6908229d4
Denys Vlasenko
2026-04-30
Subject
cpio: fix a bug (wrong free() address) in !FEATURE_TAR_LONG_OPTIONS config
Binary
No binary (build failed)
Architecture & Compiler Flags
gcc -Wp,-MD,applets/.usage.d -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer -Iinclude -Iinclude -o applets/usage applets/usage.c
Build Log
(log yok)
Commit Diff GitHub →
archival/libarchive/data_extract_all.c+4 -0
| @@ -67,7 +67,11 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle) | |
| #endif | |
| #if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION | |
| /* Skip leading "/" and past last ".." path component */ | |
| + | # if ENABLE_FEATURE_TAR_LONG_OPTIONS |
| dst_name = (char *)skip_unsafe_prefix(dst_name); | |
| + | # else /* dst_name is file_header->name, which is free()d by e.g. cpio - must copy, can't just advance the ptr */ |
| + | strip_unsafe_prefix(dst_name); |
| + | # endif |
| #endif | |
| // ^^^ This may be a problem if some applets do need to extract absolute names. | |
| // (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag). | |
testsuite/cpio.tests+1 -1
| @@ -169,7 +169,7 @@ echo \$? | |
| ls cpio.testdir/dont_write 2>&1" \ | |
| "\ | |
| cpio: removing leading '../' from member names | |
| - | ../dont_write |
| + | dont_write |
| to_extract | |
| 1 blocks | |
| 0 | |