
extern int read_fragment_table_4(long long *);
+extern int read_filesystem_tables_4();
extern void read_fragment_4(unsigned int, long long *, int *);
extern struct inode *read_inode_4(unsigned int, unsigned int);
extern struct dir *squashfs_opendir_4(unsigned int, unsigned int,
struct inode **);
-extern int read_uids_guids_4();
#endif
--
1.8.3.1

93
6005-unsquashfs-no-longer-need-to-version-and-export-some.patch
View File

@ -1,93 +0,0 @@
From d5d4143dd3412e763562bcbc37cb501d0ad67603 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:13:34 -0400
Subject: [PATCH 5/8] unsquashfs-no-longer-need-to-version-and-export-some
---
squashfs-tools/unsquash-2.c | 4 ++--
squashfs-tools/unsquash-3.c | 4 ++--
squashfs-tools/unsquash-4.c | 8 ++++----
3 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/squashfs-tools/unsquash-2.c b/squashfs-tools/unsquash-2.c
index 9b4ade4..4f2769a 100644
--- a/squashfs-tools/unsquash-2.c
+++ b/squashfs-tools/unsquash-2.c
@@ -40,7 +40,7 @@ void read_block_list_2(unsigned int *block_list, char *block_ptr, int blocks)
}
-int read_fragment_table_2(long long *directory_table_end)
+static int read_fragment_table(long long *directory_table_end)
{
int res, i;
int bytes = SQUASHFS_FRAGMENT_BYTES_2(sBlk.s.fragments);
@@ -277,7 +277,7 @@ int read_filesystem_tables_2()
if(read_uids_guids_1() == FALSE)
return FALSE;
- if(read_fragment_table_2(&directory_table_end) == FALSE)
+ if(read_fragment_table(&directory_table_end) == FALSE)
return FALSE;
if(read_inode_table(sBlk.s.inode_table_start,
diff --git a/squashfs-tools/unsquash-3.c b/squashfs-tools/unsquash-3.c
index 622ce1e..4768270 100644
--- a/squashfs-tools/unsquash-3.c
+++ b/squashfs-tools/unsquash-3.c
@@ -27,7 +27,7 @@
static squashfs_fragment_entry_3 *fragment_table;
-int read_fragment_table_3(long long *directory_table_end)
+static int read_fragment_table(long long *directory_table_end)
{
int res, i;
int bytes = SQUASHFS_FRAGMENT_BYTES_3(sBlk.s.fragments);
@@ -404,7 +404,7 @@ int read_filesystem_tables_3()
if(read_uids_guids_1() == FALSE)
return FALSE;
- if(read_fragment_table_3(&directory_table_end) == FALSE)
+ if(read_fragment_table(&directory_table_end) == FALSE)
return FALSE;
if(read_inode_table(sBlk.s.inode_table_start,
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 0f51888..c335d7c 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -29,7 +29,7 @@
static struct squashfs_fragment_entry *fragment_table;
static unsigned int *id_table;
-int read_fragment_table_4(long long *directory_table_end)
+static int read_fragment_table(long long *directory_table_end)
{
int res, i;
size_t bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
@@ -361,7 +361,7 @@ corrupted:
}
-int read_uids_guids_4()
+static int read_uids_guids()
{
int res, i;
int bytes = SQUASHFS_ID_BYTES(sBlk.s.no_ids);
@@ -406,10 +406,10 @@ int read_filesystem_tables_4()
{
long long directory_table_end;
- if(read_uids_guids_4() == FALSE)
+ if(read_uids_guids() == FALSE)
return FALSE;
- if(read_fragment_table_4(&directory_table_end) == FALSE)
+ if(read_fragment_table(&directory_table_end) == FALSE)
return FALSE;
if(read_inode_table(sBlk.s.inode_table_start,
--
1.8.3.1

