* [PATCH] erofs-utils: tar: guard slash-only header names
@ 2026-03-30 17:34 Vansh Choudhary
2026-03-31 3:34 ` Gao Xiang
2026-03-31 3:58 ` Yifan Zhao
0 siblings, 2 replies; 3+ messages in thread
From: Vansh Choudhary @ 2026-03-30 17:34 UTC (permalink / raw)
To: linux-erofs; +Cc: Vansh Choudhary
Check that the assembled header path is non-empty before trimming
trailing slashes from it.
A malformed tar header name made up only of '/' characters could
otherwise drive the trim loop to read before the start of the buffer.
Signed-off-by: Vansh Choudhary <ch@vnsh.in>
---
lib/tar.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/tar.c b/lib/tar.c
index 4e97522..39e2321 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -866,7 +866,7 @@ out_eot:
path[1] = '\0';
} else {
*_path = '\0';
- while (path[j - 1] == '/')
+ while (j && path[j - 1] == '/')
path[--j] = '\0';
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] erofs-utils: tar: guard slash-only header names
2026-03-30 17:34 [PATCH] erofs-utils: tar: guard slash-only header names Vansh Choudhary
@ 2026-03-31 3:34 ` Gao Xiang
2026-03-31 3:58 ` Yifan Zhao
1 sibling, 0 replies; 3+ messages in thread
From: Gao Xiang @ 2026-03-31 3:34 UTC (permalink / raw)
To: Vansh Choudhary, linux-erofs
On 2026/3/31 01:34, Vansh Choudhary wrote:
> Check that the assembled header path is non-empty before trimming
> trailing slashes from it.
>
> A malformed tar header name made up only of '/' characters could
> otherwise drive the trim loop to read before the start of the buffer.
>
> Signed-off-by: Vansh Choudhary <ch@vnsh.in>
I don't think it's a valid one.
> ---
> lib/tar.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/tar.c b/lib/tar.c
> index 4e97522..39e2321 100644
> --- a/lib/tar.c
> +++ b/lib/tar.c
> @@ -866,7 +866,7 @@ out_eot:
> path[1] = '\0';
> } else {
> *_path = '\0';
> - while (path[j - 1] == '/')
> + while (j && path[j - 1] == '/')
> path[--j] = '\0';
> }
> }
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] erofs-utils: tar: guard slash-only header names
2026-03-30 17:34 [PATCH] erofs-utils: tar: guard slash-only header names Vansh Choudhary
2026-03-31 3:34 ` Gao Xiang
@ 2026-03-31 3:58 ` Yifan Zhao
1 sibling, 0 replies; 3+ messages in thread
From: Yifan Zhao @ 2026-03-31 3:58 UTC (permalink / raw)
To: linux-erofs, ch
On 3/31/2026 1:34 AM, Vansh Choudhary wrote:
> Check that the assembled header path is non-empty before trimming
> trailing slashes from it.
>
> A malformed tar header name made up only of '/' characters could
> otherwise drive the trim loop to read before the start of the buffer.
>
> Signed-off-by: Vansh Choudhary <ch@vnsh.in>
> ---
> lib/tar.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/tar.c b/lib/tar.c
> index 4e97522..39e2321 100644
> --- a/lib/tar.c
> +++ b/lib/tar.c
> @@ -866,7 +866,7 @@ out_eot:
> path[1] = '\0';
> } else {
I think this else branch has ensured `j != 0`.
> *_path = '\0';
> - while (path[j - 1] == '/')
> + while (j && path[j - 1] == '/')
> path[--j] = '\0';
> }
> }
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-03-31 3:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-30 17:34 [PATCH] erofs-utils: tar: guard slash-only header names Vansh Choudhary
2026-03-31 3:34 ` Gao Xiang
2026-03-31 3:58 ` Yifan Zhao
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox