mirror of
https://git.busybox.net/busybox
synced 2026-02-22 10:12:18 +00:00
3fb6b31c71
Defends against files like these (python reproducer):
import tarfile
ti = tarfile.TarInfo("leak_hosts")
ti.type = tarfile.LNKTYPE
ti.linkname = "/etc/hosts" # or "../etc/hosts" or ".."
ti.size = 0
with tarfile.open("/tmp/hardlink.tar", "w") as t:
t.addfile(ti)
function old new delta
skip_unsafe_prefix - 127 +127
get_header_tar 1752 1754 +2
.rodata 106861 106856 -5
unzip_main 2715 2706 -9
strip_unsafe_prefix 102 18 -84
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 1/3 up/down: 129/-98) Total: 31 bytes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
|
||
|---|---|---|
| .. | ||
| libarchive | ||
| ar.c | ||
| bbunzip.c | ||
| bbunzip_test.sh | ||
| bbunzip_test2.sh | ||
| bbunzip_test3.sh | ||
| bzip2.c | ||
| chksum_and_xwrite_tar_header.c | ||
| Config.src | ||
| cpio.c | ||
| dpkg.c | ||
| dpkg_deb.c | ||
| gzip.c | ||
| Kbuild.src | ||
| lzop.c | ||
| rpm.c | ||
| rpm.h | ||
| tar.c | ||
| tar_symlink_attack | ||
| unzip.c | ||