180
6006-unsquash-4-get-fs-table-start-and-end-points.patch
View File

@ -1,180 +0,0 @@
From 00c97a78471b9757271ae67807a8913049658f3a Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:18:34 -0400
Subject: [PATCH 6/8] unsquash-4-get-fs-table-start-and-end-points
---
squashfs-tools/read_xattrs.c | 14 +++++++++++--
squashfs-tools/unsquash-4.c | 48 ++++++++++++++++++++++++++++++++++++++------
squashfs-tools/xattr.c | 4 ++--
squashfs-tools/xattr.h | 4 ++--
4 files changed, 58 insertions(+), 12 deletions(-)
diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
index 42106f5..9c66387 100644
--- a/squashfs-tools/read_xattrs.c
+++ b/squashfs-tools/read_xattrs.c
@@ -2,7 +2,7 @@
* Read a squashfs filesystem. This is a highly compressed read only
* filesystem.
*
- * Copyright (c) 2010, 2012, 2013
+ * Copyright (c) 2010, 2012, 2013, 2019
* Phillip Lougher <phillip@squashfs.org.uk>
*
* This program is free software; you can redistribute it and/or
@@ -148,7 +148,7 @@ static int read_xattr_entry(struct xattr_list *xattr,
* Read and decompress the xattr id table and the xattr metadata.
* This is cached in memory for later use by get_xattr()
*/
-int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk)
+int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, long long *table_start)
{
int res, bytes, i, indexes, index_bytes, ids;
long long *index, start, end;
@@ -170,6 +170,16 @@ int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk)
SQUASHFS_INSWAP_XATTR_TABLE(&id_table);
+ if(flag) {
+ /*
+ * id_table.xattr_table_start stores the start of the compressed xattr
+ * * metadata blocks. This by definition is also the end of the previous
+ * filesystem table - the id lookup table.
+ */
+ *table_start = id_table.xattr_table_start;
+ return id_table.xattr_ids;
+ }
+
/*
* Allocate and read the index to the xattr id table metadata
* blocks
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index c335d7c..b501871 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -361,7 +361,7 @@ corrupted:
}
-static int read_uids_guids()
+static int read_uids_guids(long long *table_start)
{
int res, i;
int bytes = SQUASHFS_ID_BYTES(sBlk.s.no_ids);
@@ -384,6 +384,14 @@ static int read_uids_guids()
}
SQUASHFS_INSWAP_ID_BLOCKS(id_index_table, indexes);
+ /*
+ * id_index_table[0] stores the start of the compressed id blocks.
+ * This by definition is also the end of the previous filesystem
+ * table - this may be the exports table if it is present, or the
+ * fragments table if it isn't.
+ */
+ *table_start = id_index_table[0];
+
for(i = 0; i < indexes; i++) {
int expected = (i + 1) != indexes ? SQUASHFS_METADATA_SIZE :
bytes & (SQUASHFS_METADATA_SIZE - 1);
@@ -402,11 +410,42 @@ static int read_uids_guids()
}
+static int parse_exports_table(long long *table_start)
+{
+ int res;
+ int indexes = SQUASHFS_LOOKUP_BLOCKS(sBlk.s.inodes);
+ long long export_index_table[indexes];
+
+ res = read_fs_bytes(fd, sBlk.s.lookup_table_start,
+ SQUASHFS_LOOKUP_BLOCK_BYTES(sBlk.s.inodes), export_index_table);
+ if(res == FALSE) {
+ ERROR("parse_exports_table: failed to read export index table\n");
+ return FALSE;
+ }
+ SQUASHFS_INSWAP_LOOKUP_BLOCKS(export_index_table, indexes);
+
+ /*
+ * export_index_table[0] stores the start of the compressed export blocks.
+ * This by definition is also the end of the previous filesystem
+ * table - the fragment table.
+ */
+ *table_start = export_index_table[0];
+
+ return TRUE;
+}
+
+
int read_filesystem_tables_4()
{
- long long directory_table_end;
+ long long directory_table_end, table_start;
+
+ if(read_xattrs_from_disk(fd, &sBlk.s, no_xattrs, &table_start) == 0)
+ return FALSE;
- if(read_uids_guids() == FALSE)
+ if(read_uids_guids(&table_start) == FALSE)
+ return FALSE;
+
+ if(parse_exports_table(&table_start) == FALSE)
return FALSE;
if(read_fragment_table(&directory_table_end) == FALSE)
@@ -423,8 +462,5 @@ int read_filesystem_tables_4()
if(no_xattrs)
sBlk.s.xattr_id_table_start = SQUASHFS_INVALID_BLK;
- if(read_xattrs_from_disk(fd, &sBlk.s) == 0)
- return FALSE;
-
return TRUE;
}
diff --git a/squashfs-tools/xattr.c b/squashfs-tools/xattr.c
index b46550c..dddba7b 100644
--- a/squashfs-tools/xattr.c
+++ b/squashfs-tools/xattr.c
@@ -85,7 +85,7 @@ extern int mangle(char *, char *, int, int, int, int);
extern char *pathname(struct dir_ent *);
/* helper functions and definitions from read_xattrs.c */
-extern int read_xattrs_from_disk(int, struct squashfs_super_block *);
+extern int read_xattrs_from_disk(int, struct squashfs_super_block *, int, long long *);
extern struct xattr_list *get_xattr(int, unsigned int *, int);
extern struct prefix prefix_table[];
@@ -635,7 +635,7 @@ int get_xattrs(int fd, struct squashfs_super_block *sBlk)
TRACE("get_xattrs\n");
- res = read_xattrs_from_disk(fd, sBlk);
+ res = read_xattrs_from_disk(fd, sBlk, FALSE, NULL);
if(res == SQUASHFS_INVALID_BLK || res == 0)
goto done;
ids = res;
diff --git a/squashfs-tools/xattr.h b/squashfs-tools/xattr.h
index 9260255..13e5519 100644
--- a/squashfs-tools/xattr.h
+++ b/squashfs-tools/xattr.h
@@ -73,7 +73,7 @@ extern void save_xattrs();
extern void restore_xattrs();
extern unsigned int xattr_bytes, total_xattr_bytes;
extern void write_xattr(char *, unsigned int);
-extern int read_xattrs_from_disk(int, struct squashfs_super_block *);
+extern int read_xattrs_from_disk(int, struct squashfs_super_block *, int, long long *);
extern struct xattr_list *get_xattr(int, unsigned int *, int);
extern void free_xattr(struct xattr_list *, int);
#else
@@ -115,7 +115,7 @@ static inline void write_xattr(char *pathname, unsigned int xattr)
}
-static inline int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk)
+static inline int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, long long *table_start)
{
if(sBlk->xattr_id_table_start != SQUASHFS_INVALID_BLK) {
fprintf(stderr, "Xattrs in filesystem! These are not "
--
1.8.3.1

