diff --git a/srcpkgs/libtar/patches/CVE-2013-4420.patch b/srcpkgs/libtar/patches/CVE-2013-4420.patch index 249d8415d07..ff3544bbf79 100644 --- a/srcpkgs/libtar/patches/CVE-2013-4420.patch +++ b/srcpkgs/libtar/patches/CVE-2013-4420.patch @@ -44,52 +44,52 @@ Forwarded: yes char * th_get_pathname(TAR *t) { - if (t->th_buf.gnu_longname) -- return t->th_buf.gnu_longname; + if (t->th_buf.gnu_longname) +- return t->th_buf.gnu_longname; + return safer_name_suffix(t->th_buf.gnu_longname); - /* allocate the th_pathname buffer if not already */ - if (t->th_pathname == NULL) -@@ -51,7 +80,7 @@ th_get_pathname(TAR *t) - } + /* allocate the th_pathname buffer if not already */ + if (t->th_pathname == NULL) +@@ -50,7 +79,7 @@ th_get_pathname(TAR *t) + } - /* will be deallocated in tar_close() */ -- return t->th_pathname; + /* will be deallocated in tar_close() */ +- return t->th_pathname; + return safer_name_suffix(t->th_pathname); } --- a/lib/extract.c +++ b/lib/extract.c -@@ -298,14 +298,14 @@ tar_extract_hardlink(TAR * t, char *real - if (mkdirhier(dirname(filename)) == -1) - return -1; - libtar_hashptr_reset(&hp); -- if (libtar_hash_getkey(t->h, &hp, th_get_linkname(t), +@@ -302,14 +302,14 @@ tar_extract_hardlink(TAR * t, char *real + if (mkdirhier(dirname(filename)) == -1) + return -1; + libtar_hashptr_reset(&hp); +- if (libtar_hash_getkey(t->h, &hp, th_get_linkname(t), + if (libtar_hash_getkey(t->h, &hp, safer_name_suffix(th_get_linkname(t)), - (libtar_matchfunc_t)libtar_str_match) != 0) - { - lnp = (char *)libtar_hashptr_data(&hp); - linktgt = &lnp[strlen(lnp) + 1]; - } - else -- linktgt = th_get_linkname(t); + (libtar_matchfunc_t)libtar_str_match) != 0) + { + lnp = (char *)libtar_hashptr_data(&hp); + linktgt = &lnp[strlen(lnp) + 1]; + } + else +- linktgt = th_get_linkname(t); + linktgt = safer_name_suffix(th_get_linkname(t)); #ifdef DEBUG - printf(" ==> extracting: %s (link to %s)\n", filename, linktgt); -@@ -343,9 +343,9 @@ tar_extract_symlink(TAR *t, char *realna + printf(" ==> extracting: %s (link to %s)\n", filename, linktgt); +@@ -347,9 +347,9 @@ tar_extract_symlink(TAR *t, char *realna #ifdef DEBUG - printf(" ==> extracting: %s (symlink to %s)\n", -- filename, th_get_linkname(t)); + printf(" ==> extracting: %s (symlink to %s)\n", +- filename, th_get_linkname(t)); + filename, safer_name_suffix(th_get_linkname(t))); #endif -- if (symlink(th_get_linkname(t), filename) == -1) +- if (symlink(th_get_linkname(t), filename) == -1) + if (symlink(safer_name_suffix(th_get_linkname(t)), filename) == -1) - { + { #ifdef DEBUG - perror("symlink()"); + perror("symlink()"); --- a/lib/internal.h +++ b/lib/internal.h @@ -21,3 +21,4 @@ @@ -99,15 +99,15 @@ Forwarded: yes +char* safer_name_suffix(char const*); --- a/lib/output.c +++ b/lib/output.c -@@ -123,9 +123,9 @@ th_print_long_ls(TAR *t) - else - printf(" link to "); - if ((t->options & TAR_GNU) && t->th_buf.gnu_longlink != NULL) -- printf("%s", t->th_buf.gnu_longlink); +@@ -124,9 +124,9 @@ th_print_long_ls(TAR *t) + else + printf(" link to "); + if ((t->options & TAR_GNU) && t->th_buf.gnu_longlink != NULL) +- printf("%s", t->th_buf.gnu_longlink); + printf("%s", safer_name_suffix(t->th_buf.gnu_longlink)); - else -- printf("%.100s", t->th_buf.linkname); + else +- printf("%.100s", t->th_buf.linkname); + printf("%.100s", safer_name_suffix(t->th_buf.linkname)); - } + } - putchar('\n'); + putchar('\n');