Package: squashfs-tools-ng
Version: 1.0.3-1
Severity: important
File: /usr/bin/gensquashfs
gensquashfs cannot understand filenames that include literal backslashes.
This occurs in the real world to anyone who clones systemd:
https://github.com/systemd/systemd/blob/master/test/fuzz/fuzz-unit-file/
https://github.com/systemd/systemd/blob/master/test/fuzz/fuzz-unit-file/dev-mapper-fedora_krowka%5Cx2dswap.swap
Here is a minimal test recipe:
root@not-omega:/# dpkg-query -W squashfs-tools-ng
squashfs-tools-ng 1.0.3-1
root@not-omega:/# mkdir a
root@not-omega:/# touch a/b\\c
root@not-omega:/# find a -ls
11806 0 drwxr-xr-x 2 root root 60 Jan 8 19:43 a
11807 0 -rw-r--r-- 1 root root 0 Jan 8 19:43
a/b\\c
root@not-omega:/# gensquashfs -D a a.sq
packing b/c
b/c: No such file or directory
Note that original squashfs-tools can handle this file, and
squashfs-tools-ng can read the result:
root@not-omega:/# dpkg-query -W squashfs-tools
squashfs-tools 1:4.4-2
root@not-omega:/# mksquashfs a a.sq -noappend
[...]
root@not-omega:/# rdsquashfs --list / a.sq
-rw-r--r-- 0/0 0 b\c
root@not-omega:/# unsquashfs -ll a.sq
Parallel unsquashfs: Using 4 processors
1 inodes (0 blocks) to write
drwxr-xr-x root/root 26 2021-01-08 19:43 squashfs-root
-rw-r--r-- root/root 0 2021-01-08 19:43 squashfs-root/b\c
This issue also occurs on squashfs-tools-ng 1.0.0-2.
-- System Information:
Debian Release: 10.7
APT prefers stable
APT policy: (990, 'stable'), (500, 'stable-updates'), (500,
'proposed-updates')
Architecture: amd64 (x86_64)
Kernel: Linux 5.6.0-0.bpo.2-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_AU.utf8, LC_CTYPE=en_AU.utf8 (charmap=UTF-8), LANGUAGE=en_AU:en
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