102
6007-unsquashfs-Make-some-variables-long-long-rather-than.patch
View File

@ -1,102 +0,0 @@
From f21807946f74c4f58a5f77755a13261cdea19e29 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:19:46 -0400
Subject: [PATCH 7/8] unsquashfs-Make-some-variables-long-long-rather-than
---
squashfs-tools/unsquash-4.c | 4 ++--
squashfs-tools/unsquashfs.c | 12 ++++++++----
squashfs-tools/unsquashfs.h | 4 ++--
3 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index b501871..211a796 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -104,7 +104,7 @@ struct inode *read_inode_4(unsigned int start_block, unsigned int offset)
{
static union squashfs_inode_header header;
long long start = sBlk.s.inode_table_start + start_block;
- int bytes = lookup_entry(inode_table_hash, start);
+ long long bytes = lookup_entry(inode_table_hash, start);
char *block_ptr = inode_table + bytes + offset;
static struct inode i;
@@ -261,7 +261,7 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
__attribute__((aligned));
struct squashfs_dir_entry *dire = (struct squashfs_dir_entry *) buffer;
long long start;
- int bytes;
+ long long bytes;
int dir_count, size;
struct dir_ent *new_dir;
struct dir *dir;
diff --git a/squashfs-tools/unsquashfs.c b/squashfs-tools/unsquashfs.c
index 875a6cd..5ba9454 100644
--- a/squashfs-tools/unsquashfs.c
+++ b/squashfs-tools/unsquashfs.c
@@ -592,7 +592,7 @@ int print_filename(char *pathname, struct inode *inode)
void add_entry(struct hash_table_entry *hash_table[], long long start,
- int bytes)
+ long long bytes)
{
int hash = CALCULATE_HASH(start);
struct hash_table_entry *hash_table_entry;
@@ -608,7 +608,7 @@ void add_entry(struct hash_table_entry *hash_table[], long long start,
}
-int lookup_entry(struct hash_table_entry *hash_table[], long long start)
+long long lookup_entry(struct hash_table_entry *hash_table[], long long start)
{
int hash = CALCULATE_HASH(start);
struct hash_table_entry *hash_table_entry;
@@ -769,7 +769,9 @@ failed:
int read_inode_table(long long start, long long end)
{
- int size = 0, bytes = 0, res;
+ int res;
+ long long size = 0;
+ long long bytes = 0;
TRACE("read_inode_table: start %lld, end %lld\n", start, end);
@@ -1179,7 +1181,9 @@ int create_inode(char *pathname, struct inode *i)
int read_directory_table(long long start, long long end)
{
- int bytes = 0, size = 0, res;
+ int res;
+ long long bytes = 0;
+ long long size = 0;
TRACE("read_directory_table: start %lld, end %lld\n", start, end);
diff --git a/squashfs-tools/unsquashfs.h b/squashfs-tools/unsquashfs.h
index f9c49ac..aeca4b7 100644
--- a/squashfs-tools/unsquashfs.h
+++ b/squashfs-tools/unsquashfs.h
@@ -74,7 +74,7 @@ struct super_block {
struct hash_table_entry {
long long start;
- int bytes;
+ long long bytes;
struct hash_table_entry *next;
};
@@ -241,7 +241,7 @@ extern struct cache *fragment_cache, *data_cache;
/* unsquashfs.c */
extern int read_inode_table(long long, long long);
extern int read_directory_table(long long, long long);
-extern int lookup_entry(struct hash_table_entry **, long long);
+extern long long lookup_entry(struct hash_table_entry **, long long);
extern int read_fs_bytes(int fd, long long, int, void *);
extern int read_block(int, long long, long long *, int, void *);
extern void enable_progress_bar();
--
1.8.3.1

27
6008-unsquash-4-fix-error-message.patch
View File

@ -1,27 +0,0 @@
From 4d10d247eb9a40dad9cc30d1fa008020d5ce07a1 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 01:20:52 -0400
Subject: [PATCH 8/8] unsquash-4-fix-error-message
---
squashfs-tools/unsquash-4.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 211a796..02b5cfc 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -297,8 +297,8 @@ struct dir *squashfs_opendir_4(unsigned int block_start, unsigned int offset,
bytes = lookup_entry(directory_table_hash, start);
if(bytes == -1)
- EXIT_UNSQUASH("squashfs_opendir: directory block %d not "
- "found!\n", block_start);
+ EXIT_UNSQUASH("squashfs_opendir: directory block %lld not "
+ "found!\n", start);
bytes += (*i)->offset;
size = (*i)->data + bytes - 3;
--
1.8.3.1

