Bug 236870 - libarchive directory traversal gives spurious permission errors
Summary: libarchive directory traversal gives spurious permission errors
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 12.0-STABLE
Hardware: Any Any
: --- Affects Many People
Assignee: Martin Matuska
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-03-29 05:56 UTC by Andrew "RhodiumToad" Gierth
Modified: 2019-06-06 09:33 UTC (History)
2 users (show)

See Also:
koobs: mfc-stable12+


Attachments
libarchive directory traversal patch (3.76 KB, patch)
2019-03-29 05:56 UTC, Andrew "RhodiumToad" Gierth
no flags Details | Diff
libarchive directory traversal patch (9.74 KB, patch)
2019-03-29 08:15 UTC, Andrew "RhodiumToad" Gierth
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andrew "RhodiumToad" Gierth 2019-03-29 05:56:58 UTC
Created attachment 203232 [details]
libarchive directory traversal patch

libarchive-based utilities, notably including tar(1), fail if told to traverse "." if the parent directory is not readable. This is caused by libarchive trying to open ".." at the end of the traverse in order to exit the directory, which is an obviously wrong thing to do.

Attached patch (against 12-stable) fixes this and includes a test case.
Comment 1 Andrew "RhodiumToad" Gierth 2019-03-29 06:04:05 UTC
Sorry, this fix isn't quite complete; there are still error cases with archiving "foo/bar/." where "foo" is not readable. Will post another fix shortly.
Comment 2 Andrew "RhodiumToad" Gierth 2019-03-29 08:15:43 UTC
Created attachment 203234 [details]
libarchive directory traversal patch

New patch. This fixes both the original issue and the issue of spurious "Bad file descriptor" errors that occur if the initial directory is not readable.
Comment 3 Andrew "RhodiumToad" Gierth 2019-03-31 19:15:03 UTC
A version of this patch was accepted by upstream libarchive:

https://github.com/libarchive/libarchive/pull/1167
Comment 4 Andrew "RhodiumToad" Gierth 2019-06-05 10:04:34 UTC
Closed as fixed, by the MFC of r347990 (see upstream PR #1167)
Comment 5 Kubilay Kocak freebsd_committer freebsd_triage 2019-06-06 09:33:08 UTC
Assign to committer that resolved