patchGNU tar - Patches: patch #10307, Fix savannah bug #62387

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #10307: Fix savannah bug #62387

Submitter:  Matej Mužila <mmuzila>
Submitted:  Wed 11 Jan 2023 08:58:25 AM UTC
   
 
Category:  None Priority:  5 - Normal
Status:  Duplicate Privacy:  Public
Assigned to:  None Open/Closed:  Closed

Thu 09 Feb 2023 05:53:51 PM UTC, comment #1: 

FYI, this issue has been assigned CVE-2022-48303.

(I'm just a messenger, I did not allocate this CVE.)

Steve Beattie <sbeattie>
Wed 11 Jan 2023 08:58:25 AM UTC, original submission:  
  • src/list.c (from_header): Check for the end of field after leading byte (0x80 or 0xff) of base-256 encoded header value.



If the 12 byte long mtime header field is set to a value consisting of 11 whitespaces (or '\0' and 10 whitespaces)
followed by 0xff or 0x80 byte, heap buffer overflow occurs.

In the base-256 decoding routine, the where pointer gets incremented after reading the leading byte (0x80 or 0xff),
but no check for the end of the field is done before further reading. This may lead to out-of-bounds read and a jump
depending on unitialised value. In this case the existing check does not kick in, because the
where is already > lim.

Patch fixing this problem is attached.

Matej Mužila <mmuzila>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Updated the item)
  • -email is unavailable- added by sbeattie (Posted a comment)
  • -email is unavailable- added by mmuzila (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2023-02-11 gray StatusNone Duplicate
        Open/ClosedOpen Closed
    2023-01-11 mmuzila Attached File- Added Fix-savannah-bug-62387.patch, #54212

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code