426
6009-CVE-2015-464.patch
View File

@ -1,426 +0,0 @@
From 6831ab9f5ae7c8d224a2b8075bd04815ed7d5e17 Mon Sep 17 00:00:00 2001
From: renxudong <renxudong1@huawei.com>
Date: Sun, 11 Aug 2019 03:17:20 -0400
Subject: [PATCH] CVE-2015-464
---
squashfs-tools/read_xattrs.c | 57 ++++++++---
squashfs-tools/unsquash-4.c | 232 +++++++++++++++++++++++++++++++++++--------
2 files changed, 236 insertions(+), 53 deletions(-)
diff --git a/squashfs-tools/read_xattrs.c b/squashfs-tools/read_xattrs.c
index 9c66387..189a8a1 100644
--- a/squashfs-tools/read_xattrs.c
+++ b/squashfs-tools/read_xattrs.c
@@ -150,7 +150,16 @@ static int read_xattr_entry(struct xattr_list *xattr,
*/
int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, long long *table_start)
{
- int res, bytes, i, indexes, index_bytes, ids;
+ /*
+ * Note on overflow limits:
+ * Size of ids (id_table.xattr_ids) is 2^32 (unsigned int)
+ * Max size of bytes is 2^32*16 or 2^36
+ * Max indexes is (2^32*16)/8K or 2^23
+ * Max index_bytes is ((2^32*16)/8K)*8 or 2^26 or 64M
+ */
+ int res, i, indexes, index_bytes;
+ unsigned int ids;
+ long long bytes;
long long *index, start, end;
struct squashfs_xattr_table id_table;
@@ -170,24 +179,44 @@ int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, l
SQUASHFS_INSWAP_XATTR_TABLE(&id_table);
- if(flag) {
- /*
- * id_table.xattr_table_start stores the start of the compressed xattr
- * * metadata blocks. This by definition is also the end of the previous
- * filesystem table - the id lookup table.
- */
+ /*
+ * Compute index table values
+ */
+ ids = id_table.xattr_ids;
+ xattr_table_start = id_table.xattr_table_start;
+ index_bytes = SQUASHFS_XATTR_BLOCK_BYTES((long long) ids);
+ indexes = SQUASHFS_XATTR_BLOCKS((long long) ids);
+
+ /*
+ * The size of the index table (index_bytes) should match the
+ * table start and end points
+ */
+ if(index_bytes != (sBlk->bytes_used - (sBlk->xattr_id_table_start + sizeof(id_table)))) {
+ ERROR("read_xattrs_from_disk: Bad xattr_ids count in super block\n");
+ return 0;
+ }
+
+ /*
+ * id_table.xattr_table_start stores the start of the compressed xattr
+ * metadata blocks. This by definition is also the end of the previous
+ * filesystem table - the id lookup table.
+ */
+ if(table_start != NULL)
*table_start = id_table.xattr_table_start;
+
+ /*
+ * If flag is set then return once we've read the above
+ * table_start. That value is necessary for sanity checking,
+ * but we don't actually want to extract the xattrs, and so
+ * stop here.
+ */
+ if(flag)
return id_table.xattr_ids;
- }
/*
* Allocate and read the index to the xattr id table metadata
* blocks
*/
- ids = id_table.xattr_ids;
- xattr_table_start = id_table.xattr_table_start;
- index_bytes = SQUASHFS_XATTR_BLOCK_BYTES(ids);
- indexes = SQUASHFS_XATTR_BLOCKS(ids);
index = malloc(index_bytes);
if(index == NULL)
MEM_ERROR();
@@ -203,7 +232,7 @@ int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, l
* Allocate enough space for the uncompressed xattr id table, and
* read and decompress it
*/
- bytes = SQUASHFS_XATTR_BYTES(ids);
+ bytes = SQUASHFS_XATTR_BYTES((long long) ids);
xattr_ids = malloc(bytes);
if(xattr_ids == NULL)
MEM_ERROR();
@@ -213,7 +242,7 @@ int read_xattrs_from_disk(int fd, struct squashfs_super_block *sBlk, int flag, l
bytes & (SQUASHFS_METADATA_SIZE - 1);
int length = read_block(fd, index[i], NULL, expected,
((unsigned char *) xattr_ids) +
- (i * SQUASHFS_METADATA_SIZE));
+ ((long long) i * SQUASHFS_METADATA_SIZE));
TRACE("Read xattr id table block %d, from 0x%llx, length "
"%d\n", i, index[i], length);
if(length == 0) {
diff --git a/squashfs-tools/unsquash-4.c b/squashfs-tools/unsquash-4.c
index 02b5cfc..a1da4c7 100644
--- a/squashfs-tools/unsquash-4.c
+++ b/squashfs-tools/unsquash-4.c
@@ -29,23 +29,55 @@
static struct squashfs_fragment_entry *fragment_table;
static unsigned int *id_table;
-static int read_fragment_table(long long *directory_table_end)
+long long *alloc_index_table(int indexes)
{
+ static long long *alloc_table = NULL;
+ static int alloc_size = 0;
+ int length = indexes * sizeof(long long);
+
+ if(alloc_size < length) {
+ long long *table = realloc(alloc_table, length);
+
+ if(table == NULL)
+ EXIT_UNSQUASH("alloc_index_table: failed to allocate "
+ "index table\n");
+
+ alloc_table = table;
+ alloc_size = length;
+ }
+
+ return alloc_table;
+}
+
+static int read_fragment_table(long long *table_start)
+{
+ /*
+ * Note on overflow limits:
+ * Size of SBlk.s.fragments is 2^32 (unsigned int)
+ * Max size of bytes is 2^32*16 or 2^36
+ * Max indexes is (2^32*16)/8K or 2^23
+ * Max length is ((2^32*16)/8K)*8 or 2^26 or 64M
+ */
int res, i;
- size_t bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
- size_t indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
+ long long bytes = SQUASHFS_FRAGMENT_BYTES((long long) sBlk.s.fragments);
+ int indexes = SQUASHFS_FRAGMENT_INDEXES((long long) sBlk.s.fragments);
+ int length = SQUASHFS_FRAGMENT_INDEX_BYTES((long long) sBlk.s.fragments);
long long *fragment_table_index;
+ /*
+ * The size of the index table (length bytes) should match the
+ * table start and end points
+ */
+ if(length != (*table_start - sBlk.s.fragment_table_start)) {
+ ERROR("read_fragment_table: Bad fragment count in super block\n");
+ return FALSE;
+ }
+
TRACE("read_fragment_table: %u fragments, reading %zu fragment indexes "
"from 0x%llx\n", sBlk.s.fragments, indexes,
sBlk.s.fragment_table_start);
- if(sBlk.s.fragments == 0) {
- *directory_table_end = sBlk.s.fragment_table_start;
- return TRUE;
- }
-
- fragment_table_index = malloc(indexes*sizeof(long long));
+ fragment_table_index = alloc_index_table(indexes);
if(fragment_table_index == NULL)
EXIT_UNSQUASH("read_fragment_table: failed to allocate "
"fragment table index\n");
@@ -55,9 +87,8 @@ static int read_fragment_table(long long *directory_table_end)
EXIT_UNSQUASH("read_fragment_table: failed to allocate "
"fragment table\n");
- res = read_fs_bytes(fd, sBlk.s.fragment_table_start,
- SQUASHFS_FRAGMENT_INDEX_BYTES(sBlk.s.fragments),
- fragment_table_index);
+ res = read_fs_bytes(fd, sBlk.s.fragment_table_start, length,
+ fragment_table_index);
if(res == FALSE) {
ERROR("read_fragment_table: failed to read fragment table "
"index\n");
@@ -83,7 +114,7 @@ static int read_fragment_table(long long *directory_table_end)
for(i = 0; i < sBlk.s.fragments; i++)
SQUASHFS_INSWAP_FRAGMENT_ENTRY(&fragment_table[i]);
- *directory_table_end = fragment_table_index[0];
+ *table_start = fragment_table_index[0];
return TRUE;
}
@@ -361,25 +392,42 @@ corrupted:
}
-static int read_uids_guids(long long *table_start)
+static int read_id_table(long long *table_start)
{
+ /*
+ * Note on overflow limits:
