8 files changed, 55 insertions, 19 deletions

diff --git a/archival/Config.src b/archival/Config.src
index 6f4f30c43..cbcd7217c 100644
--- a/archival/Config.src
+++ b/archival/Config.src
@@ -35,4 +35,15 @@ config FEATURE_LZMA_FAST
         This option reduces decompression time by about 25% at the cost of
         a 1K bigger binary.
 
+config FEATURE_PATH_TRAVERSAL_PROTECTION
+        bool "Prevent extraction of filenames with /../ path component"
+        default n
+        help
+        busybox tar and unzip remove "PREFIX/../" (if it exists)
+        from extracted names.
+        This option enables this behavior for all other unpacking applets,
+        such as cpio, ar, rpm.
+        GNU cpio 2.15 has NO such sanity check.
+# try other archivers and document their behavior?
+
 endmenu
diff --git a/archival/bbunzip.c b/archival/bbunzip.c
index fb5deb0ce..1f1f28b61 100644
--- a/archival/bbunzip.c
+++ b/archival/bbunzip.c
@@ -71,8 +71,8 @@ int FAST_FUNC bbunpack(char **argv,
                                         goto err;
                         } else {
                                 /* "clever zcat" with FILE */
-                                /* fail_if_not_compressed because zcat refuses uncompressed input */
-                                int fd = open_zipped(filename, /*fail_if_not_compressed:*/ 1);
+                                /* die_if_not_compressed because zcat refuses uncompressed input */
+                                int fd = open_zipped(filename, /*die_if_not_compressed:*/ 1);
                                 if (fd < 0)
                                         goto err_name;
                                 xmove_fd(fd, STDIN_FILENO);
@@ -80,7 +80,7 @@ int FAST_FUNC bbunpack(char **argv,
                 } else
                 if (option_mask32 & BBUNPK_SEAMLESS_MAGIC) {
                         /* "clever zcat" on stdin */
-                        if (setup_unzip_on_fd(STDIN_FILENO, /*fail_if_not_compressed*/ 1))
+                        if (setup_unzip_on_fd(STDIN_FILENO, /*die_if_not_compressed*/ 1))
                                 goto err;
                 }
 
diff --git a/archival/cpio.c b/archival/cpio.c
index 167931bdb..933d520c2 100644
--- a/archival/cpio.c
+++ b/archival/cpio.c
@@ -354,6 +354,12 @@ static NOINLINE int cpio_o(void)
 #endif
 #endif
 
+                if (sizeof(st.st_size) > 4
+                 && st.st_size > (off_t)0xffffffff
+                ) {
+                        bb_error_msg_and_die("error: file '%s' is larger than 4GB", name);
+                }
+
                 bytes += printf("070701"
                                 "%08X%08X%08X%08X%08X%08X%08X"
                                 "%08X%08X%08X%08X" /* GNU cpio uses uppercase hex */
diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c
index 049c2c156..8a69711c1 100644
--- a/archival/libarchive/data_extract_all.c
+++ b/archival/libarchive/data_extract_all.c
@@ -65,6 +65,14 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle)
                 } while (--n != 0);
         }
 #endif
+#if ENABLE_FEATURE_PATH_TRAVERSAL_PROTECTION
+        /* Strip leading "/" and up to last "/../" path component */
+        dst_name = (char *)strip_unsafe_prefix(dst_name);
+#endif
+// ^^^ This may be a problem if some applets do need to extract absolute names.
+// (Probably will need to invent ARCHIVE_ALLOW_UNSAFE_NAME flag).
+// You might think that rpm needs it, but in my tests rpm's internal cpio
+// archive has names like "./usr/bin/FOO", not "/usr/bin/FOO".
 
         if (archive_handle->ah_flags & ARCHIVE_CREATE_LEADING_DIRS) {
                 char *slash = strrchr(dst_name, '/');
diff --git a/archival/libarchive/open_transformer.c b/archival/libarchive/open_transformer.c
index 3d202ad26..a949c4509 100644
--- a/archival/libarchive/open_transformer.c
+++ b/archival/libarchive/open_transformer.c
@@ -164,7 +164,7 @@ void FAST_FUNC fork_transformer(int fd, const char *transform_prog)
 /* Used by e.g. rpm which gives us a fd without filename,
  * thus we can't guess the format from filename's extension.
  */
-static transformer_state_t *setup_transformer_on_fd(int fd, int fail_if_not_compressed)
+static transformer_state_t *setup_transformer_on_fd(int fd, int die_if_not_compressed)
 {
         transformer_state_t *xstate;
 
@@ -211,7 +211,7 @@ static transformer_state_t *setup_transformer_on_fd(int fd, int fail_if_not_comp
         }
 
         /* No known magic seen */
-        if (fail_if_not_compressed)
+        if (die_if_not_compressed)
                 bb_simple_error_msg_and_die("no gzip"
                         IF_FEATURE_SEAMLESS_BZ2("/bzip2")
                         IF_FEATURE_SEAMLESS_XZ("/xz")
@@ -247,13 +247,15 @@ static void fork_transformer_and_free(transformer_state_t *xstate)
 /* Used by e.g. rpm which gives us a fd without filename,
  * thus we can't guess the format from filename's extension.
  */
-int FAST_FUNC setup_unzip_on_fd(int fd, int fail_if_not_compressed)
+int FAST_FUNC setup_unzip_on_fd(int fd, int die_if_not_compressed)
 {
-        transformer_state_t *xstate = setup_transformer_on_fd(fd, fail_if_not_compressed);
+        transformer_state_t *xstate = setup_transformer_on_fd(fd, die_if_not_compressed);
 
         if (!xstate->xformer) {
+                /* Not compressed */
+                int retval = xstate->signature_skipped; /* never zero */
                 free(xstate);
-                return 1;
+                return retval;
         }
 
         fork_transformer_and_free(xstate);
@@ -271,7 +273,7 @@ void FAST_FUNC setup_lzma_on_fd(int fd)
 }
 #endif
 
