libarchive/contribs9/libarchive-2.8.3-CVE-2016-5418.patch

diff --git a/libarchive/archive_write_disk.c b/libarchive/archive_write_disk.c
index f61ae17..2acf847 100644
--- a/libarchive/archive_write_disk.c
+++ b/libarchive/archive_write_disk.c
@@ -218,6 +218,7 @@ struct archive_write_disk {
 #define        MINIMUM_DIR_MODE 0700
 #define        MAXIMUM_DIR_MODE 0775
 
+static int     check_path_for_symlinks(char *path, int *error_number, struct archive_string *error_string, int flags);
 static int     check_symlinks(struct archive_write_disk *);
 static int     create_filesystem_object(struct archive_write_disk *);
 static struct fixup_entry *current_fixup(struct archive_write_disk *, const char *pathname);
@@ -876,7 +877,7 @@ edit_deep_directories(struct archive_write_disk *a)
        a->restore_pwd = -1;
 
        /* If path is short, avoid the open() below. */
-       if (strlen(tail) <= PATH_MAX)
+       if (strlen(tail) < PATH_MAX)
                return;
 
        /* Try to record our starting dir. */
@@ -885,7 +886,7 @@ edit_deep_directories(struct archive_write_disk *a)
                return;
 
        /* As long as the path is too long... */
-       while (strlen(tail) > PATH_MAX) {
+       while (strlen(tail) >= PATH_MAX) {
                /* Locate a dir prefix shorter than PATH_MAX. */
                tail += PATH_MAX - 8;
                while (tail > a->name && *tail != '/')
@@ -1081,6 +1082,10 @@ create_filesystem_object(struct archive_write_disk *a)
        const char *linkname;
        mode_t final_mode, mode;
        int r;
+       /* these for check_path_for_symlinks */
+       char *linkname_copy;    /* non-const copy of linkname */
+       struct archive_string error_string;
+       int error_number;
 
        /* We identify hard/symlinks according to the link names. */
        /* Since link(2) and symlink(2) don't handle modes, we're done here. */
@@ -1089,6 +1094,18 @@ create_filesystem_object(struct archive_write_disk *a)
 #if !HAVE_LINK
                return (EPERM);
 #else
+               archive_string_init(&error_string);
+               linkname_copy = strdup(linkname);
+               if (linkname_copy == NULL) {
+                   return (EPERM);
+               }
+               r = check_path_for_symlinks(linkname_copy, &error_number, &error_string, a->flags);
+               free(linkname_copy);
+               if (r != ARCHIVE_OK) {
+                       archive_set_error(&a->archive, error_number, "%s", error_string.s);
+                       /* EPERM is more appropriate than error_number for our callers */
+                       return (EPERM);
+               }
                r = link(linkname, a->name) ? errno : 0;
                /*
                 * New cpio and pax formats allow hardlink entries
@@ -1421,97 +1438,213 @@ current_fixup(struct archive_write_disk *a, const char *pathname)
  * recent paths.
  */
 /* TODO: Extend this to support symlinks on Windows Vista and later. */
-static int
-check_symlinks(struct archive_write_disk *a)
+
+/*
+ * Checks the given path to see if any elements along it are symlinks.  Returns
+ * ARCHIVE_OK if there are none, otherwise puts an error in errmsg.
+ */
+static int check_path_for_symlinks(char *path, int *error_number, struct archive_string *error_string, int flags)
 {
 #if !defined(HAVE_LSTAT)
        /* Platform doesn't have lstat, so we can't look for symlinks. */
-       (void)a; /* UNUSED */
+       (void)path; /* UNUSED */
+       (void)error_number; /* UNUSED */
+       (void)error_string; /* UNUSED */
+       (void)flags; /* UNUSED */
        return (ARCHIVE_OK);
 #else
-       char *pn, *p;
+       int res = ARCHIVE_OK;
+       char *tail;
+       char *head;
+       int last;
        char c;
        int r;
        struct stat st;
+       int restore_pwd;
+
+       /* Nothing to do here if name is empty */
+       if(path[0] == '\0')
+           return (ARCHIVE_OK);
 
        /*
         * Guard against symlink tricks.  Reject any archive entry whose
         * destination would be altered by a symlink.
