Blame SOURCES/fastjar-CVE-2010-0831.patch

543165
2010-06-10  Jakub Jelinek  <jakub@redhat.com>
543165
	    Dan Rosenberg  <dan.j.rosenberg@gmail.com>
543165
543165
	* jartool.c (extract_jar): Fix up checks for traversal to parent
543165
	directories, disallow absolute paths, make the code slightly more
543165
	efficient.
543165
543165
--- fastjar-0.97/jartool.c.jj	2009-09-07 00:10:47.000000000 +0200
543165
+++ fastjar-0.97/jartool.c	2010-06-08 20:00:29.000000000 +0200
543165
@@ -1730,7 +1730,17 @@ int extract_jar(int fd, const char **fil
543165
       struct stat sbuf;
543165
       int depth = 0;
543165
 
543165
-      tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
543165
+      if(*filename == '/'){
543165
+	fprintf(stderr, "Absolute path names are not allowed.\n");
543165
+	exit(EXIT_FAILURE);
543165
+      }
543165
+
543165
+      tmp_buff = malloc(strlen((const char *)filename));
543165
+
543165
+      if(tmp_buff == NULL) {
543165
+	fprintf(stderr, "Out of memory.\n");
543165
+	exit(EXIT_FAILURE);
543165
+      }
543165
 
543165
       for(;;){
543165
         const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/');
543165
@@ -1738,25 +1748,28 @@ int extract_jar(int fd, const char **fil
543165
         if(idx == NULL)
543165
           break;
543165
         else if(idx == start){
543165
+	  tmp_buff[idx - filename] = '/';
543165
           start++;
543165
           continue;
543165
         }
543165
-        start = idx + 1;
543165
 
543165
-        strncpy(tmp_buff, (const char *)filename, (idx - filename));
543165
-        tmp_buff[(idx - filename)] = '\0';
543165
+	memcpy(tmp_buff + (start - filename), (const char *)start, (idx - start));
543165
+	tmp_buff[idx - filename] = '\0';
543165
 
543165
 #ifdef DEBUG    
543165
         printf("checking the existance of %s\n", tmp_buff);
543165
 #endif
543165
-	if(strcmp(tmp_buff, "..") == 0){
543165
+	if(idx - start == 2 && memcmp(start, "..", 2) == 0){
543165
 	  --depth;
543165
 	  if (depth < 0){
543165
 	    fprintf(stderr, "Traversal to parent directories during unpacking!\n");
543165
 	    exit(EXIT_FAILURE);
543165
 	  }
543165
-	} else if (strcmp(tmp_buff, ".") != 0)
543165
+	} else if (idx - start != 1 || *start != '.')
543165
 	  ++depth;
543165
+
543165
+        start = idx + 1;
543165
+
543165
         if(stat(tmp_buff, &sbuf) < 0){
543165
           if(errno != ENOENT)
543165
             exit_on_error("stat");
543165
@@ -1765,6 +1778,7 @@ int extract_jar(int fd, const char **fil
543165
 #ifdef DEBUG    
543165
           printf("Directory exists\n");
543165
 #endif
543165
+	  tmp_buff[idx - filename] = '/';
543165
           continue;
543165
         }else {
543165
           fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n",
543165
@@ -1781,10 +1795,11 @@ int extract_jar(int fd, const char **fil
543165
         if(verbose && handle)
543165
           printf("%10s: %s/\n", "created", tmp_buff);
543165
 
543165
+	tmp_buff[idx - filename] = '/';
543165
       }
543165
 
543165
       /* only a directory */
543165
-      if(strlen((const char *)start) == 0)
543165
+      if(*start == '\0')
543165
         dir = TRUE;
543165
 
543165
 #ifdef DEBUG    
543165
@@ -1792,7 +1807,7 @@ int extract_jar(int fd, const char **fil
543165
 #endif
543165
 
543165
       /* If the entry was just a directory, don't write to file, etc */
543165
-      if(strlen((const char *)start) == 0)
543165
+      if(*start == '\0')
543165
         f_fd = -1;
543165
 
543165
       free(tmp_buff);
543165
@@ -1876,7 +1891,8 @@ int extract_jar(int fd, const char **fil
543165
       exit(EXIT_FAILURE);
543165
     }
543165
 
543165
-    close(f_fd);
543165
+    if (f_fd != -1)
543165
+      close(f_fd);
543165
 
543165
     if(verbose && dir == FALSE && handle)
543165
       printf("%10s: %s\n",