aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDenys Vlasenko <vda.linux@googlemail.com>2015-02-10 01:30:43 +0100
committerDenys Vlasenko <vda.linux@googlemail.com>2015-02-10 01:30:43 +0100
commit8c06bc6ba14949d945eff0abcabab885f1ef7680 (patch)
tree438b36b8264a1b257d4fb3e6293dcda1a4ac9d35
parent23cfaab47de7392c1ba7d601a05fb36da3629b28 (diff)
downloadbusybox-w32-8c06bc6ba14949d945eff0abcabab885f1ef7680.tar.gz
busybox-w32-8c06bc6ba14949d945eff0abcabab885f1ef7680.tar.bz2
busybox-w32-8c06bc6ba14949d945eff0abcabab885f1ef7680.zip
unzip: prevent attacks via malicious filenames
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Diffstat
-rw-r--r--archival/libarchive/Kbuild.src5
-rw-r--r--archival/libarchive/get_header_tar.c30
-rw-r--r--archival/libarchive/unsafe_prefix.c36
-rw-r--r--archival/unzip.c35
4 files changed, 63 insertions, 43 deletions
diff --git a/archival/libarchive/Kbuild.src b/archival/libarchive/Kbuild.src
index 7e89e9e89..b7faaf77f 100644
--- a/archival/libarchive/Kbuild.src
+++ b/archival/libarchive/Kbuild.src
@@ -30,6 +30,7 @@ COMMON_FILES:= \
30DPKG_FILES:= \ 30DPKG_FILES:= \
31 unpack_ar_archive.o \ 31 unpack_ar_archive.o \
32 filter_accept_list_reassign.o \ 32 filter_accept_list_reassign.o \
33 unsafe_prefix.o \
33 get_header_ar.o \ 34 get_header_ar.o \
34 get_header_tar.o \ 35 get_header_tar.o \
35 get_header_tar_gz.o \ 36 get_header_tar_gz.o \
@@ -44,7 +45,7 @@ lib-$(CONFIG_DPKG_DEB) += $(DPKG_FILES)
44 45
45lib-$(CONFIG_AR) += get_header_ar.o unpack_ar_archive.o 46lib-$(CONFIG_AR) += get_header_ar.o unpack_ar_archive.o
46lib-$(CONFIG_CPIO) += get_header_cpio.o 47lib-$(CONFIG_CPIO) += get_header_cpio.o
47lib-$(CONFIG_TAR) += get_header_tar.o 48lib-$(CONFIG_TAR) += get_header_tar.o unsafe_prefix.o
48lib-$(CONFIG_FEATURE_TAR_TO_COMMAND) += data_extract_to_command.o 49lib-$(CONFIG_FEATURE_TAR_TO_COMMAND) += data_extract_to_command.o
49lib-$(CONFIG_LZOP) += lzo1x_1.o lzo1x_1o.o lzo1x_d.o 50lib-$(CONFIG_LZOP) += lzo1x_1.o lzo1x_1o.o lzo1x_d.o
50lib-$(CONFIG_LZOP_COMPR_HIGH) += lzo1x_9x.o 51lib-$(CONFIG_LZOP_COMPR_HIGH) += lzo1x_9x.o
@@ -53,7 +54,7 @@ lib-$(CONFIG_UNLZMA) += open_transformer.o decompress_unlzma.
