[PATCH] Fix a squashfs crash when reading large directories

[Campbell Suter]

SquashFS encodes directories with more than 256 entries, with xattrs or
a few other things with a different type of inode than most directories.

This type of directory entry has an indexing feature to increase the
performance of filename lookups. When U-Boot's squashfs driver
calculates the length of such an inode, it incorrectly adds one to the
number of indexes which causes the length to be miscalculated, causing a
synchronous abort when reading the next inode.

This occurs for directories that satisfy all the following conditions:

* They have at least 257 entries, the size of their inodes add to >8K,
or they have extended attributes. 
* They are not the root directory (as there is no subsequent inode to
read), and are not the last child of the root directory.
* The length of the names of all the child files sum to a sufficent
value (I think this is the point where the child entries span multiple
metadata blocks, but I haven't confirmed it)

The following script generates a squashfs that was crashing when listed:

mkdir -p files/{a,b,c}         
pad=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
for i in {1..257}; do touch files/b/file-$(printf '%03d' $i)-$pad done
mksquashfs files result.squashfs
  
Signed-off-by: Campbell Suter <campbell at snapit.group>
---
  
 fs/squashfs/sqfs_inode.c | 4 ++-- 
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/squashfs/sqfs_inode.c b/fs/squashfs/sqfs_inode.c
index 14d70cf678..e76ec7cbdf 100644
--- a/fs/squashfs/sqfs_inode.c
+++ b/fs/squashfs/sqfs_inode.c
@@ -49,7 +49,7 @@ int sqfs_inode_size(struct squashfs_base_inode *inode, u32 blk_size)
                        return sizeof(*ldir);
 
                di = ldir->index;
-               while (l < i_count + 1) {
+               while (l < i_count) {                   
                        sz = get_unaligned_le32(&di->size) + 1;
                        index_list_size += sz;          
                        di = (void *)di + sizeof(*di) + sz;
@@ -57,7 +57,7 @@ int sqfs_inode_size(struct squashfs_base_inode *inode, u32 blk_size)
                }
 
                return sizeof(*ldir) + index_list_size +
-                       (i_count + 1) * SQFS_DIR_INDEX_BASE_LENGTH;
+                       i_count * SQFS_DIR_INDEX_BASE_LENGTH;
        }
 
        case SQFS_LREG_TYPE: {
-- 
2.28.0