Blame SOURCES/libarchive-3.1.2-CVE-2015-8925.patch

995285
From 1e18cbb71515a22b2a6f1eb4aaadea461929b834 Mon Sep 17 00:00:00 2001
995285
From: Tim Kientzle <kientzle@acm.org>
995285
Date: Sat, 21 Feb 2015 10:37:48 -0800
995285
Subject: [PATCH] Issue 408: Fix escaped newline parsing
995285
995285
---
995285
 libarchive/archive_read_support_format_mtree.c  | 56 ++++++++++++-------------
995285
 libarchive/test/test_read_format_mtree.c        |  8 +++-
995285
 libarchive/test/test_read_format_mtree.mtree.uu | 20 +++++----
995285
 3 files changed, 45 insertions(+), 39 deletions(-)
995285
995285
diff --git a/libarchive/archive_read_support_format_mtree.c b/libarchive/archive_read_support_format_mtree.c
995285
index c4e7021..397bfee 100644
995285
--- a/libarchive/archive_read_support_format_mtree.c
995285
+++ b/libarchive/archive_read_support_format_mtree.c
995285
@@ -1661,6 +1661,10 @@ parse_escapes(char *src, struct mtree_entry *mentry)
995285
 				c = '\v';
995285
 				++src;
995285
 				break;
995285
+			case '\\':
995285
+				c = '\\';
995285
+				++src;
995285
+				break;
995285
 			}
995285
 		}
995285
 		*dest++ = c;
995285
@@ -1804,8 +1808,7 @@ readline(struct archive_read *a, struct mtree *mtree, char **start, ssize_t limi
995285
 	ssize_t total_size = 0;
995285
 	ssize_t find_off = 0;
995285
 	const void *t;
995285
-	const char *s;
995285
-	void *p;
995285
+	void *nl;
995285
 	char *u;
995285
 
995285
 	/* Accumulate line in a line buffer. */
995285
@@ -1816,11 +1819,10 @@ readline(struct archive_read *a, struct mtree *mtree, char **start, ssize_t limi
995285
 			return (0);
995285
 		if (bytes_read < 0)
995285
 			return (ARCHIVE_FATAL);
995285
-		s = t;  /* Start of line? */
995285
-		p = memchr(t, '\n', bytes_read);
995285
-		/* If we found '\n', trim the read. */
995285
-		if (p != NULL) {
995285
-			bytes_read = 1 + ((const char *)p) - s;
995285
+		nl = memchr(t, '\n', bytes_read);
995285
+		/* If we found '\n', trim the read to end exactly there. */
995285
+		if (nl != NULL) {
995285
+			bytes_read = ((const char *)nl) - ((const char *)t) + 1;
995285
 		}
995285
 		if (total_size + bytes_read + 1 > limit) {
995285
 			archive_set_error(&a->archive,
995285
@@ -1834,38 +1836,34 @@ readline(struct archive_read *a, struct mtree *mtree, char **start, ssize_t limi
995285
 			    "Can't allocate working buffer");
995285
 			return (ARCHIVE_FATAL);
995285
 		}
995285
+		/* Append new bytes to string. */
995285
 		memcpy(mtree->line.s + total_size, t, bytes_read);
995285
 		__archive_read_consume(a, bytes_read);
995285
 		total_size += bytes_read;
995285
-		/* Null terminate. */
995285
 		mtree->line.s[total_size] = '\0';
995285
-		/* If we found an unescaped '\n', clean up and return. */
995285
+
995285
 		for (u = mtree->line.s + find_off; *u; ++u) {
995285
 			if (u[0] == '\n') {
995285
+				/* Ends with unescaped newline. */
995285
 				*start = mtree->line.s;
995285
 				return total_size;
995285
-			}
995285
-			if (u[0] == '#') {
995285
-				if (p == NULL)
995285
+			} else if (u[0] == '#') {
995285
+				/* Ends with comment sequence #...\n */
995285
+				if (nl == NULL) {
995285
+					/* But we've not found the \n yet */
995285
 					break;
995285
-				*start = mtree->line.s;
995285
-				return total_size;
995285
-			}
995285
-			if (u[0] != '\\')
995285
-				continue;
995285
-			if (u[1] == '\\') {
995285
-				++u;
995285
-				continue;
995285
-			}
995285
-			if (u[1] == '\n') {
995285
-				memmove(u, u + 1,
995285
-				    total_size - (u - mtree->line.s) + 1);
995285
-				--total_size;
995285
-				++u;
995285
-				break;
995285
+				}
995285
+			} else if (u[0] == '\\') {
995285
+				if (u[1] == '\n') {
995285
+					/* Trim escaped newline. */
995285
+					total_size -= 2;
995285
+					mtree->line.s[total_size] = '\0';
995285
+					break;
995285
+				} else if (u[1] != '\0') {
995285
+					/* Skip the two-char escape sequence */
995285
+					++u;
995285
+				}
995285
 			}
995285
-			if (u[1] == '\0')
995285
-				break;
995285
 		}
995285
 		find_off = u - mtree->line.s;
995285
 	}
995285
diff --git a/libarchive/test/test_read_format_mtree.c b/libarchive/test/test_read_format_mtree.c
995285
index efedc41..85a0e2e 100644
995285
--- a/libarchive/test/test_read_format_mtree.c
995285
+++ b/libarchive/test/test_read_format_mtree.c
995285
@@ -110,6 +110,10 @@ test_read_format_mtree1(void)
995285
 	assertEqualString(archive_entry_pathname(ae), "dir2/dir3b/indir3b");
995285
 