+        *
+        * Walk the filename in chunks separated by '/'.  For each segment:
+        *  - if it doesn't exist, continue
+        *  - if it's symlink, abort or remove it
+        *  - if it's a directory and it's not the last chunk, cd into it
+        * As we go:
+        *  head points to the current (relative) path
+        *  tail points to the temporary \0 terminating the segment we're currently examining
+        *  c holds what used to be in *tail
+        *  last is 1 if this is the last tail
         */
-       /* Whatever we checked last time doesn't need to be re-checked. */
-       pn = a->name;
-       p = a->path_safe.s;
-       while ((*pn != '\0') && (*p == *pn))
-               ++p, ++pn;
-       c = pn[0];
-       /* Keep going until we've checked the entire name. */
-       while (pn[0] != '\0' && (pn[0] != '/' || pn[1] != '\0')) {
+       restore_pwd = open(".", O_RDONLY | O_BINARY | O_CLOEXEC);
+       if (restore_pwd < 0)
+               return (ARCHIVE_FATAL);
+       head = path;
+       tail = path;
+       last = 0;
+
+       /* TODO: reintroduce a safe cache here? */
+
+       /* Keep going until we've checked the entire name.
+        * head, tail, path all alias the same string, which is
+        * temporarily zeroed at tail, so be careful restoring the
+        * stashed (c=tail[0]) for error messages.
+        * Exiting the loop with break is okay; continue is not.
+        */
+       while (!last) {
+               /* Skip the separator we just consumed, plus any adjacent ones */
+               while (*tail == '/')
+                   ++tail;
                /* Skip the next path element. */
-               while (*pn != '\0' && *pn != '/')
-                       ++pn;
-               c = pn[0];
-               pn[0] = '\0';
+               while (*tail != '\0' && *tail != '/')
+                       ++tail;
+               /* is this the last path component? */
+               last = (tail[0] == '\0') || (tail[0] == '/' && tail[1] == '\0');
+               /* temporarily truncate the string here */
+               c = tail[0];
+               tail[0] = '\0';
                /* Check that we haven't hit a symlink. */
-               r = lstat(a->name, &st);
+               r = lstat(head, &st);
                if (r != 0) {
+                       tail[0] = c;
                        /* We've hit a dir that doesn't exist; stop now. */
                        if (errno == ENOENT)
                                break;
+                       /* Treat any other error as fatal - best to be paranoid here */
+                       if(error_number) *error_number = errno;
+                       if(error_string)
+                               archive_string_sprintf(error_string,
+                                       "Could not stat %s",
+                                       path);
+                       res = (ARCHIVE_FATAL);
+                       break;
+               } else if (S_ISDIR(st.st_mode)) {
+                       if (!last) {
+                               if (chdir(head) != 0) {
+                                       tail[0] = c;
+                                       if(error_number) *error_number = errno;
+                                       if(error_string)
+                                               archive_string_sprintf(error_string,
+                                                       "Could not chdir %s",
+                                                       path);
+                                       res = (ARCHIVE_FATAL);
+                                       break;
+                               }
+                               /* Our view is now from inside this dir: */
+                               head = tail + 1;
+                       }
                } else if (S_ISLNK(st.st_mode)) {
-                       if (c == '\0') {
+                       if (last) {
                                /*
                                 * Last element is symlink; remove it
                                 * so we can overwrite it with the
                                 * item being extracted.
                                 */
-                               if (unlink(a->name)) {
-                                       archive_set_error(&a->archive, errno,
-                                           "Could not remove symlink %s",
-                                           a->name);
-                                       pn[0] = c;
-                                       return (ARCHIVE_FAILED);
+                               if (unlink(head)) {
+                                       tail[0] = c;
+                                       if(error_number) *error_number = errno;
+                                       if(error_string)
+                                               archive_string_sprintf(error_string,
+                                                       "Could not remove symlink %s",
+                                                       path);
+                                       res = (ARCHIVE_FAILED);
+                                       break;
                                }
-                               a->pst = NULL;
                                /*
                                 * Even if we did remove it, a warning
                                 * is in order.  The warning is silly,
                                 * though, if we're just replacing one
                                 * symlink with another symlink.