+ * Size of SBlk.s.no_ids is 2^16 (unsigned short)
+ * Max size of bytes is 2^16*4 or 256K
+ * Max indexes is (2^16*4)/8K or 32
+ * Max length is ((2^16*4)/8K)*8 or 256
+ */
int res, i;
int bytes = SQUASHFS_ID_BYTES(sBlk.s.no_ids);
int indexes = SQUASHFS_ID_BLOCKS(sBlk.s.no_ids);
- long long id_index_table[indexes];
+ int length = SQUASHFS_ID_BLOCK_BYTES(sBlk.s.no_ids);
+ long long *id_index_table;
- TRACE("read_uids_guids: no_ids %d\n", sBlk.s.no_ids);
+ /*
+ * The size of the index table (length bytes) should match the
+ * table start and end points
+ */
+ if(length != (*table_start - sBlk.s.id_table_start)) {
+ ERROR("read_id_table: Bad id count in super block\n");
+ return FALSE;
+ }
+
+ TRACE("read_id_table: no_ids %d\n", sBlk.s.no_ids);
+ id_index_table = alloc_index_table(indexes);
id_table = malloc(bytes);
if(id_table == NULL) {
- ERROR("read_uids_guids: failed to allocate id table\n");
+ ERROR("read_id_table: failed to allocate id table\n");
return FALSE;
}
- res = read_fs_bytes(fd, sBlk.s.id_table_start,
- SQUASHFS_ID_BLOCK_BYTES(sBlk.s.no_ids), id_index_table);
+ res = read_fs_bytes(fd, sBlk.s.id_table_start, length, id_index_table);
if(res == FALSE) {
- ERROR("read_uids_guids: failed to read id index table\n");
+ ERROR("read_id_table: failed to read id index table\n");
return FALSE;
}
SQUASHFS_INSWAP_ID_BLOCKS(id_index_table, indexes);
@@ -398,7 +446,7 @@ static int read_uids_guids(long long *table_start)
res = read_block(fd, id_index_table[i], NULL, expected,
((char *) id_table) + i * SQUASHFS_METADATA_SIZE);
if(res == FALSE) {
- ERROR("read_uids_guids: failed to read id table block"
+ ERROR("read_id_table: failed to read id table block"
"\n");
return FALSE;
}
@@ -412,12 +460,30 @@ static int read_uids_guids(long long *table_start)
static int parse_exports_table(long long *table_start)
{
+ /*
+ * Note on overflow limits:
+ * Size of SBlk.s.inodes is 2^32 (unsigned int)
+ * Max indexes is (2^32*8)/8K or 2^22
+ * Max length is ((2^32*8)/8K)*8 or 2^25
+ */
int res;
- int indexes = SQUASHFS_LOOKUP_BLOCKS(sBlk.s.inodes);
- long long export_index_table[indexes];
+ int indexes = SQUASHFS_LOOKUP_BLOCKS((long long) sBlk.s.inodes);
+ int length = SQUASHFS_LOOKUP_BLOCK_BYTES((long long) sBlk.s.inodes);
+ long long *export_index_table;
+
+ /*
+ * The size of the index table (length bytes) should match the
+ * table start and end points
+ */
+ if(length != (*table_start - sBlk.s.lookup_table_start)) {
+ ERROR("parse_exports_table: Bad inode count in super block\n");
+ return FALSE;
+ }
- res = read_fs_bytes(fd, sBlk.s.lookup_table_start,
- SQUASHFS_LOOKUP_BLOCK_BYTES(sBlk.s.inodes), export_index_table);
+ export_index_table = alloc_index_table(indexes);
+
+ res = read_fs_bytes(fd, sBlk.s.lookup_table_start, length,
+ export_index_table);
if(res == FALSE) {
ERROR("parse_exports_table: failed to read export index table\n");
return FALSE;
@@ -437,30 +503,118 @@ static int parse_exports_table(long long *table_start)
int read_filesystem_tables_4()
{
- long long directory_table_end, table_start;
+ long long table_start;
- if(read_xattrs_from_disk(fd, &sBlk.s, no_xattrs, &table_start) == 0)
- return FALSE;
+ /* Read xattrs */
+ if(sBlk.s.xattr_id_table_start != SQUASHFS_INVALID_BLK) {
+ /* sanity check super block contents */
+ if(sBlk.s.xattr_id_table_start >= sBlk.s.bytes_used) {
+ ERROR("read_filesystem_tables: xattr id table start too large in super block\n");
+ goto corrupted;
+ }
- if(read_uids_guids(&table_start) == FALSE)
- return FALSE;
+ if(read_xattrs_from_disk(fd, &sBlk.s, no_xattrs, &table_start) == 0)
+ goto corrupted;
+ } else
+ table_start = sBlk.s.bytes_used;
- if(parse_exports_table(&table_start) == FALSE)
- return FALSE;
+ /* Read id lookup table */
- if(read_fragment_table(&directory_table_end) == FALSE)
- return FALSE;
+ /* Sanity check super block contents */
+ if(sBlk.s.id_table_start >= table_start) {
+ ERROR("read_filesystem_tables: id table start too large in super block\n");
+ goto corrupted;
+ }
- if(read_inode_table(sBlk.s.inode_table_start,
- sBlk.s.directory_table_start) == FALSE)
- return FALSE;
+ /* there should always be at least one id */
+ if(sBlk.s.no_ids == 0) {
+ ERROR("read_filesystem_tables: Bad id count in super block\n");
+ goto corrupted;
+ }
+
+ /*
+ * the number of ids can never be more than double the number of inodes
+ * (the maximum is a unique uid and gid for each inode).
+ */
+ if(sBlk.s.no_ids > (sBlk.s.inodes * 2L)) {
+ ERROR("read_filesystem_tables: Bad id count in super block\n");
+ goto corrupted;
+ }
+
+ if(read_id_table(&table_start) == FALSE)
+ goto corrupted;
+
+ /* Read exports table */
+ if(sBlk.s.lookup_table_start != SQUASHFS_INVALID_BLK) {
+
+ /* sanity check super block contents */
+ if(sBlk.s.lookup_table_start >= table_start) {
+ ERROR("read_filesystem_tables: lookup table start too large in super block\n");
+ goto corrupted;
+ }
+
+ if(parse_exports_table(&table_start) == FALSE)
+ goto corrupted;
+ }
+
+ /* Read fragment table */
+ if(sBlk.s.fragments != 0) {
+
+ /* Sanity check super block contents */
+ if(sBlk.s.fragment_table_start >= table_start) {
+ ERROR("read_filesystem_tables: fragment table start too large in super block\n");
+ goto corrupted;
+ }
+
+ /* The number of fragments should not exceed the number of inodes */
+ if(sBlk.s.fragments > sBlk.s.inodes) {
+ ERROR("read_filesystem_tables: Bad fragment count in super block\n");
+ goto corrupted;
+ }
+
+ if(read_fragment_table(&table_start) == FALSE)
+ goto corrupted;
+ } else {
+ /*
+ * Sanity check super block contents - with 0 fragments,
+ * the fragment table should be empty
+ */
+ if(sBlk.s.fragment_table_start != table_start) {
+ ERROR("read_filesystem_tables: fragment table start invalid in super block\n");
+ goto corrupted;
+ }
+ }
+
+ /* Read directory table */
+
+ /* Sanity check super block contents */
+ if(sBlk.s.directory_table_start >= table_start) {
+ ERROR("read_filesystem_tables: directory table start too large in super block\n");
+ goto corrupted;
+ }
if(read_directory_table(sBlk.s.directory_table_start,
- directory_table_end) == FALSE)
- return FALSE;
+ table_start) == FALSE)
+ goto corrupted;
+
+ /* Read inode table */
+
+ /* Sanity check super block contents */
+ if(sBlk.s.inode_table_start >= sBlk.s.directory_table_start) {
+ ERROR("read_filesystem_tables: inode table start too large in super block\n");
+ goto corrupted;
+ }
+
+ if(read_inode_table(sBlk.s.inode_table_start,
+ sBlk.s.directory_table_start) == FALSE)
+ goto corrupted;
if(no_xattrs)
sBlk.s.xattr_id_table_start = SQUASHFS_INVALID_BLK;
return TRUE;
+
+corrupted:
+ ERROR("File system corruption detected\n");
+ return FALSE;
}
--
1.8.3.1

