pax: fix 1-byte OOB read in sparse name building

The GNU sparse name builder trims trailing slash and /. components before
building the synthetic ustar entry name. If the sparse pathname is fully
pruned, the effective source length becomes zero and build_ustar_entry_name()
reads one byte before the pathname buffer.

Handle the all-pruned pathname case before calling the ustar name builder.
The synthetic name then preserves the root-directory case.

diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
index cda1ffd904e464cf707009c8f5f23b1da3297bb2..6b33a051d6d297218ea4edfb9264ce494299aca8 100644 (file)
--- a/libarchive/archive_write_set_format_pax.c
+++ b/libarchive/archive_write_set_format_pax.c
@@ -1794,7 +1794,12 @@ build_gnu_sparse_name(char *dest, const char *src)
        }
 
        /* General case: build a ustar-compatible name adding
-        * "/GNUSparseFile/". */
+        * "/GNUSparseFile.0/". */
+
+       if (p == src) {
+               strcpy(dest, "/GNUSparseFile.0/rootdir");
+               return (dest);
+       }
        build_ustar_entry_name(dest, src, p - src, "GNUSparseFile.0");
 
        return (dest);