                                 */
+                               tail[0] = c;
+                               /* FIXME:  not sure how important this is to restore
                                if (!S_ISLNK(a->mode)) {
-                                       archive_set_error(&a->archive, 0,
-                                           "Removing symlink %s",
-                                           a->name);
+                                       if(error_number) *error_number = 0;
+                                       if(error_string)
+                                               archive_string_sprintf(error_string,
+                                                       "Removing symlink %s",
+                                                       path);
                                }
+                               */
                                /* Symlink gone.  No more problem! */
-                               pn[0] = c;
-                               return (0);
-                       } else if (a->flags & ARCHIVE_EXTRACT_UNLINK) {
+                               res = (ARCHIVE_OK);
+                               break;
+                       } else if (flags & ARCHIVE_EXTRACT_UNLINK) {
                                /* User asked us to remove problems. */
-                               if (unlink(a->name) != 0) {
-                                       archive_set_error(&a->archive, 0,
-                                           "Cannot remove intervening symlink %s",
-                                           a->name);
-                                       pn[0] = c;
-                                       return (ARCHIVE_FAILED);
+                               if (unlink(head) != 0) {
+                                       tail[0] = c;
+                                       if(error_number) *error_number = 0;
+                                       if(error_string)
+                                               archive_string_sprintf(error_string,
+                                                       "Cannot remove intervening symlink %s",
+                                                       path);
+                                       res = (ARCHIVE_FAILED);
+                                       break;
                                }
-                               a->pst = NULL;
                        } else {
-                               archive_set_error(&a->archive, 0,
-                                   "Cannot extract through symlink %s",
-                                   a->name);
-                               pn[0] = c;
-                               return (ARCHIVE_FAILED);
+                               tail[0] = c;
+                               if(error_number) *error_number = 0;
+                               if(error_string)
+                                       archive_string_sprintf(error_string,
+                                               "Cannot extract through symlink %s",
+                                               path);
+                               res = (ARCHIVE_FAILED);
+                               break;
                        }
                }
+               /* be sure to always maintain this */
+               tail[0] = c;
+       }
+       /* Catches loop exits via break */
+       tail[0] = c;
+#ifdef HAVE_FCHDIR
+       /* If we changed directory above, restore it here. */
+       if (restore_pwd >= 0) {
+               r = fchdir(restore_pwd);
+               if (r != 0) {
+                       if(error_number) *error_number = 0;
+                       if(error_string)
+                               archive_string_sprintf(error_string,
+                                       "Cannot extract through symlink %s",
+                                       path);
+               }
+               close(restore_pwd);
+               restore_pwd = -1;
+               if (r != 0) {
+                       res = (ARCHIVE_FATAL);
+               }
        }
-       pn[0] = c;
-       /* We've checked and/or cleaned the whole path, so remember it. */
-       archive_strcpy(&a->path_safe, a->name);
-       return (ARCHIVE_OK);
+#endif
+       /* TODO: reintroduce a safe cache here? */
+       return res;
 #endif
 }
 
+/*
+ * Check a->name for symlinks, returning ARCHIVE_OK if its clean, otherwise
+ * calls archive_set_error and returns ARCHIVE_{FATAL,FAILED}
+ */
+static int
+check_symlinks(struct archive_write_disk *a)
+{
+       struct archive_string error_string;
+       int error_number;
+       int rc;
+       archive_string_init(&error_string);
+       rc = check_path_for_symlinks(a->name, &error_number, &error_string, a->flags);
+       if (rc != ARCHIVE_OK) {
+               archive_set_error(&a->archive, error_number, "%s", error_string.s);
+       }
+       archive_string_free(&error_string);
+       a->pst = NULL;  /* to be safe */
+       return rc;
+}
+
+
 #if defined(_WIN32) || defined(__CYGWIN__)
 /*
  * 1. Convert a path separator from '\' to '/' .