27
9000-makedev-miss-headfile.patch
View File

@ -1,27 +0,0 @@
From: yujinyang <yujinyang1@huawei.com>
Date: Wed Dec 12 06:09:17 2018 -0500
Subject: fix makedev miss headfile
diff -Nur squashfs4.3-old/squashfs-tools/mksquashfs.c squashfs4.3/squashfs-tools/mksquashfs.c
--- squashfs4.3-old/squashfs-tools/mksquashfs.c 2018-12-12 15:59:59.805000000 +0800
+++ squashfs4.3/squashfs-tools/mksquashfs.c 2018-12-12 09:20:18.000000000 +0800
@@ -50,6 +50,7 @@
#include <sys/wait.h>
#include <limits.h>
#include <ctype.h>
+#include <sys/sysmacros.h>
#ifndef linux
#define __BYTE_ORDER BYTE_ORDER
diff -Nur squashfs4.3-old/squashfs-tools/unsquashfs.c squashfs4.3/squashfs-tools/unsquashfs.c
--- squashfs4.3-old/squashfs-tools/unsquashfs.c 2018-12-12 15:59:59.802000000 +0800
+++ squashfs4.3/squashfs-tools/unsquashfs.c 2018-12-12 09:24:57.000000000 +0800
@@ -30,7 +30,7 @@
#include "xattr.h"
#include "unsquashfs_info.h"
#include "stdarg.h"
-
+#include <sys/sysmacros.h>
#include <sys/sysinfo.h>
#include <sys/types.h>
#include <sys/time.h>

