xfnw/plan9fox
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

tar: fix memory corruption in extract1 (thanks petter)

Browse source 
extract1() expects two extra bytes to be avilabe before
fname buffer so it can prepend ./ before the name. this
used to be the case with name(), but was violated when
long name support was added and getname() was used in
place of name() which did not reserve the 2 extra bytes.

this change reserves two extra bytes in the getname()'s
static buffer and also removes the extra copy as name()
already makes a copy.
This commit is contained in:
cinap_lenrek 2019-11-02 14:17:34 +01:00
parent 638f860791
commit 37827f533b
1 changed files with 2 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
sys/src/cmd/tar.c
View file

@ -1138,7 +1138,7 @@ wrmeta(int fd, Hdr *hp, long mtime, int mode) /* update metadata */
/*
* copy a file from the archive into the filesystem.
* fname is result of name(), so has two extra bytes at beginning.
* fname is result of getname(), so has two extra bytes at beginning.
*/
static void
extract1(int ar, Hdr *hp, char *fname)
@ -1214,7 +1214,7 @@ skip(int ar, Hdr *hp, char *fname)
static char*
getname(int ar, Hdr *hp)
{
static char namebuf[Maxlongname+1], *nextname = nil;
static char buf[2+Maxlongname+1], *namebuf = buf+2, *nextname = nil;
ulong blksleft, blksread;
char *fname, *p;
int n;
@ -1243,10 +1243,6 @@ getname(int ar, Hdr *hp)
*p = '\0';
fname = nil;
nextname = namebuf;
} else {
namebuf[Maxlongname] = '\0';
strncpy(namebuf, fname, Maxlongname);
fname = namebuf;
}
return fname;
}