1	diff --git a/libarchive/archive_write_disk.c b/libarchive/archive_write_disk.c
2	index f61ae17..2acf847 100644
3	--- a/libarchive/archive_write_disk.c
4	+++ b/libarchive/archive_write_disk.c
5	@@ -218,6 +218,7 @@ struct archive_write_disk {
6	#define MINIMUM_DIR_MODE 0700
7	#define MAXIMUM_DIR_MODE 0775
8
9	+static int check_path_for_symlinks(char path, int error_number, struct archive_string *error_string, int flags);
10	static int check_symlinks(struct archive_write_disk *);
11	static int create_filesystem_object(struct archive_write_disk *);
12	static struct fixup_entry current_fixup(struct archive_write_disk , const char *pathname);
13	@@ -876,7 +877,7 @@ edit_deep_directories(struct archive_write_disk *a)
14	a->restore_pwd = -1;
15
16	/* If path is short, avoid the open() below. */
17	- if (strlen(tail) <= PATH_MAX)
18	+ if (strlen(tail) < PATH_MAX)
19	return;
20
21	/* Try to record our starting dir. */
22	@@ -885,7 +886,7 @@ edit_deep_directories(struct archive_write_disk *a)
23	return;
24
25	/* As long as the path is too long... */
26	- while (strlen(tail) > PATH_MAX) {
27	+ while (strlen(tail) >= PATH_MAX) {
28	/* Locate a dir prefix shorter than PATH_MAX. */
29	tail += PATH_MAX - 8;
30	while (tail > a->name && *tail != '/')
31	@@ -1081,6 +1082,10 @@ create_filesystem_object(struct archive_write_disk *a)
32	const char *linkname;
33	mode_t final_mode, mode;
34	int r;
35	+ /* these for check_path_for_symlinks */
36	+ char linkname_copy; / non-const copy of linkname */
37	+ struct archive_string error_string;
38	+ int error_number;
39
40	/* We identify hard/symlinks according to the link names. */
41	/* Since link(2) and symlink(2) don't handle modes, we're done here. */
42	@@ -1089,6 +1094,18 @@ create_filesystem_object(struct archive_write_disk *a)
43	#if !HAVE_LINK
44	return (EPERM);
45	#else
46	+ archive_string_init(&error_string);
47	+ linkname_copy = strdup(linkname);
48	+ if (linkname_copy == NULL) {
49	+ return (EPERM);
50	+ }
51	+ r = check_path_for_symlinks(linkname_copy, &error_number, &error_string, a->flags);
52	+ free(linkname_copy);
53	+ if (r != ARCHIVE_OK) {
54	+ archive_set_error(&a->archive, error_number, "%s", error_string.s);
55	+ /* EPERM is more appropriate than error_number for our callers */
56	+ return (EPERM);
57	+ }
58	r = link(linkname, a->name) ? errno : 0;
59	/*
60	* New cpio and pax formats allow hardlink entries
61	@@ -1421,97 +1438,213 @@ current_fixup(struct archive_write_disk a, const char pathname)
62	* recent paths.
63	*/
64	/* TODO: Extend this to support symlinks on Windows Vista and later. */
65	-static int
66	-check_symlinks(struct archive_write_disk *a)
67	+
68	+/*
69	+ * Checks the given path to see if any elements along it are symlinks. Returns
70	+ * ARCHIVE_OK if there are none, otherwise puts an error in errmsg.
71	+ */
72	+static int check_path_for_symlinks(char path, int error_number, struct archive_string *error_string, int flags)
73	{
74	#if !defined(HAVE_LSTAT)
75	/* Platform doesn't have lstat, so we can't look for symlinks. */
76	- (void)a; /* UNUSED */
77	+ (void)path; /* UNUSED */
78	+ (void)error_number; /* UNUSED */
79	+ (void)error_string; /* UNUSED */
80	+ (void)flags; /* UNUSED */
81	return (ARCHIVE_OK);
82	#else
83	- char pn, p;
84	+ int res = ARCHIVE_OK;
85	+ char *tail;
86	+ char *head;
87	+ int last;
88	char c;
89	int r;
90	struct stat st;
91	+ int restore_pwd;
92	+
93	+ /* Nothing to do here if name is empty */
94	+ if(path[0] == '\0')
95	+ return (ARCHIVE_OK);
96
97	/*
98	* Guard against symlink tricks. Reject any archive entry whose
99	* destination would be altered by a symlink.
