From 756b671031e0f6158f82186220ebc087c44cd985 Mon Sep 17 00:00:00 2001 From: Tim Kientzle Date: Sat, 10 Jan 2015 12:24:58 -0800 Subject: [PATCH] Fix a potential crash issue discovered by Alexander Cherepanov: It seems bsdtar automatically handles stacked compression. This is a nice feature but it could be problematic when it's completely unlimited. Most clearly it's illustrated with quines: $ curl -sRO http://www.maximumcompression.com/selfgz.gz $ (ulimit -v 10000000 && bsdtar -tvf selfgz.gz) bsdtar: Error opening archive: Can't allocate data for gzip decompression Without ulimit, bsdtar will eat all available memory. This could also be a problem for other applications using libarchive. --- Makefile.am | 2 ++ libarchive/archive_read.c | 7 ++-- libarchive/test/test_read_too_many_filters.c | 45 ++++++++++++++++++++++++ libarchive/test/test_read_too_many_filters.gz.uu | 15 ++++++++ 4 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 libarchive/test/test_read_too_many_filters.c create mode 100644 libarchive/test/test_read_too_many_filters.gz.uu diff --git a/Makefile.am b/Makefile.am index 9b0632b..5cfef49 100644 --- a/Makefile.am +++ b/Makefile.am @@ -294,6 +294,7 @@ libarchive_test_SOURCES= \ libarchive/test/test_read_large.c \ libarchive/test/test_read_pax_truncated.c \ libarchive/test/test_read_position.c \ + libarchive/test/test_read_too_many_filters.c \ libarchive/test/test_read_truncated.c \ libarchive/test/test_read_uu.c \ libarchive/test/test_tar_filenames.c \ @@ -380,6 +381,7 @@ libarchive_test_EXTRA_DIST=\ libarchive/test/test_read_format_raw.data.uu \ libarchive/test/test_read_format_tar_empty_filename.tar.uu \ libarchive/test/test_read_format_zip.zip.uu \ + libarchive/test/test_read_too_many_filters.gz.uu \ libarchive/test/CMakeLists.txt \ libarchive/test/README diff --git a/libarchive/archive_read.c b/libarchive/archive_read.c index f39f5ce..92d67d9 100644 --- a/libarchive/archive_read.c +++ b/libarchive/archive_read.c @@ -352,13 +352,13 @@ archive_read_open2(struct archive *_a, void *client_data, static int build_stream(struct archive_read *a) { - int number_bidders, i, bid, best_bid; + int number_bidders, i, bid, best_bid, n; struct archive_read_filter_bidder *bidder, *best_bidder; struct archive_read_filter *filter; ssize_t avail; int r; - for (;;) { + for (n = 0; n < 25; ++n) { number_bidders = sizeof(a->bidders) / sizeof(a->bidders[0]); best_bid = 0; @@ -402,6 +402,9 @@ build_stream(struct archive_read *a) return (ARCHIVE_FATAL); } } + archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT, + "Input requires too many filters for decoding"); + return (ARCHIVE_FATAL); } /* diff --git a/libarchive/test/test_read_too_many_filters.c b/libarchive/test/test_read_too_many_filters.c new file mode 100644 index 0000000..37cab24 --- /dev/null +++ b/libarchive/test/test_read_too_many_filters.c @@ -0,0 +1,45 @@ +/*- + * Copyright (c) 2003-2008,2015 Tim Kientzle + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +#include "test.h" + +DEFINE_TEST(test_read_too_many_filters) +{ + const char *name = "test_read_too_many_filters.gz"; + struct archive *a; + int r; + + assert((a = archive_read_new()) != NULL); + r = archive_read_support_compression_gzip(a); + if (r == ARCHIVE_WARN) { + skipping("gzip reading not fully supported on this platform"); + } + assertEqualIntA(a, ARCHIVE_OK, archive_read_support_format_all(a)); + extract_reference_file(name); + assertEqualIntA(a, ARCHIVE_FATAL, + archive_read_open_filename(a, name, 200)); + + assertEqualInt(ARCHIVE_OK, archive_read_close(a)); + assertEqualInt(ARCHIVE_OK, archive_read_finish(a)); +} diff --git a/libarchive/test/test_read_too_many_filters.gz.uu b/libarchive/test/test_read_too_many_filters.gz.uu new file mode 100644 index 0000000..6bf6614 --- /dev/null +++ b/libarchive/test/test_read_too_many_filters.gz.uu @@ -0,0 +1,15 @@ +This is a valid gzip file that decompresses to itself, from + http://www.maximumcompression.com/selfgz.gz + +This is used in test_read_too_many_filters to try to +crash libarchive by forcing it to spawn an unending +list of gunzip filters. + +begin 644 test_read_too_many_filters.gz +M'XL(`````````P`/`/#_'XL(`````````P`/`/#_````__\```#__X)QH5P` +M`!X`X?\```#__P```/__@G&A7```'@#A_P```/__````__\```#__P```/__ +M````__\```#__\(FAF`!`!0`Z_\```#__P```/__PB:&8`$`%`#K_\(FAF`! +M`!0`Z_^9(#6-B"@Q,C,T`K/`+```%`#K_P*SP"P``!0`Z_]"B"'$`````/__ +>`P!#2DTAT@```$*((<0`````__\#`$-*32'2```` +` +end -- 2.7.4