-static transformer_state_t *open_transformer(const char *fname, int fail_if_not_compressed)
+static transformer_state_t *open_transformer(const char *fname, int die_if_not_compressed)
 {
         transformer_state_t *xstate;
         int fd;
@@ -291,18 +293,18 @@ static transformer_state_t *open_transformer(const char *fname, int fail_if_not_
                 }
         }
 
-        xstate = setup_transformer_on_fd(fd, fail_if_not_compressed);
+        xstate = setup_transformer_on_fd(fd, die_if_not_compressed);
 
         return xstate;
 }
 
-int FAST_FUNC open_zipped(const char *fname, int fail_if_not_compressed)
+int FAST_FUNC open_zipped(const char *fname, int die_if_not_compressed)
 {
         int fd;
         transformer_state_t *xstate;
 
-        xstate = open_transformer(fname, fail_if_not_compressed);
-        if (!xstate)
+        xstate = open_transformer(fname, die_if_not_compressed);
+        if (!xstate) /* open error */
                 return -1;
 
         fd = xstate->src_fd;
@@ -333,7 +335,7 @@ void* FAST_FUNC xmalloc_open_zipped_read_close(const char *fname, size_t *maxsz_
         transformer_state_t *xstate;
         char *image;
 
-        xstate = open_transformer(fname, /*fail_if_not_compressed:*/ 0);
+        xstate = open_transformer(fname, /*die_if_not_compressed:*/ 0);
         if (!xstate) /* file open error */
                 return NULL;
 
@@ -378,7 +380,7 @@ void* FAST_FUNC xmalloc_open_zipped_read_close(const char *fname, size_t *maxsz_
         int fd;
         char *image;
 
-        fd = open_zipped(fname, /*fail_if_not_compressed:*/ 0);
+        fd = open_zipped(fname, /*die_if_not_compressed:*/ 0);
         if (fd < 0)
                 return NULL;
 
diff --git a/archival/libarchive/unsafe_prefix.c b/archival/libarchive/unsafe_prefix.c
index 33e487bf9..667081195 100644
--- a/archival/libarchive/unsafe_prefix.c
+++ b/archival/libarchive/unsafe_prefix.c
@@ -14,7 +14,11 @@ const char* FAST_FUNC strip_unsafe_prefix(const char *str)
                         cp++;
                         continue;
                 }
-                if (is_prefixed_with(cp, "/../"+1)) {
+                /* We are called lots of times.
+                 * is_prefixed_with(cp, "../") is slower than open-coding it,
+                 * with minimal code growth (~few bytes).
+                 */
+                if (cp[0] == '.' && cp[1] == '.' && cp[2] == '/') {
                         cp += 3;
                         continue;
                 }
diff --git a/archival/rpm.c b/archival/rpm.c
index d83c33137..c2f0550ff 100644
--- a/archival/rpm.c
+++ b/archival/rpm.c
@@ -330,7 +330,7 @@ static void extract_cpio(int fd, const char *source_rpm)
         archive_handle->src_fd = fd;
         /*archive_handle->offset = 0; - init_handle() did it */
 
-        setup_unzip_on_fd(archive_handle->src_fd, /*fail_if_not_compressed:*/ 1);
+        setup_unzip_on_fd(archive_handle->src_fd, /*die_if_not_compressed:*/ 1);
         while (get_header_cpio(archive_handle) == EXIT_SUCCESS)
                 continue;
 }
@@ -549,6 +549,7 @@ int rpm2cpio_main(int argc UNUSED_PARAM, char **argv)
         //      /* We need to know whether child (gzip/bzip/etc) exits abnormally */
         //      signal(SIGCHLD, check_errors_in_children);
 
+        str = NULL;
         if (ENABLE_FEATURE_SEAMLESS_LZMA
          && (str = rpm_getstr0(TAG_PAYLOADCOMPRESSOR)) != NULL
          && strcmp(str, "lzma") == 0
@@ -557,7 +558,11 @@ int rpm2cpio_main(int argc UNUSED_PARAM, char **argv)
                 // set up decompressor without detection
                 setup_lzma_on_fd(rpm_fd);
         } else {
-                setup_unzip_on_fd(rpm_fd, /*fail_if_not_compressed:*/ 1);
+                int signature_bytes = setup_unzip_on_fd(rpm_fd, /*die_if_not_compressed:*/ 0);
+                if (signature_bytes != 0) {
+                        xlseek(rpm_fd, - signature_bytes, SEEK_CUR);
+                        bb_error_msg("warning, unknown compression '%s'", str);
+                }
         }
 
         if (bb_copyfd_eof(rpm_fd, STDOUT_FILENO) < 0)
diff --git a/archival/tar.c b/archival/tar.c
index 23ea02b5d..fd20d6ce7 100644
--- a/archival/tar.c
+++ b/archival/tar.c
@@ -1188,7 +1188,7 @@ int tar_main(int argc UNUSED_PARAM, char **argv)
                  * on e.g. tarball with 1st file named "BZh5".
                  */
                 ) {
-                        tar_handle->src_fd = open_zipped(tar_filename, /*fail_if_not_compressed:*/ 0);
+                        tar_handle->src_fd = open_zipped(tar_filename, /*die_if_not_compressed:*/ 0);
                         if (tar_handle->src_fd < 0)
                                 bb_perror_msg_and_die("can't open '%s'", tar_filename);
                 } else {