100	+ *
101	+ * Walk the filename in chunks separated by '/'. For each segment:
102	+ * - if it doesn't exist, continue
103	+ * - if it's symlink, abort or remove it
104	+ * - if it's a directory and it's not the last chunk, cd into it
105	+ * As we go:
106	+ * head points to the current (relative) path
107	+ * tail points to the temporary \0 terminating the segment we're currently examining
108	+ * c holds what used to be in *tail
109	+ * last is 1 if this is the last tail
110	*/
111	- /* Whatever we checked last time doesn't need to be re-checked. */
112	- pn = a->name;
113	- p = a->path_safe.s;
114	- while ((pn != '\0') && (p == *pn))
115	- ++p, ++pn;
116	- c = pn[0];
117	- /* Keep going until we've checked the entire name. */
118	- while (pn[0] != '\0' && (pn[0] != '/' \|\| pn[1] != '\0')) {
119	+ restore_pwd = open(".", O_RDONLY \| O_BINARY \| O_CLOEXEC);
120	+ if (restore_pwd < 0)
121	+ return (ARCHIVE_FATAL);
122	+ head = path;
123	+ tail = path;
124	+ last = 0;
125	+
126	+ /* TODO: reintroduce a safe cache here? */
127	+
128	+ /* Keep going until we've checked the entire name.
129	+ * head, tail, path all alias the same string, which is
130	+ * temporarily zeroed at tail, so be careful restoring the
131	+ * stashed (c=tail[0]) for error messages.
132	+ * Exiting the loop with break is okay; continue is not.
133	+ */
134	+ while (!last) {
135	+ /* Skip the separator we just consumed, plus any adjacent ones */
136	+ while (*tail == '/')
137	+ ++tail;
138	/* Skip the next path element. */
139	- while (pn != '\0' && pn != '/')
140	- ++pn;
141	- c = pn[0];
142	- pn[0] = '\0';
143	+ while (tail != '\0' && tail != '/')
144	+ ++tail;
145	+ /* is this the last path component? */
146	+ last = (tail[0] == '\0') \|\| (tail[0] == '/' && tail[1] == '\0');
147	+ /* temporarily truncate the string here */
148	+ c = tail[0];
149	+ tail[0] = '\0';
150	/* Check that we haven't hit a symlink. */
151	- r = lstat(a->name, &st);
152	+ r = lstat(head, &st);
153	if (r != 0) {
154	+ tail[0] = c;
155	/* We've hit a dir that doesn't exist; stop now. */
156	if (errno == ENOENT)
157	break;
158	+ /* Treat any other error as fatal - best to be paranoid here */
159	+ if(error_number) *error_number = errno;
160	+ if(error_string)
161	+ archive_string_sprintf(error_string,
162	+ "Could not stat %s",
163	+ path);
164	+ res = (ARCHIVE_FATAL);
165	+ break;
166	+ } else if (S_ISDIR(st.st_mode)) {
167	+ if (!last) {
168	+ if (chdir(head) != 0) {
169	+ tail[0] = c;
170	+ if(error_number) *error_number = errno;
171	+ if(error_string)
172	+ archive_string_sprintf(error_string,
173	+ "Could not chdir %s",
174	+ path);
175	+ res = (ARCHIVE_FATAL);
176	+ break;
177	+ }
178	+ /* Our view is now from inside this dir: */
179	+ head = tail + 1;
180	+ }
181	} else if (S_ISLNK(st.st_mode)) {
182	- if (c == '\0') {
183	+ if (last) {
184	/*
185	* Last element is symlink; remove it
186	* so we can overwrite it with the
187	* item being extracted.
188	*/
189	- if (unlink(a->name)) {
190	- archive_set_error(&a->archive, errno,
191	- "Could not remove symlink %s",
192	- a->name);
193	- pn[0] = c;
194	- return (ARCHIVE_FAILED);
195	+ if (unlink(head)) {
196	+ tail[0] = c;
197	+ if(error_number) *error_number = errno;
198	+ if(error_string)
199	+ archive_string_sprintf(error_string,
200	+ "Could not remove symlink %s",
201	+ path);
202	+ res = (ARCHIVE_FAILED);
203	+ break;
204	}
205	- a->pst = NULL;
206	/*
207	* Even if we did remove it, a warning
208	* is in order. The warning is silly,
209	* though, if we're just replacing one
210	* symlink with another symlink.