146
mksquashfs.1
View File

@ -1,146 +0,0 @@
.TH MKSQUASHFS 1 "2014\-05\-13" "4.3" "create and append squashfs filesystems"
.SH NAME
mksquashfs \- tool to create and append to squashfs filesystems
.SH SYNOPSIS
\fBmksquashfs\fR \fISOURCE\fR [\fISOURCE2\fR \fI...\fR] \fIDESTINATION\fR [\fIOPTIONS\fR]
.SH DESCRIPTION
Squashfs is a highly compressed read\-only filesystem for Linux. It uses zlib compression to compress both files, inodes and directories. Inodes in the system are very small and all blocks are packed to minimize data overhead. Block sizes greater than 4K are supported up to a maximum of 64K.
.PP
Squashfs is intended for general read\-only filesystem use, for archival use (i.e. in cases where a .tar.gz file may be used), and in constrained block device/memory systems (e.g. embedded systems) where low overhead is needed.
.SH OPTIONS
.SS Filesystem build options
.IP "\-comp \fICOMPRESSION\fR" 4
select \fICOMPRESSION\fR compression. Compressors available: gzip (default), lzma (no kernel support), lzo, lz4 and xz.
.IP "\-b \fIBLOCK_SIZE\fR"
set data block to \fIBLOCK_SIZE\fR. Default 131072 bytes. Optionally K or M can be used as a suffix to specify kilobytes or megabytes, respectively.
.IP "\-no\-exports" 4
don't make the filesystem exportable via NFS.
.IP "\-no\-sparse" 4
don't detect sparse files.
.IP "\-no\-xattrs" 4
don't store extended attributes.
.IP "\-xattrs" 4
store extended attributes (default).
.IP "\-noI" 4
do not compress inode table.
.IP "\-noD" 4
do not compress data blocks.
.IP "\-noF" 4
do not compress fragment blocks.
.IP "\-noX" 4
do not compress extended attributes.
.IP "\-no\-fragments" 4
do not use fragments.
.IP "\-always\-use\-fragments" 4
use fragment blocks for files larger than block size.
.IP "\-no\-duplicates" 4
do not perform duplicate checking.
.IP "\-all\-root" 4
make all files owned by root.
.IP "\-force\-uid uid" 4
set all file uids to uid.
.IP "\-force\-gid gid" 4
set all file gids to gid.
.IP "\-nopad" 4
do not pad filesystem to a multiple of 4K.
.IP "\-keep\-as\-directory" 4
if one source directory is specified, create a root directory containing that directory, rather than the contents of the directory.
.SS Filesystem filter options
.IP "\-p \fIPSEUDO_DEFINITION\fR" 4
Add pseudo file definition.
.IP "\-pf \fIPSEUDO_FILE\fR" 4
Add list of pseudo file definitions.
.IP "\-sort \fISORT_FILE\fR" 4
sort files according to priorities in \fISORT_FILE\fR. One file or dir with priority per line. Priority \-32768 to 32767, default priority 0.
.IP "\-ef \fIEXCLUDE_FILE\fR" 4
list of exclude dirs/files. One per line.
.IP "\-wildcards" 4
Allow extended shell wildcards (globbing) to be used in exclude dirs/files
.IP "\-regex" 4
Allow POSIX regular expressions to be used in exclude dirs/files.
.SS Filesystem append options
.IP "\-noappend" 4
do not append to existing filesystem.
.IP "\-root\-becomes \fINAME\fR" 4
when appending source files/directories, make the original root become a subdirectory in the new root called \fINAME\fR, rather than adding the new source items to the original root.
.SS Mksquashfs runtime options:
.IP "\-version" 4
print version, licence and copyright message.
.IP "\-exit\-on\-error" 4
treat normally ignored errors as fatal.
.IP "\-recover \fINAME\fR" 4
recover filesystem data using recovery file \fINAME\fR.
.IP "\-no\-recovery" 4
don't generate a recovery file.
.IP "\-info" 4
print files written to filesystem.
.IP "\-no\-progress" 4
don't display the progress bar.
.IP "\-progress" 4
display progress bar when using the \-info option.
.IP "\-processors \fINUMBER\fR" 4
Use \fINUMBER\fR processors. By default will use number of processors available.
.IP "\-mem \fISIZE\fR" 4
Use \fISIZE\fR physical memory. Optionally K or M can be used as a suffix for kilobytes or megabytes, respectively. Default 25% of memory.
.IP "\-read\-queue \fISIZE\fR" 4
Deprecated. Use \-mem instead.
.IP "\-write\-queue \fISIZE\fR" 4
Deprecated. Use \-mem instead.
.IP "\-fragment\-queue \fISIZE\fR" 4
Deprecated. Use \-mem instead.
.SS Miscellaneous options
.IP "\-root\-owned" 4
alternative name for \-all\-root.
.IP "\-noInodeCompression" 4
alternative name for \-noI.
.IP "\-noDataCompression" 4
alternative name for \-noD.
.IP "\-noFragmentCompression" 4
alternative name for \-noF.
.IP "\-noXattrCompression" 4
alternative name for \-noX.
.IP "\-Xhelp" 4
print compressor options for selected compressor
.SS Compressors available and compressor specific options
.IP "gzip (default)"
.IP "\-Xcompression-level \fIcompression\-level\fR" 4
\fIcompression\-level\fR should be 1 .. 9 (default 9)
.IP "\-Xwindow\-size \fIwindow\-size\fR" 4
\fIwindow\-size\fR should be 8 .. 15 (default 15)
.IP "\-Xstrategy strategy1,strategy2,...,strategyN" 4
Compress using strategy1,strategy2,...,strategyN in turn and choose the best compression. Available strategies: default, filtered, huffman_only, run_length_encoded and fixed
.IP "lzmz (no options) (no kernel support)" 4
.IP "lzo" 4
.IP "\-Xalgorithm \fIalgorithm\fR" 4
Where \fIalgorithm\fR is one of: lzo1x_1, lzo1x_1_11, lzo1x_1_12, lzo1x_1_15 or lzo1x_999. (default lzo1x_999)
.IP "\-Xcompression\-level \fIcompression\-level\fR" 4
\fIcompression\-level\fR should be 1 .. 9 (default 8)
.IP "lz4" 4
.IP "\-Xhc"
Compress using LZ4 High Compression
.IP "xz" 4
.IP "\-Xbcj filter1,filter2,...,filterN" 4
Compress using filter1,filter2,...,filterN in turn (in addition to no filter), and choose the best compression. Available filters: x86, arm, armthumb, powerpc, sparc, ia64.
.IP "\-Xdict\-size \fIDICT_SIZE\fR" 4
Use \fIDICT_SIZE\fR as the XZ dictionary size. The dictionary size can be specified as a percentage of the block size, or as an absolute value. The dictionary size must be less than or equal to the block size and 8192 bytes or larger. It must also be storable in the xz header as either 2^n or as 2^n+2^(n+1). Example dict\-sizes are 75%, 50%, 37.5%, 25%, or 32K, 16K, 8K etc.
.SH SEE ALSO
unsquashfs(1)
.SH HOMEPAGE
More information about mksquashfs and the squashfs filesystem can be found at <\fIhttp://squashfs.sourceforge.net/\fR>.
.SH AUTHOR
squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
.PP
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.