53lib-$(CONFIG_UNXZ) += open_transformer.o decompress_unxz.o 54lib-$(CONFIG_UNXZ) += open_transformer.o decompress_unxz.o
54lib-$(CONFIG_GUNZIP) += open_transformer.o decompress_gunzip.o 55lib-$(CONFIG_GUNZIP) += open_transformer.o decompress_gunzip.o
55lib-$(CONFIG_UNCOMPRESS) += open_transformer.o decompress_uncompress.o 56lib-$(CONFIG_UNCOMPRESS) += open_transformer.o decompress_uncompress.o
56lib-$(CONFIG_UNZIP) += open_transformer.o decompress_gunzip.o 57lib-$(CONFIG_UNZIP) += open_transformer.o decompress_gunzip.o unsafe_prefix.o
57lib-$(CONFIG_RPM2CPIO) += open_transformer.o decompress_gunzip.o get_header_cpio.o 58lib-$(CONFIG_RPM2CPIO) += open_transformer.o decompress_gunzip.o get_header_cpio.o
58lib-$(CONFIG_RPM) += open_transformer.o decompress_gunzip.o get_header_cpio.o 59lib-$(CONFIG_RPM) += open_transformer.o decompress_gunzip.o get_header_cpio.o
59 60
diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
index ba43bb073..0c663fbd7 100644
--- a/archival/libarchive/get_header_tar.c
+++ b/archival/libarchive/get_header_tar.c
@@ -17,36 +17,6 @@
17typedef uint32_t aliased_uint32_t FIX_ALIASING; 17typedef uint32_t aliased_uint32_t FIX_ALIASING;
18typedef off_t aliased_off_t FIX_ALIASING; 18typedef off_t aliased_off_t FIX_ALIASING;
19 19
20
21const char* FAST_FUNC strip_unsafe_prefix(const char *str)
22{
23 const char *cp = str;
24 while (1) {
25 char *cp2;
26 if (*cp == '/') {
27 cp++;
28 continue;
29 }
30 if (strncmp(cp, "/../"+1, 3) == 0) {
31 cp += 3;
32 continue;
33 }
34 cp2 = strstr(cp, "/../");
35 if (!cp2)
36 break;
37 cp = cp2 + 4;
38 }
39 if (cp != str) {
40 static smallint warned = 0;
41 if (!warned) {
42 warned = 1;
43 bb_error_msg("removing leading '%.*s' from member names",
44 (int)(cp - str), str);
45 }
46 }
47 return cp;
48}
49
50/* NB: _DESTROYS_ str[len] character! */ 20/* NB: _DESTROYS_ str[len] character! */
51static unsigned long long getOctal(char *str, int len) 21static unsigned long long getOctal(char *str, int len)
52{ 22{
diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
new file mode 100644
index 000000000..826c673bf
--- /dev/null
+++ b/archival/libarchive/unsafe_prefix.c
@@ -0,0 +1,36 @@
1/* vi: set sw=4 ts=4: */
2/*
3 * Licensed under GPLv2 or later, see file LICENSE in this source tree.
4 */
5
6#include "libbb.h"
7#include "bb_archive.h"
8
9const char* FAST_FUNC strip_unsafe_prefix(const char *str)
10{
11 const char *cp = str;
12 while (1) {
13 char *cp2;
14 if (*cp == '/') {
15 cp++;
16 continue;
17 }
18 if (strncmp(cp, "/../"+1, 3) == 0) {
19 cp += 3;
20 continue;
21 }
22 cp2 = strstr(cp, "/../");
23 if (!cp2)
24 break;
25 cp = cp2 + 4;
26 }
27 if (cp != str) {
28 static smallint warned = 0;
29 if (!warned) {
30 warned = 1;
31 bb_error_msg("removing leading '%.*s' from member names",
32 (int)(cp - str), str);
33 }
34 }
35 return cp;
36}
diff --git a/archival/unzip.c b/archival/unzip.c
index 38a07e212..eed225677 100644
--- a/archival/unzip.c
+++ b/archival/unzip.c
@@ -596,14 +596,18 @@ int unzip_main(int argc, char **argv)
596 /* Skip extra header bytes */ 596 /* Skip extra header bytes */
597 unzip_skip(zip_header.formatted.extra_len); 597 unzip_skip(zip_header.formatted.extra_len);
598 598
599 /* Guard against "/abspath", "/../" and similar attacks */
600 overlapping_strcpy(dst_fn, strip_unsafe_prefix(dst_fn));
601
599 /* Filter zip entries */ 602 /* Filter zip entries */
600 if (find_list_entry(zreject, dst_fn) 603 if (find_list_entry(zreject, dst_fn)
601 || (zaccept && !find_list_entry(zaccept, dst_fn)) 604 || (zaccept && !find_list_entry(zaccept, dst_fn))
602 ) { /* Skip entry */ 605 ) { /* Skip entry */
603 i = 'n'; 606 i = 'n';
604 607
605 } else { /* Extract entry */ 608 } else {
606 if (listing) { /* List entry */ 609 if (listing) {
610 /* List entry */
607 unsigned dostime = zip_header.formatted.modtime | (zip_header.formatted.moddate << 16); 611 unsigned dostime = zip_header.formatted.modtime | (zip_header.formatted.moddate << 16);
608 if (!verbose) { 612 if (!verbose) {
609 // " Length Date Time Name\n" 613 // " Length Date Time Name\n"
@@ -639,9 +643,11 @@ int unzip_main(int argc, char **argv)
639 total_size += zip_header.formatted.cmpsize; 643 total_size += zip_header.formatted.cmpsize;
640 } 644 }
641 i = 'n'; 645 i = 'n';
642 } else if (dst_fd == STDOUT_FILENO) { /* Extracting to STDOUT */ 646 } else if (dst_fd == STDOUT_FILENO) {
647 /* Extracting to STDOUT */
643 i = -1; 648 i = -1;
644 } else if (last_char_is(dst_fn, '/')) { /* Extract directory */ 649 } else if (last_char_is(dst_fn, '/')) {
650 /* Extract directory */
645 if (stat(dst_fn, &stat_buf) == -1) { 651 if (stat(dst_fn, &stat_buf) == -1) {
646 if (errno != ENOENT) { 652 if (errno != ENOENT) {
647 bb_perror_msg_and_die("can't stat '%s'", dst_fn); 653 bb_perror_msg_and_die("can't stat '%s'", dst_fn);
@@ -655,22 +661,27 @@ int unzip_main(int argc, char **argv)
655 } 661 }
656 } else { 662 } else {
657 if (!S_ISDIR(stat_buf.st_mode)) { 663 if (!S_ISDIR(stat_buf.st_mode)) {
658 bb_error_msg_and_die("'%s' exists but is not directory", dst_fn); 664 bb_error_msg_and_die("'%s' exists but is not a %s",
665 dst_fn, "directory");
659 } 666 }
660 } 667 }
661 i = 'n'; 668 i = 'n';
662 669
663 } else { /* Extract file */ 670 } else {
671 /* Extract file */
664 check_file: 672 check_file:
665 if (stat(dst_fn, &stat_buf) == -1) { /* File does not exist */ 673 if (stat(dst_fn, &stat_buf) == -1) {
674 /* File does not exist */
666 if (errno != ENOENT) { 675 if (errno != ENOENT) {
667 bb_perror_msg_and_die("can't stat '%s'", dst_fn); 676 bb_perror_msg_and_die("can't stat '%s'", dst_fn);
668 } 677 }
669 i = 'y'; 678 i = 'y';
670 } else { /* File already exists */ 679 } else {
680 /* File already exists */
671 if (overwrite == O_NEVER) { 681 if (overwrite == O_NEVER) {
672 i = 'n'; 682 i = 'n';
673 } else if (S_ISREG(stat_buf.st_mode)) { /* File is regular file */ 683 } else if (S_ISREG(stat_buf.st_mode)) {
684 /* File is regular file */
674 if (overwrite == O_ALWAYS) { 685 if (overwrite == O_ALWAYS) {
675 i = 'y'; 686 i = 'y';
676 } else { 687 } else {
@@ -678,8 +689,10 @@ int unzip_main(int argc, char **argv)
678 my_fgets80(key_buf); 689 my_fgets80(key_buf);
679 i = key_buf[0]; 690 i = key_buf[0];
680 } 691 }
681 } else { /* File is not regular file */ 692 } else {
682 bb_error_msg_and_die("'%s' exists but is not regular file", dst_fn); 693 /* File is not regular file */
694 bb_error_msg_and_die("'%s' exists but is not a %s",
695 dst_fn, "regular file");
683 } 696 }
684 } 697 }
685 } 698 }
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-20 03:46:00 +0000