libelf: Fix dir traversal vuln in ar extraction.

read_long_names terminates names at the first '/' found but then skips
one character without checking (it's supposed to be '\n'). Hence the
next name could start with any character including '/'. This leads to
a directory traversal vulnerability at the time the contents of the
archive is extracted.

The danger is mitigated by the fact that only one '/' is possible in a
resulting filename and only in the leading position. Hence only files
in the root directory can be written via this vuln and only when ar is
executed as root.

The fix for the vuln is to not skip any characters while looking
for '/'.

Signed-off-by: Alexander Cherepanov <cherepan@mccme.ru>

diff --git a/libelf/ChangeLog b/libelf/ChangeLog
index 3b88d03115ff65a65e11211389249b07cebd40b4..447c35465c132e5232ef7d3a1f7806def4716d3b 100644 (file)
--- a/libelf/ChangeLog
+++ b/libelf/ChangeLog
@@ -1,3 +1,8 @@
+2014-12-28  Alexander Cherepanov  <cherepan@mccme.ru>
+
+       * elf_begin.c (read_long_names): Don't miss '/' right after
+       another '/'. Fixes a dir traversal vuln in ar extraction.
+
 2014-12-18  Ulrich Drepper  <drepper@gmail.com>
 
        * Makefile.am: Suppress output of textrel_check command.

diff --git a/libelf/elf_begin.c b/libelf/elf_begin.c
index 30abe0bface4fe901f60982798897fe467fb5c6d..cd3756ccb2c9c7464f69afb7fd0ecf079c00ed86 100644 (file)
--- a/libelf/elf_begin.c
+++ b/libelf/elf_begin.c
@@ -749,10 +749,7 @@ read_long_names (Elf *elf)
            }
 
          /* NUL-terminate the string.  */
-         *runp = '\0';
-
-         /* Skip the NUL byte and the \012.  */
-         runp += 2;
+         *runp++ = '\0';
 
          /* A sanity check.  Somebody might have generated invalid
             archive.  */