busybox-w32/archival/libarchive, branch long_paths

Merge branch 'busybox' into merge

2026-02-12T12:58:38+00:00

Merge branch 'busybox' into merge

2026-02-10T13:49:25+00:00

*: whitespace cleanup

2026-02-08T07:31:13+00:00

Signed-off-by: Denys Vlasenko

tar: strip unsafe hardlink components - GNU tar does the same

2026-01-29T11:01:56+00:00

Defends against files like these (python reproducer): import tarfile ti = tarfile.TarInfo("leak_hosts") ti.type = tarfile.LNKTYPE ti.linkname = "/etc/hosts" # or "../etc/hosts" or ".." ti.size = 0 with tarfile.open("/tmp/hardlink.tar", "w") as t: t.addfile(ti) function old new delta skip_unsafe_prefix - 127 +127 get_header_tar 1752 1754 +2 .rodata 106861 106856 -5 unzip_main 2715 2706 -9 strip_unsafe_prefix 102 18 -84 ------------------------------------------------------------------------------ (add/remove: 1/0 grow/shrink: 1/3 up/down: 129/-98) Total: 31 bytes Signed-off-by: Denys Vlasenko

Merge branch 'busybox' into merge

2025-10-06T06:53:56+00:00

archival/libarchive: sanitize filenames on output (prevent control sequence attacks

2025-09-24T01:30:12+00:00

This fixes CVE-2025-46394 (terminal escape sequence injection) Original credit: Ian.Norton at entrust.com function old new delta header_list 9 15 +6 header_verbose_list 239 244 +5 ------------------------------------------------------------------------------ (add/remove: 0/0 grow/shrink: 2/0 up/down: 11/0) Total: 11 bytes Signed-off-by: Denys Vlasenko

Merge branch 'busybox' into merge

2025-05-19T07:34:32+00:00

libbb/archival: make setup_unzip_on_fd() return bytes read if not compressed

2025-04-20T21:49:33+00:00

setup_unzip_on_fd() does not return the transformer structure, so the user does not know how much to seek back (or alternatively what the signature was) when compressor signature is not detected. Currently not needed (the only user is tar which dies anyway). However, rpm2cpio may need this if we extend it to extract the internal .cpio even if cpio's compressions algo is not known. function old new delta setup_unzip_on_fd 53 59 +6 Signed-off-by: Denys Vlasenko

archival: disallow path traversals (CVE-2023-39810)

2025-04-16T01:03:17+00:00

Create new configure option for archival/libarchive based extractions to disallow path traversals. As this is a paranoid option and might introduce backward incompatibility, default it to no. Fixes: CVE-2023-39810 Based on the patch by Peter Kaestle function old new delta data_extract_all 921 945 +24 strip_unsafe_prefix 101 102 +1 ------------------------------------------------------------------------------ (add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0) Total: 25 bytes Signed-off-by: Denys Vlasenko

tar: try harder to detect old tar files

2024-11-08T13:08:47+00:00

The code to autodetect compressed tar files failed to detect a bunzip2-compressed archive. When tar was invoked with the 'j' option it worked fine. The autodetection code looks for the magic string 'ustar' or a series of five NULs to determine that an archive is uncompressed. The failing archives had more than five NULs in the header and were taken to be uncompressed. Look for a longer run of NULs: 16 is certainly sufficient for the archives in question. Adds 8-16 bytes. (GitHub issue #475)