]> git.ipfire.org Git - thirdparty/xz.git/commit
xz: Fix --files/--files0 usage via XZ_OPT and XZ_DEFAULTS env vars master
authorrootvector2 <dxbnaveed.k@gmail.com>
Thu, 28 May 2026 06:59:23 +0000 (12:29 +0530)
committerLasse Collin <lasse.collin@tukaani.org>
Thu, 28 May 2026 10:22:55 +0000 (13:22 +0300)
commit1aab7e9cab1293c2b8a481ed1beac94da21ef04f
tree648e990244271989321f0fbd99d323f2647d0fb2
parentd0d380797e9f1c25c0a88ce5d4cfd092590a209d
xz: Fix --files/--files0 usage via XZ_OPT and XZ_DEFAULTS env vars

If --files=FILELIST or --files0=FILELIST was specified via an enrivonment
variable, it worked if there were no errors when reading from the file
FILELIST. However, if an error occurred when reading from FILELIST,
there was a use-after-free bug when printing the error message because
the memory containing the string "FILELIST" had been freed.

    printf foo.xz > filelist.txt
    XZ_OPT=--files=filelist.txt xz -l

Because filelist.txt doesn't end in a newline, the file list is seen as
invalid/truncated, resulting in an error message like this:

    xz: ????????.txt: Unexpected end of input when reading filenames

The question marks are because the garbage string is masked using
tuklib_mask_nonprint(). After this commit, it works:

    xz: filelist.txt: Unexpected end of input when reading filenames

Co-authored-by: Lasse Collin <lasse.collin@tukaani.org>
Fixes: https://github.com/tukaani-project/xz/pull/223
src/xz/args.c