995285
 	assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae);;
995285
+	assertEqualString(archive_entry_pathname(ae), "dir2/dir3b/filename\\with_esc\b\t\fapes");
995285
+	assertEqualInt(archive_entry_filetype(ae), AE_IFREG);
995285
+
995285
+	assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae);;
995285
 	assertEqualString(archive_entry_pathname(ae), "notindir");
995285
 
995285
 	assertEqualIntA(a, ARCHIVE_OK, archive_read_next_header(a, &ae);;
995285
@@ -151,7 +155,7 @@ test_read_format_mtree1(void)
995285
 	assertEqualInt(archive_entry_mtime(ae), min_time);
995285
 
995285
 	assertEqualIntA(a, ARCHIVE_EOF, archive_read_next_header(a, &ae);;
995285
-	assertEqualInt(19, archive_file_count(a));
995285
+	assertEqualInt(20, archive_file_count(a));
995285
 	assertEqualInt(ARCHIVE_OK, archive_read_close(a));
995285
 	assertEqualInt(ARCHIVE_OK, archive_read_free(a));
995285
 }
995285
diff --git a/libarchive/test/test_read_format_mtree.mtree.uu b/libarchive/test/test_read_format_mtree.mtree.uu
995285
index a0dff18..f1c9d60 100644
995285
--- a/libarchive/test/test_read_format_mtree.mtree.uu
995285
+++ b/libarchive/test/test_read_format_mtree.mtree.uu
995285
@@ -5,14 +5,16 @@ M92!U:60],3@*("XN"F9I;&5<,#0P=VET:%PP-#!S<&%C92!T>7!E/69I;&4*
995285
 M9&ER,B!T>7!E/61I<@H@9&ER,V$@='EP93UD:7(*("!I;F1I
995285
 M9FEL90ID:7(R+V9U;&QI;F1I
995285
 M"B!I;F1I<C(@='EP93UF:6QE"B!D:7(S8B!T>7!E/61I<@H@(&EN9&ER,V(@
995285
-M='EP93UF:6QE"B`@+BX*("XN"FYO=&EN9&ER('1Y<&4]9FEL90ID:7(R+V9U
995285
-M;&QI;F1I
995285
-M:7IE/3!X,`ID:7(R+W-M86QL9FEL92!T>7!E/69I;&4@
995285
-M,#`P,#`P,#`P,#`P,#`P,#`P,#`P,#$*9&ER,B]T;V]S;6%L;&9;;&4@='EP
995285
-M93UF:6QE('-I>F4]+3$*9&ER,B]B:6=F:6QE('1Y<&4]9FEL92!S:7IE/3DR
995285
-M,C,S-S(P,S8X-30W-S4X,#<*9&ER,B]T;V]B:6=F:6QE('1Y<&4]9FEL92!S
995285
-M:7IE/3DR,C,S-S(P,S8X-30W-S4X,#@*9&ER,B]V97)Y;VQD9FEL92!T>7!E
995285
-M/69I;&4@=&EM93TM.3(R,S,W,C`S-C@U-#
995285
-H;&4@='EP93UF:6QE('1I;64]+3DR,C,S-S(P,S8X-30W-S4X,#D*"@``
995285
+M='EP93UF:6QE"B`@9FEL96YA;65<7'=I=&A<"E]E
995285
+M<&4]9FEL92!M;V1E/3`T-#0@
995285
+M<&4]9FEL90ID:7(R+V9U;&QI;F1I
995285
+M:6QE('1Y<&4]9FEL92!S:7IE/3!X,`ID:7(R+W-M86QL9FEL92!T>7!E/69I
995285
+M;&4@
995285
+M;V]S;6%L;&9;;&4@='EP93UF:6QE('-I>F4]+3$*9&ER,B]B:6=F:6QE('1Y
995285
+M<&4]9FEL92!S:7IE/3DR,C,S-S(P,S8X-30W-S4X,#<*9&ER,B]T;V]B:6=F
995285
+M:6QE('1Y<&4]9FEL92!S:7IE/3DR,C,S-S(P,S8X-30W-S4X,#@*9&ER,B]V
995285
+M97)Y;VQD9FEL92!T>7!E/69I;&4@=&EM93TM.3(R,S,W,C`S-C@U-#
995285
+M.`ID:7(R+W1O;V]L9&9;;&4@='EP93UF:6QE('1I;64]+3DR,C,S-S(P,S8X
995285
+*-30W-S4X,#D*"@``
995285
 `
995285
 end
995285
-- 
995285
2.7.4
995285