1. photon
  2. Commit 200a1f46448ef432927a47c303325a93d9c6d0a7
Browse code

libtar : Fix CVE-2013-4420

Change-Id: I3d162f5d40efad0983716cc75413229e2758dce0
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4195
Reviewed-by: Sharath George
Tested-by: Sharath George
(cherry picked from commit 8fc2fbbb9e937c28e68107d49e9675e7cba8cfcd)
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/4911
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>

xiaolin-vmware authored on 2017/11/03 06:51:32
Showing 2 changed files
SPECS/libtar/libtar-CVE-2013-4420.patch
History View file @ 200a1f4
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,100 @@
0 
+diff --git a/decode.c b/decode2.c
1 
+index c16ea2d..2e290d1 100644
2 
+--- a/lib/decode.c
3 
+@@ -21,24 +21,54 @@
4 
+ # include <string.h>
5 
+ #endif
6 
+
7 
++char *
8 
++safer_name_suffix (char const *file_name)
9 
++{
10 
++	char const *p, *t;
11 
++	p = t = file_name;
12 
++	while (*p)
13 
++	{
14 
++		if (p[0] == '.' && p[0] == p[1] && p[2] == '/')
15 
++		{
16 
++			p += 3;
17 
++			t = p;
18 
++		}
19 
++		/* advance pointer past the next slash */
20 
++		while (*p && (p++)[0] != '/');
21 
++	}
22 
++
23 
++	if (!*t)
24 
++	{
25 
++		t = ".";
26 
++	}
27 
++
28 
++	if (t != file_name)
29 
++	{
30 
++		/* TODO: warn somehow that the path was modified */
31 
++	}
32 
++	return (char*)t;
33 
++}
34 
+
35 
+ /* determine full path name */
36 
+ char *
37 
+ th_get_pathname(TAR *t)
38 
+ {
39 
+ 	static TLS_THREAD char filename[MAXPATHLEN];
40 
++	char *safer_name;
41 
+
42 
+ 	if (t->th_buf.gnu_longname)
43 
+-		return t->th_buf.gnu_longname;
44 
++		return safer_name_suffix(t->th_buf.gnu_longname);
45 
++
46 
++	safer_name = safer_name_suffix(t->th_buf.name);
47 
+
48 
+ 	if (t->th_buf.prefix[0] != '\0')
49 
+ 	{
50 
+ 		snprintf(filename, sizeof(filename), "%.155s/%.100s",
51 
+-			 t->th_buf.prefix, t->th_buf.name);
52 
++			 t->th_buf.prefix, safer_name);
53 
+ 		return filename;
54 
+ 	}
55 
+
56 
+-	snprintf(filename, sizeof(filename), "%.100s", t->th_buf.name);
57 
++	snprintf(filename, sizeof(filename), "%.100s", safer_name);
58 
+ 	return filename;
59 
+ }
60 
+
61 
+Index: libtar-1.2.16/lib/extract.c
62 
+===================================================================
63 
+--- libtar-1.2.16.orig/lib/extract.c	2013-12-09 14:11:03.212344872 +0100
64 
+@@ -305,7 +305,7 @@ tar_extract_hardlink(TAR * t, char *real
65 
+ 		linktgt = &lnp[strlen(lnp) + 1];
66 
+ 	}
67 
+ 	else
68 
+-		linktgt = th_get_linkname(t);
69 
++		linktgt = safer_name_suffix(th_get_linkname(t));
70 
+
71 
+ #ifdef DEBUG
72 
+ 	printf("  ==> extracting: %s (link to %s)\n", filename, linktgt);
73 
+@@ -343,9 +343,9 @@ tar_extract_symlink(TAR *t, char *realna
74 
+
75 
+ #ifdef DEBUG
76 
+ 	printf("  ==> extracting: %s (symlink to %s)\n",
77 
+-	       filename, th_get_linkname(t));
78 
++	       filename, safer_name_suffix(th_get_linkname(t)));
79 
+ #endif
80 
+-	if (symlink(th_get_linkname(t), filename) == -1)
81 
++	if (symlink(safer_name_suffix(th_get_linkname(t)), filename) == -1)
82 
+ 	{
83 
+ #ifdef DEBUG
84 
+ 		perror("symlink()");
85 
+Index: libtar-1.2.16/lib/internal.h
86 
+===================================================================
87 
+--- libtar-1.2.16.orig/lib/internal.h	2012-05-17 09:34:32.000000000 +0200
88 
+@@ -15,6 +15,7 @@
89 
+
90 
+ #include <libtar.h>
91 
+
92 
++char* safer_name_suffix(char const*);
93 
+ #ifdef TLS
94 
+ #define TLS_THREAD TLS
95 
+ #else
96 
+
SPECS/libtar/libtar.spec
History View file @ 200a1f4
... ... 
@@ -1,7 +1,7 @@
1 1 
 Summary:        C library for manipulating tar files
2 2 
 Name:           libtar
3 3 
 Version:        1.2.20
4 
-Release:        4%{?dist}
4 
+Release:        5%{?dist}
5 5 
 URL:            https://github.com/tklauser/libtar/archive/v1.2.20.tar.gz
6 6 
 License:        MIT
7 7 
 Group:          System Environment/Libraries
... ... 
@@ -10,6 +10,7 @@ Distribution:   Photon
10 10 
 Source0:        libtar-%{version}.tar.gz
11 11 
 %define         sha1 libtar=b3ec4058fa83448d6040ce9f9acf85eeec4530b1
12 12 
 Patch0:         libtar-gen-debuginfo.patch
13 
+patch1:         libtar-CVE-2013-4420.patch
13 14 
 Provides:       libtar.so.0()(64bit)
14 15
15 16 
 %description
... ... 
@@ -27,6 +28,7 @@ developing applications that use libtar.
27 27 
 %prep
28 28 
 %setup
29 29 
 %patch0
30 
+%patch1 -p1
30 31 
 autoreconf -iv
31 32
32 33 
 %build
... ... 
@@ -56,6 +58,8 @@ chmod +x %{buildroot}/%{_libdir}/libtar.so.*
56 56 
 %{_libdir}/libtar.la
57 57
58 58 
 %changelog
59 
+*   Thu Nov 02 2017 Xiaolin Li <xiaolinl@vmware.com> 1.2.20-5
60 
+-   Fix CVE-2013-4420
59 61 
 *   Thu Jun 29 2017 Chang Lee <changlee@vmware.com> 1.2.20-4
60 62 
 -   Removed %check due to no test existence.
61 63 
 *   Tue Apr 25 2017 Priyesh Padmavilasom <ppadmavilasom@vmware.com> 1.2.20-3