From: datauwu <datauwu@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:10:27 +0000 (+0800)
Subject: pax: fix 1-byte OOB read in sparse name building
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=51287cecd6b53f7e17f620d8a1448b73da9fff30;p=thirdparty%2Flibarchive.git

pax: fix 1-byte OOB read in sparse name building

The GNU sparse name builder trims trailing slash and /. components before
building the synthetic ustar entry name. If the sparse pathname is fully
pruned, the effective source length becomes zero and build_ustar_entry_name()
reads one byte before the pathname buffer.

Handle the all-pruned pathname case before calling the ustar name builder.
The synthetic name then preserves the root-directory case.
---

diff --git a/libarchive/archive_write_set_format_pax.c b/libarchive/archive_write_set_format_pax.c
index cda1ffd90..6b33a051d 100644
--- a/libarchive/archive_write_set_format_pax.c
+++ b/libarchive/archive_write_set_format_pax.c
@@ -1794,7 +1794,12 @@ build_gnu_sparse_name(char *dest, const char *src)
 	}
 
 	/* General case: build a ustar-compatible name adding
-	 * "/GNUSparseFile/". */
+	 * "/GNUSparseFile.0/". */
+
+	if (p == src) {
+		strcpy(dest, "/GNUSparseFile.0/rootdir");
+		return (dest);
+	}
 	build_ustar_entry_name(dest, src, p - src, "GNUSparseFile.0");
 
 	return (dest);