tar: fix 1-byte OOB read in SUN.holesdata parsing

header_pax_extension() passes PAX attribute values without the trailing
newline to pax_attribute(). The SUN.holesdata parser read one byte past
the supplied value when the last numeric field ended at the value
boundary.

Handle length == 0 before checking *e.

diff --git a/libarchive/archive_read_support_format_tar.c b/libarchive/archive_read_support_format_tar.c
index e07cfdb63b53cf5440270334a2a488720b3e1348..1c0441db6c41e891d4426126518404540aa7fdb7 100644 (file)
--- a/libarchive/archive_read_support_format_tar.c
+++ b/libarchive/archive_read_support_format_tar.c
@@ -3448,13 +3448,10 @@ pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar,
                                return (ARCHIVE_FATAL);
                        tar->sparse_last->hole = hole;
                }
-               if (length == 0 || *e == '\n') {
-                       if (length == 0 && *e == '\n') {
-                               return (ARCHIVE_OK);
-                       } else {
-                               return (ARCHIVE_WARN);
-                       }
-               }
+               if (length == 0)
+                       return (ARCHIVE_OK);
+               if (*e == '\n')
+                       return (ARCHIVE_WARN);
                p = e + 1;
                length--;
                hole = hole == 0;