ad0bb50dc7
Fixes CVE-2022-48303: GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of control has not been demonstrated. The issue occurs in from_header in list.c via a V7 archive in which mtime has approximately 11 whitespace characters. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Peter: add _IGNORE_CVES entry] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
34 lines
1.1 KiB
Diff
34 lines
1.1 KiB
Diff
From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
|
|
From: Sergey Poznyakoff <gray@gnu.org>
|
|
Date: Sat, 11 Feb 2023 11:57:39 +0200
|
|
Subject: [PATCH] Fix boundary checking in base-256 decoder
|
|
|
|
* src/list.c (from_header): Base-256 encoding is at least 2 bytes
|
|
long.
|
|
|
|
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
|
|
Upstream: https://git.savannah.gnu.org/cgit/tar.git/commit/?id=3da78400eafcccb97e2f2fd4b227ea40d794ede8
|
|
---
|
|
src/list.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/list.c b/src/list.c
|
|
index 9fafc425..86bcfdd1 100644
|
|
--- a/src/list.c
|
|
+++ b/src/list.c
|
|
@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
|
|
where++;
|
|
}
|
|
}
|
|
- else if (*where == '\200' /* positive base-256 */
|
|
- || *where == '\377' /* negative base-256 */)
|
|
+ else if (where <= lim - 2
|
|
+ && (*where == '\200' /* positive base-256 */
|
|
+ || *where == '\377' /* negative base-256 */))
|
|
{
|
|
/* Parse base-256 output. A nonnegative number N is
|
|
represented as (256**DIGS)/2 + N; a negative number -N is
|
|
--
|
|
2.39.2
|
|
|