shithub: riscv

Info  •  Files  •  Log  •  Branches

tar: fix memory corruption in extract1 (thanks petter)

extract1() expects two extra bytes to be avilabe before
fname buffer so it can prepend ./ before the name. this
used to be the case with name(), but was violated when
long name support was added and getname() was used in
place of name() which did not reserve the 2 extra bytes.

this change reserves two extra bytes in the getname()'s
static buffer and also removes the extra copy as name()
already makes a copy.

--- a/sys/src/cmd/tar.c

+++ b/sys/src/cmd/tar.c

@@ -1138,7 +1138,7 @@

 /*

  * copy a file from the archive into the filesystem.

- * fname is result of name(), so has two extra bytes at beginning.

+ * fname is result of getname(), so has two extra bytes at beginning.

  */

 static void

 extract1(int ar, Hdr *hp, char *fname)

@@ -1214,7 +1214,7 @@

 static char*

 getname(int ar, Hdr *hp)

 {

-	static char namebuf[Maxlongname+1], *nextname = nil;

+	static char buf[2+Maxlongname+1], *namebuf = buf+2, *nextname = nil;

 	ulong blksleft, blksread;

 	char *fname, *p;

 	int n;

@@ -1243,10 +1243,6 @@

 		*p = '\0';

 		fname = nil;

 		nextname = namebuf;

-	} else {

-		namebuf[Maxlongname] = '\0';

-		strncpy(namebuf, fname, Maxlongname);

-		fname = namebuf;

 	}

 	return fname;

 }