unzip: prevent attacks via malicious filenames

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

3 files changed, 39 insertions, 32 deletions

diff --git a/archival/libarchive/Kbuild.src b/archival/libarchive/Kbuild.src
index 7e89e9e89..b7faaf77f 100644
--- a/archival/libarchive/Kbuild.src
+++ b/archival/libarchive/Kbuild.src
@@ -30,6 +30,7 @@ COMMON_FILES:= \
 DPKG_FILES:= \
         unpack_ar_archive.o \
         filter_accept_list_reassign.o \
+        unsafe_prefix.o \
         get_header_ar.o \
         get_header_tar.o \
         get_header_tar_gz.o \
@@ -44,7 +45,7 @@ lib-$(CONFIG_DPKG_DEB)                  += $(DPKG_FILES)
 
 lib-$(CONFIG_AR)                        += get_header_ar.o unpack_ar_archive.o
 lib-$(CONFIG_CPIO)                      += get_header_cpio.o
-lib-$(CONFIG_TAR)                       += get_header_tar.o
+lib-$(CONFIG_TAR)                       += get_header_tar.o unsafe_prefix.o
 lib-$(CONFIG_FEATURE_TAR_TO_COMMAND)    += data_extract_to_command.o
 lib-$(CONFIG_LZOP)                      += lzo1x_1.o lzo1x_1o.o lzo1x_d.o
 lib-$(CONFIG_LZOP_COMPR_HIGH)           += lzo1x_9x.o
@@ -53,7 +54,7 @@ lib-$(CONFIG_UNLZMA)                    += open_transformer.o decompress_unlzma.
 lib-$(CONFIG_UNXZ)                      += open_transformer.o decompress_unxz.o
 lib-$(CONFIG_GUNZIP)                    += open_transformer.o decompress_gunzip.o
 lib-$(CONFIG_UNCOMPRESS)                += open_transformer.o decompress_uncompress.o
-lib-$(CONFIG_UNZIP)                     += open_transformer.o decompress_gunzip.o
+lib-$(CONFIG_UNZIP)                     += open_transformer.o decompress_gunzip.o unsafe_prefix.o
 lib-$(CONFIG_RPM2CPIO)                  += open_transformer.o decompress_gunzip.o get_header_cpio.o
 lib-$(CONFIG_RPM)                       += open_transformer.o decompress_gunzip.o get_header_cpio.o
 
diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
index ba43bb073..0c663fbd7 100644
--- a/archival/libarchive/get_header_tar.c
+++ b/archival/libarchive/get_header_tar.c
@@ -17,36 +17,6 @@
 typedef uint32_t aliased_uint32_t FIX_ALIASING;
 typedef off_t    aliased_off_t    FIX_ALIASING;
 
-
-const char* FAST_FUNC strip_unsafe_prefix(const char *str)
-{
-        const char *cp = str;
-        while (1) {
-                char *cp2;
-                if (*cp == '/') {
-                        cp++;
-                        continue;
-                }
-                if (strncmp(cp, "/../"+1, 3) == 0) {
-                        cp += 3;
-                        continue;
-                }
-                cp2 = strstr(cp, "/../");
-                if (!cp2)
-                        break;
-                cp = cp2 + 4;
-        }
-        if (cp != str) {
-                static smallint warned = 0;
-                if (!warned) {
-                        warned = 1;
-                        bb_error_msg("removing leading '%.*s' from member names",
-                                (int)(cp - str), str);
-                }
-        }
-        return cp;
-}
-
 /* NB: _DESTROYS_ str[len] character! */
 static unsigned long long getOctal(char *str, int len)
 {
diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
new file mode 100644
index 000000000..826c673bf
--- /dev/null
+++ b/archival/libarchive/unsafe_prefix.c
@@ -0,0 +1,36 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+
+#include "libbb.h"
+#include "bb_archive.h"
+
+const char* FAST_FUNC strip_unsafe_prefix(const char *str)
+{
+        const char *cp = str;
+        while (1) {
+                char *cp2;
+                if (*cp == '/') {
+                        cp++;
+                        continue;
+                }
+                if (strncmp(cp, "/../"+1, 3) == 0) {
+                        cp += 3;
+                        continue;
+                }
+                cp2 = strstr(cp, "/../");
+                if (!cp2)
+                        break;
+                cp = cp2 + 4;
+        }
+        if (cp != str) {
+                static smallint warned = 0;
+                if (!warned) {
+                        warned = 1;
+                        bb_error_msg("removing leading '%.*s' from member names",
+                                (int)(cp - str), str);
+                }
+        }
+        return cp;
+}