helpGNU tar - Support: sr #109281, Read overflow in...

 
 

sr #109281: Read overflow in strip_compression_suffix

Submitted by:  Yury Gribov <yugr>
Submitted on:  Thu 23 Mar 2017 09:52:34 PM UTC  
 
Category: NonePriority: 5 - Normal
Severity: 3 - NormalStatus: None
Privacy: PublicAssigned to: None
Open/Closed: OpenOperating System: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 23 Mar 2017 09:52:34 PM UTC, original submission:

The following command
src/tar --one-top-level -xf a.gz
triggers read overflow (actually underflow) in strip_compression_suffix:

==20744==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edcd at pc 0x7f34a06a048f bp 0x7fffd0d2ae50 sp 0x7fffd0d2a5f8
READ of size 1 at 0x60200000edcd thread T0
#0 0x7f34a06a048e in __interceptor_strncmp (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x7048e)
#1 0x459f2d in strip_compression_suffix /home/yugr/src/tar-1.29/src/suffix.c:104
#2 0x467688 in decode_options /home/yugr/src/tar-1.29/src/tar.c:2540
#3 0x467fe3 in main /home/yugr/src/tar-1.29/src/tar.c:2703
#4 0x7f34a028782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#5 0x404c08 in _start (/home/yugr/src/tar-1.29/src/tar+0x404c08)

This is caused by optimistic assumption that length of file w/o compression suffix is greater than 4 here:
if (strncmp (name + len - 4, ".tar", 4) == 0)
len -= 4;

The issue was found with AddressSanitizer and debian_pkg_test (https://github.com/yugr/debian_pkg_test)

Yury Gribov <yugr>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by yugr (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup1