busybox-w32/archival/libarchive, branch masterA mirror of https://github.com/rmyorston/busybox-w32.git
https://git.lua4.win/busybox-w32/atom?h=master2026-03-11T10:14:49+00:00Merge branch 'busybox' into merge2026-03-11T10:14:49+00:00Ron Yorstonrmy@pobox.com2026-03-11T10:14:49+00:00urn:sha1:ede205bd07573813337b5706acb0cae3b127a36ftar: only strip unsafe components from hardlinks, not symlinks2026-02-28T04:59:18+00:00Radoslav Kolevradoslav.kolev@suse.com2026-02-16T09:50:04+00:00urn:sha1:599f5dd8fac390c18b79cba4c14c334957605dae
commit 3fb6b31c7 introduced a check for unsafe components in
tar archive hardlinks, but it was being applied to symlinks too
which broke "Symlinks and hardlinks coexist" tar test.
Signed-off-by: Radoslav Kolev <radoslav.kolev@suse.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Merge branch 'busybox' into merge2026-02-12T12:58:38+00:00Ron Yorstonrmy@pobox.com2026-02-12T12:50:11+00:00urn:sha1:de7b34e8c779d8baca5abba1394284e0b6e87dc6Merge branch 'busybox' into merge2026-02-10T13:49:25+00:00Ron Yorstonrmy@pobox.com2026-02-10T13:49:25+00:00urn:sha1:0e3015ddb8538f6329c59ed984a9c59bba3f376e*: whitespace cleanup2026-02-08T07:31:13+00:00Denys Vlasenkovda.linux@googlemail.com2026-02-07T20:17:07+00:00urn:sha1:391fdea73b73673410c5e267ec08efd45b3f38ee
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
tar: strip unsafe hardlink components - GNU tar does the same2026-01-29T11:01:56+00:00Denys Vlasenkovda.linux@googlemail.com2026-01-29T10:48:02+00:00urn:sha1:3fb6b31c716669e12f75a2accd31bb7685b1a1cb
Defends against files like these (python reproducer):
import tarfile
ti = tarfile.TarInfo("leak_hosts")
ti.type = tarfile.LNKTYPE
ti.linkname = "/etc/hosts" # or "../etc/hosts" or ".."
ti.size = 0
with tarfile.open("/tmp/hardlink.tar", "w") as t:
t.addfile(ti)
function old new delta
skip_unsafe_prefix - 127 +127
get_header_tar 1752 1754 +2
.rodata 106861 106856 -5
unzip_main 2715 2706 -9
strip_unsafe_prefix 102 18 -84
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 1/3 up/down: 129/-98) Total: 31 bytes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Merge branch 'busybox' into merge2025-10-06T06:53:56+00:00Ron Yorstonrmy@pobox.com2025-10-06T06:53:56+00:00urn:sha1:3b6192619de7b98db5155dbcfe4038355d97cdacarchival/libarchive: sanitize filenames on output (prevent control sequence attacks2025-09-24T01:30:12+00:00Denys Vlasenkovda.linux@googlemail.com2025-09-24T01:28:47+00:00urn:sha1:f5e1bf966b19ea1821f00a8c9ecd7774598689b4
This fixes CVE-2025-46394 (terminal escape sequence injection)
Original credit: Ian.Norton at entrust.com
function old new delta
header_list 9 15 +6
header_verbose_list 239 244 +5
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/0 up/down: 11/0) Total: 11 bytes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Merge branch 'busybox' into merge2025-05-19T07:34:32+00:00Ron Yorstonrmy@pobox.com2025-05-19T07:34:32+00:00urn:sha1:64bf69893bd99c305d13a956389f216e7d15c682libbb/archival: make setup_unzip_on_fd() return bytes read if not compressed2025-04-20T21:49:33+00:00Denys Vlasenkovda.linux@googlemail.com2025-04-20T21:43:19+00:00urn:sha1:c61fdadf974205104f6690ad360117bdf86f0ba6
setup_unzip_on_fd() does not return the transformer structure, so the user
does not know how much to seek back (or alternatively what the signature was)
when compressor signature is not detected.
Currently not needed (the only user is tar which dies anyway).
However, rpm2cpio may need this if we extend it to extract the internal .cpio
even if cpio's compressions algo is not known.
function old new delta
setup_unzip_on_fd 53 59 +6
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>