Code: static int read_fragment_table(long long *directory_table_end)
 {
 	int res, i;
	int bytes = SQUASHFS_FRAGMENT_BYTES(sBlk.s.fragments);
	int  indexes = SQUASHFS_FRAGMENT_INDEXES(sBlk.s.fragments);
	long long fragment_table_index[indexes];
 
 	TRACE("read_fragment_table: %d fragments, reading %d fragment indexes "
 		"from 0x%llx\n", sBlk.s.fragments, indexes,
 		sBlk.s.fragment_table_start);
 
	if(sBlk.s.fragments == 0) {
		*directory_table_end = sBlk.s.fragment_table_start;
		return TRUE;
	}
 	fragment_table = malloc(bytes);
 	if(fragment_table == NULL)
 		EXIT_UNSQUASH("read_fragment_table: failed to allocate "
 			"fragment table\n");
 
	res = read_fs_bytes(fd, sBlk.s.fragment_table_start,
		SQUASHFS_FRAGMENT_INDEX_BYTES(sBlk.s.fragments),
		fragment_table_index);
 	if(res == FALSE) {
 		ERROR("read_fragment_table: failed to read fragment table "
 			"index\n");
		return FALSE;
	}
	SQUASHFS_INSWAP_FRAGMENT_INDEXES(fragment_table_index, indexes);

	for(i = 0; i < indexes; i++) {
		int expected = (i + 1) != indexes ? SQUASHFS_METADATA_SIZE :
					bytes & (SQUASHFS_METADATA_SIZE - 1);
		int length = read_block(fd, fragment_table_index[i], NULL,
			expected, ((char *) fragment_table) + (i *
			SQUASHFS_METADATA_SIZE));
		TRACE("Read fragment table block %d, from 0x%llx, length %d\n",
			i, fragment_table_index[i], length);
		if(length == FALSE) {
			ERROR("read_fragment_table: failed to read fragment "
				"table index\n");
			return FALSE;
		}
	}

 	for(i = 0; i < sBlk.s.fragments; i++) 
 		SQUASHFS_INSWAP_FRAGMENT_ENTRY(&fragment_table[i]);
 
	*directory_table_end = fragment_table_index[0];
 	return TRUE;
 }

Vulnerability Type: DoS Overflow 
CWE ID: CWE-190
Summary: Integer overflow in the read_fragment_table_4 function in unsquash-4.c in Squashfs and sasquatch allows remote attackers to cause a denial of service (application crash) via a crafted input, which triggers a stack-based buffer overflow.
Commit Message: unsquashfs-4: Add more sanity checks + fix CVE-2015-4645/6

Add more filesystem table sanity checks to Unsquashfs-4 and
also properly fix CVE-2015-4645 and CVE-2015-4646.

The CVEs were raised due to Unsquashfs having variable
oveflow and stack overflow in a number of vulnerable
functions.

The suggested patch only "fixed" one such function and fixed
it badly, and so it was buggy and introduced extra bugs!

The suggested patch was not only buggy, but, it used the
essentially wrong approach too.  It was "fixing" the
symptom but not the cause.  The symptom is wrong values
causing overflow, the cause is filesystem corruption.
This corruption should be detected and the filesystem
rejected *before* trying to allocate memory.

This patch applies the following fixes:

1. The filesystem super-block tables are checked, and the values
   must match across the filesystem.

   This will trap corrupted filesystems created by Mksquashfs.

2. The maximum (theorectical) size the filesystem tables could grow
   to, were analysed, and some variables were increased from int to
   long long.

   This analysis has been added as comments.

3. Stack allocation was removed, and a shared buffer (which is
   checked and increased as necessary) is used to read the
   table indexes.

Signed-off-by: Phillip Lougher <phillip@squashfs.org.uk>