From 10ffa00fd92e89edecb155a675383c40a1d3aae1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C4=90o=C3=A0n=20Tr=E1=BA=A7n=20C=C3=B4ng=20Danh?= Date: Tue, 21 Feb 2023 07:49:08 +0700 Subject: [PATCH] tar: fix CVE-2022-48303 --- srcpkgs/tar/patches/cve-2022-48303.patch | 31 ++++++++++++++++++++++++ srcpkgs/tar/template | 2 +- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 srcpkgs/tar/patches/cve-2022-48303.patch diff --git a/srcpkgs/tar/patches/cve-2022-48303.patch b/srcpkgs/tar/patches/cve-2022-48303.patch new file mode 100644 index 00000000000..8ce9af97ac3 --- /dev/null +++ b/srcpkgs/tar/patches/cve-2022-48303.patch @@ -0,0 +1,31 @@ +From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001 +From: Sergey Poznyakoff +Date: Sat, 11 Feb 2023 11:57:39 +0200 +Subject: Fix boundary checking in base-256 decoder + +* src/list.c (from_header): Base-256 encoding is at least 2 bytes +long. +--- + src/list.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + https://savannah.gnu.org/bugs/?62387 + +diff --git a/src/list.c b/src/list.c +index 9fafc42..86bcfdd 100644 +--- a/src/list.c ++++ b/src/list.c +@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type, + where++; + } + } +- else if (*where == '\200' /* positive base-256 */ +- || *where == '\377' /* negative base-256 */) ++ else if (where <= lim - 2 ++ && (*where == '\200' /* positive base-256 */ ++ || *where == '\377' /* negative base-256 */)) + { + /* Parse base-256 output. A nonnegative number N is + represented as (256**DIGS)/2 + N; a negative number -N is +-- +cgit v1.1 + diff --git a/srcpkgs/tar/template b/srcpkgs/tar/template index c18acdba112..0896a89afe2 100644 --- a/srcpkgs/tar/template +++ b/srcpkgs/tar/template @@ -1,7 +1,7 @@ # Template file for 'tar' pkgname=tar version=1.34 -revision=2 +revision=3 build_style=gnu-configure configure_args="gl_cv_struct_dirent_d_ino=yes" makedepends="acl-devel"