Feature: Add security audit documentation and mimalloc support and optimized build

[EdgeOfAssembly]

Hello,

This pull request introduces several enhancements from the EdgeOfAssembly/squashfs-tools fork, aimed at improving security, performance, and the build process.

Here’s a summary of the key changes:

1. Comprehensive Security Audit: A full set of security audit documents has been added. This includes a detailed methodology, findings, vulnerability analysis, and actionable recommendations. These documents provide a deep dive into the security posture of the codebase and offer a roadmap for hardening.

2. mimalloc Support: This PR integrates optional support for the mimalloc memory allocator. When enabled, mimalloc can offer significant performance improvements, especially in multi-threaded scenarios, along with enhanced memory security features. Documentation and a build script (BUILD_WITH_MIMALLOC.sh) are included.

3. Optimized Build Process: The Makefile has been updated to perform a single-pass compilation, which can speed up the build process.

These changes are intended to be non-disruptive and provide valuable new capabilities and insights for the project.

We would be grateful if you could review these contributions. Thank you for your time and consideration.

Best regards,
@EdgeOfAssembly

[Copilot]

Pull Request Overview

This pull request introduces comprehensive security audit documentation and optional mimalloc memory allocator support to enhance the security posture and performance of squashfs-tools.

Key changes include:

• Complete security audit documentation covering vulnerability analysis, remediation recommendations, and implementation methodology
• Optional mimalloc memory allocator integration for improved performance and security features
• Enhanced build system with single-pass compilation and security-hardened flags

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
squashfs-tools/alloc.h	Adds optional mimalloc support through macro redirection of memory allocation functions
squashfs-tools/Makefile	Implements single-pass compilation, mimalloc build flags, and enhanced security compiler options
VULNERABILITY_DETAILS.md	Provides detailed technical analysis of 7 identified security vulnerabilities with exploitation scenarios
SECURITY_SUMMARY.md	Offers executive summary and quick reference for the security audit findings
SECURITY_RECOMMENDATIONS.md	Contains actionable remediation guide with specific code fixes and implementation timeline
SECURITY_AUDIT_README.md	Serves as navigation guide for all security documentation based on user role
SECURITY_AUDIT.md	Presents comprehensive security audit report with positive findings and identified issues
README.md	Updates to reference new mimalloc documentation
MIMALLOC.md	Documents mimalloc integration including installation, usage, and benefits
BUILD_WITH_MIMALLOC.sh	Provides example build script demonstrating mimalloc compilation with verification
AUDIT_METHODOLOGY.md	Describes the comprehensive methodology used for the security audit process

Comments suppressed due to low confidence (1)

VULNERABILITY_DETAILS.md:1

• The audit date is listed as October 2025, but according to the context, it should be October 2024 or earlier since the knowledge cutoff is January 2025. This creates a temporal inconsistency.

# Detailed Vulnerability Analysis

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

[nitpick] Single-pass compilation approach may make debugging more difficult and could impact build times for incremental changes. Consider keeping the traditional object-based build as the default and making single-pass compilation an optional feature.

Suggested change

	# Single-pass compilation: compile and link all source files at once
	mksquashfs: $(MKSQUASHFS_SRCS) Makefile
	$(CC) $(CFLAGS) $(CPPFLAGS) -DCOMPRESSORS="\"$(subst @, ,$(subst $(space),\n,$(COMPRESSORS)))\"" $(LDFLAGS) $(EXTRA_LDFLAGS) $(MKSQUASHFS_SRCS) $(LIBS) -o $@
	# Object-based build is default; single-pass compilation is optional
	ifdef SINGLE_PASS
	mksquashfs: $(MKSQUASHFS_SRCS) Makefile
	$(CC) $(CFLAGS) $(CPPFLAGS) -DCOMPRESSORS="\"$(subst @, ,$(subst $(space),\n,$(COMPRESSORS)))\"" $(LDFLAGS) $(EXTRA_LDFLAGS) $(MKSQUASHFS_SRCS) $(LIBS) -o $@
	else
	MKSQUASHFS_OBJS := $(patsubst %.c,%.o,$(MKSQUASHFS_SRCS))
	mksquashfs: $(MKSQUASHFS_OBJS)
	$(CC) $(CFLAGS) $(CPPFLAGS) -DCOMPRESSORS="\"$(subst @, ,$(subst $(space),\n,$(COMPRESSORS)))\"" $(LDFLAGS) $(EXTRA_LDFLAGS) $(MKSQUASHFS_OBJS) $(LIBS) -o $@
	endif