From: Jan Osusky <Jan.Osusky@iblsoft.com>
Date: Mon, 14 Nov 2016 10:24:35 +0000 (+0100)
Subject: Add sanity check of tar "uid, "gid" and "mtime" fields
X-Git-Tag: v3.3.0~114^2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=337c58686562aa09e961cb63ae07e0edff557701;p=thirdparty%2Flibarchive.git

Add sanity check of tar "uid, "gid" and "mtime" fields

Sometimes a bz2 file is identified as tar.bz2, i.e. a chunk of
raw data may look like a tar header (metadata block).
To reduce chance of such false positive, the format of uid, gid
and mtime field is checked. This fields are expected to contain
octal numbers. In fact, also space and '\0' are allowed - perhaps
I am too liberal.
---

diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c
index 469666e8e..0625c1f36 100644
--- a/libarchive/archive_read_support_format_tar.c
+++ b/libarchive/archive_read_support_format_tar.c
@@ -362,7 +362,26 @@ archive_read_format_tar_bid(struct archive_read *a, int best_bid)
 		/* Not a valid mode; bail out here. */
 		return (0);
 	}
-	/* TODO: Sanity test uid/gid/size/mtime/rdevmajor/rdevminor fields. */
+
+	/* Sanity test uid/gid/mtime fields must hold octal numbers. */
+	size_t i;
+	for (i = 0; i < sizeof(header->gid); ++i) {
+		char c = header->gid[i];
+		if (c != ' ' && c != '\0' && (c < '0' || c > '7'))
+			return 0;
+	}
+	for (i = 0; i < sizeof(header->uid); ++i) {
+		char c = header->uid[i];
+		if (c != ' ' && c != '\0' && (c < '0' || c > '7'))
+			return 0;
+	}
+	for (i = 0; i < sizeof(header->mtime); ++i) {
+		char c = header->mtime[i];
+		if (c != ' ' && c != '\0' && (c < '0' || c > '7'))
+			return 0;
+	}
+
+	/* TODO: Sanity test size/rdevmajor/rdevminor fields. */
 
 	return (bid);
 }