libarchive/contribs9/libarchive-2.8.3-CVE-2015-8920.patch

From 97f964e3e0ce3ae34bfb4c366a37ba7c0d9610a6 Mon Sep 17 00:00:00 2001
From: Tim Kientzle <kientzle@acm.org>
Date: Sat, 7 Feb 2015 12:35:33 -0800
Subject: [PATCH] Issue 403: Buffer underflow parsing 'ar' header

While pruning trailing text from ar filenames, we did not
check for an empty filename.  This results in reading the byte
before the filename on the stack.

While here, change a number of ar format issues from WARN to FATAL.
It's better to abort on a damaged file than risk reading garbage.
No doubt, this will require additional tuning in the future.
---
 libarchive/archive_read_support_format_ar.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/libarchive/archive_read_support_format_ar.c b/libarchive/archive_read_support_format_ar.c
index 82756c9..4b5b66b 100644
--- a/libarchive/archive_read_support_format_ar.c
+++ b/libarchive/archive_read_support_format_ar.c
@@ -180,7 +180,7 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
        if (strncmp(h + AR_fmag_offset, "`\n", 2) != 0) {
                archive_set_error(&a->archive, EINVAL,
                    "Incorrect file header signature");
-               return (ARCHIVE_WARN);
+               return (ARCHIVE_FATAL);
        }
 
        /* Copy filename into work buffer. */
@@ -239,8 +239,15 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
         * and are not terminated in '/', so we don't trim anything
         * that starts with '/'.)
         */
-       if (filename[0] != '/' && *p == '/')
+       if (filename[0] != '/' && p > filename && *p == '/') {
                *p = '\0';
+       }
+
+       if (p < filename) {
+               archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
+                   "Found entry with empty filename");
+               return (ARCHIVE_FATAL);
+       }
 
        /*
         * '//' is the GNU filename table.
@@ -262,12 +269,12 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
                if (entry_size == 0) {
                        archive_set_error(&a->archive, EINVAL,
                            "Invalid string table");
-                       return (ARCHIVE_WARN);
+                       return (ARCHIVE_FATAL);
                }
                if (ar->strtab != NULL) {
                        archive_set_error(&a->archive, EINVAL,
                            "More than one string tables exist");
-                       return (ARCHIVE_WARN);
+                       return (ARCHIVE_FATAL);
                }
 
                /* Read the filename table into memory. */
@@ -311,11 +318,11 @@ _ar_read_header(struct archive_read *a, struct archive_entry *entry,
                 */
                if (ar->strtab == NULL || number > ar->strtab_size) {
                        archive_set_error(&a->archive, EINVAL,
-                           "Can't find long filename for entry");
+                           "Can't find long filename for GNU/SVR4 archive entry");
                        archive_entry_copy_pathname(entry, filename);
                        /* Parse the time, owner, mode, size fields. */
                        ar_parse_common_header(ar, entry, h);
-                       return (ARCHIVE_WARN);
+                       return (ARCHIVE_FATAL);
                }
 
                archive_entry_copy_pathname(entry, &ar->strtab[(size_t)number]);
@@ -573,7 +580,7 @@ bad_string_table:
            "Invalid string table");
        free(ar->strtab);
        ar->strtab = NULL;
-       return (ARCHIVE_WARN);
+       return (ARCHIVE_FATAL);
 }
 
 static uint64_t
-- 
2.7.4

1	From 97f964e3e0ce3ae34bfb4c366a37ba7c0d9610a6 Mon Sep 17 00:00:00 2001
2	From: Tim Kientzle <kientzle@acm.org>
3	Date: Sat, 7 Feb 2015 12:35:33 -0800
4	Subject: [PATCH] Issue 403: Buffer underflow parsing 'ar' header
5
6	While pruning trailing text from ar filenames, we did not
7	check for an empty filename. This results in reading the byte
8	before the filename on the stack.
9
10	While here, change a number of ar format issues from WARN to FATAL.
11	It's better to abort on a damaged file than risk reading garbage.
12	No doubt, this will require additional tuning in the future.
13	---
14	libarchive/archive_read_support_format_ar.c \| 21 ++++++++++++++-------
15	1 file changed, 14 insertions(+), 7 deletions(-)
16
17	diff --git a/libarchive/archive_read_support_format_ar.c b/libarchive/archive_read_support_format_ar.c
18	index 82756c9..4b5b66b 100644
19	--- a/libarchive/archive_read_support_format_ar.c
20	+++ b/libarchive/archive_read_support_format_ar.c
21	@@ -180,7 +180,7 @@ _ar_read_header(struct archive_read a, struct archive_entry entry,
22	if (strncmp(h + AR_fmag_offset, "`\n", 2) != 0) {
23	archive_set_error(&a->archive, EINVAL,
24	"Incorrect file header signature");
25	- return (ARCHIVE_WARN);
26	+ return (ARCHIVE_FATAL);
27	}
28
29	/* Copy filename into work buffer. */
30	@@ -239,8 +239,15 @@ _ar_read_header(struct archive_read a, struct archive_entry entry,
31	* and are not terminated in '/', so we don't trim anything
32	* that starts with '/'.)
33	*/
34	- if (filename[0] != '/' && *p == '/')
35	+ if (filename[0] != '/' && p > filename && *p == '/') {
36	*p = '\0';
37	+ }
38	+
39	+ if (p < filename) {
40	+ archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
41	+ "Found entry with empty filename");
42	+ return (ARCHIVE_FATAL);
43	+ }
44
45	/*
46	* '//' is the GNU filename table.
47	@@ -262,12 +269,12 @@ _ar_read_header(struct archive_read a, struct archive_entry entry,
48	if (entry_size == 0) {
49	archive_set_error(&a->archive, EINVAL,
50	"Invalid string table");
51	- return (ARCHIVE_WARN);
52	+ return (ARCHIVE_FATAL);
53	}
54	if (ar->strtab != NULL) {
55	archive_set_error(&a->archive, EINVAL,
56	"More than one string tables exist");
57	- return (ARCHIVE_WARN);
58	+ return (ARCHIVE_FATAL);
59	}
60
61	/* Read the filename table into memory. */
62	@@ -311,11 +318,11 @@ _ar_read_header(struct archive_read a, struct archive_entry entry,
63	*/
64	if (ar->strtab == NULL \|\| number > ar->strtab_size) {
65	archive_set_error(&a->archive, EINVAL,
66	- "Can't find long filename for entry");
67	+ "Can't find long filename for GNU/SVR4 archive entry");
68	archive_entry_copy_pathname(entry, filename);
69	/* Parse the time, owner, mode, size fields. */
70	ar_parse_common_header(ar, entry, h);
71	- return (ARCHIVE_WARN);
72	+ return (ARCHIVE_FATAL);
73	}
74
75	archive_entry_copy_pathname(entry, &ar->strtab[(size_t)number]);
76	@@ -573,7 +580,7 @@ bad_string_table:
77	"Invalid string table");
78	free(ar->strtab);
79	ar->strtab = NULL;
80	- return (ARCHIVE_WARN);
81	+ return (ARCHIVE_FATAL);
82	}
83
84	static uint64_t
85	--
86	2.7.4
87