211	*/
212	+ tail[0] = c;
213	+ /* FIXME: not sure how important this is to restore
214	if (!S_ISLNK(a->mode)) {
215	- archive_set_error(&a->archive, 0,
216	- "Removing symlink %s",
217	- a->name);
218	+ if(error_number) *error_number = 0;
219	+ if(error_string)
220	+ archive_string_sprintf(error_string,
221	+ "Removing symlink %s",
222	+ path);
223	}
224	+ */
225	/* Symlink gone. No more problem! */
226	- pn[0] = c;
227	- return (0);
228	- } else if (a->flags & ARCHIVE_EXTRACT_UNLINK) {
229	+ res = (ARCHIVE_OK);
230	+ break;
231	+ } else if (flags & ARCHIVE_EXTRACT_UNLINK) {
232	/* User asked us to remove problems. */
233	- if (unlink(a->name) != 0) {
234	- archive_set_error(&a->archive, 0,
235	- "Cannot remove intervening symlink %s",
236	- a->name);
237	- pn[0] = c;
238	- return (ARCHIVE_FAILED);
239	+ if (unlink(head) != 0) {
240	+ tail[0] = c;
241	+ if(error_number) *error_number = 0;
242	+ if(error_string)
243	+ archive_string_sprintf(error_string,
244	+ "Cannot remove intervening symlink %s",
245	+ path);
246	+ res = (ARCHIVE_FAILED);
247	+ break;
248	}
249	- a->pst = NULL;
250	} else {
251	- archive_set_error(&a->archive, 0,
252	- "Cannot extract through symlink %s",
253	- a->name);
254	- pn[0] = c;
255	- return (ARCHIVE_FAILED);
256	+ tail[0] = c;
257	+ if(error_number) *error_number = 0;
258	+ if(error_string)
259	+ archive_string_sprintf(error_string,
260	+ "Cannot extract through symlink %s",
261	+ path);
262	+ res = (ARCHIVE_FAILED);
263	+ break;
264	}
265	}
266	+ /* be sure to always maintain this */
267	+ tail[0] = c;
268	+ }
269	+ /* Catches loop exits via break */
270	+ tail[0] = c;
271	+#ifdef HAVE_FCHDIR
272	+ /* If we changed directory above, restore it here. */
273	+ if (restore_pwd >= 0) {
274	+ r = fchdir(restore_pwd);
275	+ if (r != 0) {
276	+ if(error_number) *error_number = 0;
277	+ if(error_string)
278	+ archive_string_sprintf(error_string,
279	+ "Cannot extract through symlink %s",
280	+ path);
281	+ }
282	+ close(restore_pwd);
283	+ restore_pwd = -1;
284	+ if (r != 0) {
285	+ res = (ARCHIVE_FATAL);
286	+ }
287	}
288	- pn[0] = c;
289	- /* We've checked and/or cleaned the whole path, so remember it. */
290	- archive_strcpy(&a->path_safe, a->name);
291	- return (ARCHIVE_OK);
292	+#endif
293	+ /* TODO: reintroduce a safe cache here? */
294	+ return res;
295	#endif
296	}
297
298	+/*
299	+ * Check a->name for symlinks, returning ARCHIVE_OK if its clean, otherwise
300	+ * calls archive_set_error and returns ARCHIVE_{FATAL,FAILED}
301	+ */
302	+static int
303	+check_symlinks(struct archive_write_disk *a)
304	+{
305	+ struct archive_string error_string;
306	+ int error_number;
307	+ int rc;
308	+ archive_string_init(&error_string);
309	+ rc = check_path_for_symlinks(a->name, &error_number, &error_string, a->flags);
310	+ if (rc != ARCHIVE_OK) {
311	+ archive_set_error(&a->archive, error_number, "%s", error_string.s);
312	+ }
313	+ archive_string_free(&error_string);
314	+ a->pst = NULL; /* to be safe */
315	+ return rc;
316	+}
317	+
318	+
319	#if defined(_WIN32) \|\| defined(__CYGWIN__)
320	/*
321	* 1. Convert a path separator from '\' to '/' .