From ef80776d27dbc3914b43e6437c19dc2db4fbfbdc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=98rjan=20Malde?= <red@foxi.me>
Date: Tue, 21 Feb 2023 22:22:21 +0100
Subject: patches/tar/CVE-2022-48303.patch: new patch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Signed-off-by: Ørjan Malde <red@foxi.me>
---
patches/tar/CVE-2022-48303.patch | 30 ++++++++++++++++++++++++++++++
1 file changed, 30 insertions(+)
create mode 100644 patches/tar/CVE-2022-48303.patch
(limited to 'patches/tar')
diff --git a/patches/tar/CVE-2022-48303.patch b/patches/tar/CVE-2022-48303.patch
new file mode 100644
index 00000000..6dd068b9
--- /dev/null
+++ b/patches/tar/CVE-2022-48303.patch
@@ -0,0 +1,30 @@
+From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 11 Feb 2023 11:57:39 +0200
+Subject: Fix boundary checking in base-256 decoder
+
+* src/list.c (from_header): Base-256 encoding is at least 2 bytes
+long.
+---
+ src/list.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc42..86bcfdd 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
+ where++;
+ }
+ }
+- else if (*where == '\200' /* positive base-256 */
+- || *where == '\377' /* negative base-256 */)
++ else if (where <= lim - 2
++ && (*where == '\200' /* positive base-256 */
++ || *where == '\377' /* negative base-256 */))
+ {
+ /* Parse base-256 output. A nonnegative number N is
+ represented as (256**DIGS)/2 + N; a negative number -N is
+--
+cgit v1.1
+
--
cgit v1.2.3