mainGNU tar - Support: sr #109281, Read overflow in...

 
 

sr #109281: Read overflow in strip_compression_suffix

Submitter:  Yury Gribov <yugr>
Submitted:  Thu 23 Mar 2017 09:52:34 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  3 - Normal Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 23 Mar 2017 09:52:34 PM UTC, original submission:  

The following command
  src/tar --one-top-level -xf a.gz
triggers read overflow (actually underflow) in strip_compression_suffix:

==20744==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000edcd at pc 0x7f34a06a048f bp 0x7fffd0d2ae50 sp 0x7fffd0d2a5f8
READ of size 1 at 0x60200000edcd thread T0
    #0 0x7f34a06a048e in __interceptor_strncmp (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x7048e)
    #1 0x459f2d in strip_compression_suffix /home/yugr/src/tar-1.29/src/suffix.c:104
    #2 0x467688 in decode_options /home/yugr/src/tar-1.29/src/tar.c:2540
    #3 0x467fe3 in main /home/yugr/src/tar-1.29/src/tar.c:2703
    #4 0x7f34a028782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x404c08 in _start (/home/yugr/src/tar-1.29/src/tar+0x404c08)

This is caused by optimistic assumption that length of file w/o compression suffix is greater than 4 here:
      if (strncmp (name + len - 4, ".tar", 4) == 0)
        len -= 4;

The issue was found with AddressSanitizer and debian_pkg_test (https://github.com/yugr/debian_pkg_test)

Yury Gribov <yugr>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by yugr (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code