tar/trunk/01-fix-cve-2022-48303.patch

   1 From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Matej=20Mu=C5=BEila?= <mmuzila@gmail.com>
   3 Date: Wed, 11 Jan 2023 08:55:58 +0100
   4 Subject: [PATCH] Fix savannah bug #62387
   5
   6 * src/list.c (from_header): Check for the end of field after leading byte
   7   (0x80 or 0xff) of base-256 encoded header value
   8 ---
   9  src/list.c | 6 ++++++
  10  1 file changed, 6 insertions(+)
  11
  12 diff --git a/src/list.c b/src/list.c
  13 index 9fafc425..bf41b581 100644
  14 --- a/src/list.c
  15 +++ b/src/list.c
  16 @@ -895,6 +895,12 @@ from_header (char const *where0, size_t digs, char const *type,
  17                            << (CHAR_BIT * sizeof (uintmax_t)
  18                                - LG_256 - (LG_256 - 2)));
  19        value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit;
  20 +      if (where == lim)
  21 +        {
  22 +          if (type && !silent)
  23 +            ERROR ((0, 0, _("Archive base-256 value is invalid")));
  24 +          return -1;
  25 +        }
  26        for (;;)
  27         {
  28           value = (value << LG_256) + (unsigned char) *where++;
  29 --
  30 2.38.1
  31