summaryrefslogtreecommitdiff
path: root/archival
diff options
context:
space:
mode:
authorDenys Vlasenko2021-10-11 19:28:39 +0200
committerDenys Vlasenko2021-10-11 19:28:39 +0200
commit6ba1f2d0bcdddb96c43ff9fec34758a4e2b4a467 (patch)
tree1961565061f829aabe0664af7ef076909e6ded72 /archival
parentaec8fbfb834dfcf46b7c967d6572c9adcb72b620 (diff)
downloadbusybox-6ba1f2d0bcdddb96c43ff9fec34758a4e2b4a467.zip
busybox-6ba1f2d0bcdddb96c43ff9fec34758a4e2b4a467.tar.gz
tar: prevent malicious archives with enormous long name sizes OOMing the machine
function old new delta get_header_tar 1707 1752 +45 Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat (limited to 'archival')
-rw-r--r--archival/libarchive/get_header_tar.c11
1 files changed, 8 insertions, 3 deletions
diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
index a142290..d26868b 100644
--- a/archival/libarchive/get_header_tar.c
+++ b/archival/libarchive/get_header_tar.c
@@ -147,6 +147,12 @@ static void process_pax_hdr(archive_handle_t *archive_handle, unsigned sz, int g
#endif
}
+static void die_if_bad_fnamesize(off_t sz)
+{
+ if ((uoff_t)sz > 0xfff) /* more than 4k?! no funny business please */
+ bb_simple_error_msg_and_die("bad archive");
+}
+
char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
{
file_header_t *file_header = archive_handle->file_header;
@@ -331,7 +337,6 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
file_header->name = xstrdup(tar.name);
}
- /* Set bits 12-15 of the files mode */
switch (tar_typeflag) {
case '1': /* hardlink */
/* we mark hardlinks as regular files with zero size and a link name */
@@ -389,7 +394,7 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
/* free: paranoia: tar with several consecutive longnames */
free(p_longname);
/* For paranoia reasons we allocate extra NUL char */
-//FIXME: disallow huge sizes:
+ die_if_bad_fnamesize(file_header->size);
p_longname = xzalloc(file_header->size + 1);
/* We read ASCIZ string, including NUL */
xread(archive_handle->src_fd, p_longname, file_header->size);
@@ -400,7 +405,7 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
goto again;
case 'K':
free(p_linkname);
-//FIXME: disallow huge sizes:
+ die_if_bad_fnamesize(file_header->size);
p_linkname = xzalloc(file_header->size + 1);
xread(archive_handle->src_fd, p_linkname, file_header->size);
archive_handle->offset += file_header->size;