49
squashfs-tools.spec
View File

@ -1,75 +1,44 @@
Name: squashfs-tools
Version: 4.3
Release: 17
Version: 4.4
Release: 1
Summary: Utility for the squashfs filesystems
License: GPLv2+
URL: http://squashfs.sourceforge.net/
Source0: http://downloads.sourceforge.net/squashfs/squashfs%{version}.tar.gz
Source1: mksquashfs.1
Source2: unsquashfs.1
Patch0: 0000-PAE.patch
Patch1: 0001-mem-overflow.patch
Patch2: 0002-2gb.patch
Patch3: 0003-cve-2015-4645.patch
Patch4: 0004-local-cve-fix.patch
#notice patch sequence because of autosetup
Patch9000: 9000-makedev-miss-headfile.patch
Patch6000: 6000-mksquashfs.c-get-inline-functions-work-with-C99.patch
Patch6001: 6001-unsquashfs-Fix-one-off-error-in-name-length-check.patch
Patch6002: 6002-unsquashfs-add-definition-for-SQUASHFS_DIR_COUNT.patch
Patch6003: 6003-unsquashfs-Be-more-explicit-when-file-system-corrupt.patch
Patch6004: 6004-unsquashfs-move-fs-table-reading-into-the-version-sp.patch
Patch6005: 6005-unsquashfs-no-longer-need-to-version-and-export-some.patch
Patch6006: 6006-unsquash-4-get-fs-table-start-and-end-points.patch
Patch6007: 6007-unsquashfs-Make-some-variables-long-long-rather-than.patch
Patch6008: 6008-unsquash-4-fix-error-message.patch
Patch6009: 6009-CVE-2015-464.patch
BuildRequires: zlib-devel xz-devel git
BuildRequires: zlib-devel xz-devel libzstd-devel git
BuildRequires: lzo-devel libattr-devel lz4-devel
%description
Squashfs is a highly compressed read-only filesystem for Linux.
It uses either gzip/xz/lzo/lz4 compression to compress both files, inodes
It uses either gzip/xz/lzo/lz4/zstd compression to compress both files, inodes
and directories.
%package help
Summary: Including man files for squashfs-tools
Requires: man
%description help
This contains man files for the using of squashfs-tools.
%prep
%autosetup -n squashfs%{version} -p1 -S git
%build
CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 \
CFLAGS="%{optflags}" XZ_SUPPORT=1 LZO_SUPPORT=1 LZMA_XZ_SUPPORT=1 LZ4_SUPPORT=1 ZSTD_SUPPORT=1 \
%make_build -C squashfs-tools
%install
install -D -m 755 squashfs-tools/mksquashfs %{buildroot}%{_sbindir}/mksquashfs
install -D -m 755 squashfs-tools/unsquashfs %{buildroot}%{_sbindir}/unsquashfs
install -D -m 644 %{SOURCE1} %{buildroot}%{_mandir}/man1/mksquashfs.1
install -D -m 644 %{SOURCE2} %{buildroot}%{_mandir}/man1/unsquashfs.1
%files
%defattr(-,root,root)
%doc ACKNOWLEDGEMENTS README README-4.3 DONATIONS
%doc ACKNOWLEDGEMENTS README-4.4
%license COPYING
%{_sbindir}/mksquashfs
%{_sbindir}/unsquashfs
%files help
%{_mandir}/man1/*
%changelog
* Tue Oct 15 2019 zhanghaibo <ted.zhang@huawei.com> - 4.4-1
- Rebase to version 4.4
* Wed Jul 18 2018 openEuler Buildteam <buildteam@openeuler.org> - 4.3-17
- Package init

BIN
squashfs4.3.tar.gz
View File

Binary file not shown.

BIN
squashfs4.4.tar.gz Normal file
View File

Binary file not shown.

66
unsquashfs.1
View File

@ -1,66 +0,0 @@
.TH UNSQUASHFS 1 "2014\-05\-13" "4.3" "uncompress squashfs filesystems"
.SH NAME
mksquashfs \- tool to uncompress squashfs filesystems
.SH SYNOPSIS
\fBunsquashfs\fR [\fIOPTIONS\fR] \fIFILESYSTEM\fR [\fIdirectories or files to extract\fR]
.SH DESCRIPTION
Squashfs is a highly compressed read\-only filesystem for Linux. It uses zlib compression to compress both files, inodes and directories. Inodes in the system are very small and all blocks are packed to minimize data overhead. Block sizes greater than 4K are supported up to a maximum of 64K.
.PP
Squashfs is intended for general read\-only filesystem use, for archival use (i.e. in cases where a .tar.gz file may be used), and in constrained block device/memory systems (e.g. embedded systems) where low overhead is needed.
.SH OPTIONS
.IP "\-v, \-version" 4
print version, licence and copyright information.
.IP "\-d \fIPATHNAME\fR, \-dest \fIPATHNAME\fR" 4
unsquash to \fIPATHNAME\fR, default "squashfs\-root".
.IP "\-n, \-no\-progress" 4
don't display the progress bar.
.IP "\-no, \-no\-xattrs" 4
don't extract xattrs in file system.
.IP "\-x, \-xattrs" 4
extract xattrs in file system (default).
.IP "\-u, \-user\-xattrs" 4
only extract user xattrs in file system. Enables extracting xattrs.
.IP "\-p \fINUMBER\fR, \-processors \fINUMBER\fR" 4
use \fINUMBER\fR processors. By default will use number of processors available.
.IP "\-i, \-info" 4
print files as they are unsquashed.
.IP "\-li, \-linfo" 4
print files as they are unsquashed with file attributes (like ls \-l output).
.IP "\-l, \-ls" 4
list filesystem, but don't unsquash.
.IP "\-ll, \-lls" 4
list filesystem with file attributes (like ls \-l output), but don't unsquash.
.IP "\-f, \-force" 4
if file already exists then overwrite.
.IP "\-s, \-stat" 4
display filesystem superblock information.
.IP "\-e \fIEXTRACT_FILE\fR, \-ef \fIEXTRACT_FILE\fR" 4
list of directories or files to extract. One per line.
.IP "\-da \fISIZE\fR, \-data\-queue \fISIZE\fR" 4
Set data queue to \fISIZE\fR Mbytes. Default 256 Mbytes.
.IP "\-fr \fISIZE\fR, \-frag\-queue \fISIZE\fR" 4
Set fragment queue to \fISIZE\fR Mbytes. Default 256 Mbytes.
.IP "\-r, \-regex" 4
treat extract names as POSIX regular expressions rather than use the default shell wildcard expansion (globbing).
.SS Decompressors available
.IP "gzip" 4
.IP "lzma" 4
.IP "lzo" 4
.IP "lz4" 4
.IP "xz" 4
.SH SEE ALSO
mksquashfs(1)
.SH HOMEPAGE
More information about unsquashfs and the squashfs filesystem can be found at <\fIhttp://squashfs.sourceforge.net/\fR>.
.SH AUTHOR
squashfs was written by Phillip Lougher <\fIplougher@users.sourceforge.net\fR>.
.PP
This manual page was written by Daniel Baumann <\fIdaniel.baumann@progress\-technologies.net\fR>. With some updates for 4.3 for use with Fedora.