mirror of
https://git.savannah.gnu.org/git/tar.git
synced 2026-07-19 22:42:25 +00:00
Paul Eggert
67981bbb15
Problem reported by Antonio Teixeira. * src/list.c (read_header): When POSIX says a size field must be zero or does not represent a data count, treat it as zero. * tests/extrac32.at: Update to match new behavior. We now treat hard link sizes as zero even when the size fields are nonzero, and this means the “injected” file is treated as valid regardless of whether we list or extract. * tests/extrac34.at: New test. * tests/Makefile.am (TESTSUITE_AT), tests/testsuite.at: Add it.
49 lines
1.6 KiB
Plaintext
49 lines
1.6 KiB
Plaintext
# Check for file injection bug with symlinks. -*- Autotest -*-
|
|
|
|
# Copyright 2026 Free Software Foundation, Inc.
|
|
|
|
# This file is part of GNU tar.
|
|
|
|
# GNU tar is free software; you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
|
|
# GNU tar is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
# Thanks to Guillermo de Angel for the bug report and test cases; see:
|
|
# https://lists.gnu.org/r/bug-tar/2026-03/msg00007.html
|
|
|
|
AT_SETUP([skip file injection])
|
|
AT_KEYWORDS([injection])
|
|
AT_DATA([archive.in],
|
|
[/Td6WFoAAATm1rRGBMDbAYAcIQEcAAAAAAAAACYr+9LgDf8A010AMZhKvfVdtHe4Rxjj7M03ek97
|
|
UgeKfJ0ORqYg0XDFntWxdTH4PYrTOo9CoqBrnTM2NcwFBrRVr7aFwdd56vddyAw2QGDjxgNexDU3
|
|
ImTi/+z8ZOLMi/+AybdEpd5aA/M9Maa+8tQ84bySzSAwrmxMWJJ6W9IKvsqfiRa3TrD51v44PZU/
|
|
KLVKpocS56n/O3g+b+hiZwaysR0eLO+tiU8FB/e3PEq3vTtDFVi/YfZMieBWSzomSX9eF13K1yPY
|
|
UuWgp7VokXqduL0YGNVV40MTPG9oAAAApD6mpajengIAAfcBgBwAAOM4xw6xxGf7AgAAAAAEWVo=
|
|
])
|
|
AT_CHECK([base64 --help >/dev/null 2>&1 || AT_SKIP_TEST
|
|
xz --help >/dev/null 2>&1 || AT_SKIP_TEST
|
|
base64 -d < archive.in | xz -c -d > archive.tar
|
|
])
|
|
AT_CHECK([tar tf archive.tar],
|
|
[0],
|
|
[carrier_entry
|
|
injected.txt
|
|
marker.txt
|
|
])
|
|
AT_CHECK([tar xvf archive.tar],
|
|
[0],
|
|
[carrier_entry
|
|
injected.txt
|
|
marker.txt
|
|
])
|
|
AT_CLEANUP
|