OSS-UBOOT-SQUASHFS-OOB-DOS-001
==============================

U-Boot SquashFS parser: unchecked wire-size arithmetic — out-of-bounds read
and uncontrolled-allocation DoS (three sibling sites of CVE-2024-57254..57259).

Affected: U-Boot origin/master @ f605dcee103c897b6f1a8873549a36949bd4e2a1
          (fs/squashfs/sqfs.c, fs/squashfs/sqfs_inode.c). Unpatched.

Impact:   OOB READ + allocation/disk-read DoS. Boot-media / pre-OS tier.
          NO out-of-bounds write, NO RCE claimed.

Contents of this package
------------------------
  report.md            Full write-up: three root causes (file:line + CWE),
                       honest impact, CVSS 3.1 vectors, anti-dup vs the
                       sigma-star CVEs, and the suggested fix.
  reproduce.sh         Clones U-Boot at the pinned commit, builds the faithful
                       host ASan harness from the harness sources below, and
                       nm-confirms the REAL parser is linked. Documents how a
                       trigger image is crafted.
  harness/fuzz_sqfs.c  libFuzzer/standalone harness driver (leaf stubs only).
  harness/harness_dev.c  Real-shaped blk_desc/partition using real U-Boot headers.
  harness/craft.py     Trigger-crafting logic (used to induce each root cause).
  harness/build.sh.orig  Original in-place build script (reference).

TRIGGER IMAGES ARE NOT INCLUDED
-------------------------------
This is a public-list package, so the prebuilt crash/trigger .sqsh images are
intentionally NOT shipped. reproduce.sh documents (and harness/craft.py
implements) how to regenerate them from a stock `mksquashfs -noI` image.
Prebuilt minimal reproducers are available to the maintainers privately on
request.

Quick start
-----------
  bash reproduce.sh          # clone + build the faithful ASan harness
  # then craft a trigger per the instructions reproduce.sh prints, e.g.:
  #   python3 harness/craft.py base.sqsh rc1.sqsh 0
  #   ASAN_OPTIONS=detect_leaks=0 work/harness/fuzz_sqfs rc1.sqsh

Nothing in this package has been sent or disclosed.
