mirrors/cmake
2
0 Fork 0
mirror of https://gitlab.kitware.com/cmake/cmake.git synced 2026-10-07 04:02:23 +03:00
Code Activity

libarchive: Backport "Validate pathname in record_hardlink"

Browse Source 
Backport libarchive commit `16ad931073` (cpio reader: Validate pathname
in record_hardlink, 2026-05-08).

Add a fuzzing test case to expose this to dynamic analysis tools.
This commit is contained in:
Tyler Yankee committed 2026-05-09 19:38:34 -04:00
1 parent 7e1b633a89
commit 935c8525f6
2 files changed
+12 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

Tests/Fuzzing/corpus/archive/no-pathname.tar
BIN
View File
Binary file not shown.
Utilities/cmlibarchive/libarchive/archive_read_support_format_cpio.c
+12 -1
View File
@@ -1102,6 +1102,16 @@ record_hardlink(struct archive_read *a,
ENOMEM, "Out of memory adding file to list");
return (ARCHIVE_FATAL);
}
const char *pathname = archive_entry_pathname(entry);
if (pathname == NULL) {
archive_set_error(&a->archive,
ARCHIVE_ERRNO_FILE_FORMAT,
"Invalid hardlink entry with no pathname");
free(le);
return (ARCHIVE_FATAL);
}
if (cpio->links_head != NULL)
cpio->links_head->previous = le;
le->next = cpio->links_head;
@@ -1110,10 +1120,11 @@ record_hardlink(struct archive_read *a,
le->dev = dev;
le->ino = ino;
le->links = archive_entry_nlink(entry) - 1;
le->name = strdup(archive_entry_pathname(entry));
le->name = strdup(pathname);
if (le->name == NULL) {
archive_set_error(&a->archive,
ENOMEM, "Out of memory adding file to list");
free(le);
return (ARCHIVE_FATAL);
}