1 /*-
2 * Copyright (c) 2003-2023 Tim Kientzle
3 * Copyright (c) 2011-2012 Michihiro NAKAJIMA
4 * Copyright (c) 2016 Martin Matuska
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 #include "archive_platform.h"
29
30 #ifdef HAVE_ERRNO_H
31 #include <errno.h>
32 #endif
33 #include <stddef.h>
34 #ifdef HAVE_STDLIB_H
35 #include <stdlib.h>
36 #endif
37 #ifdef HAVE_STRING_H
38 #include <string.h>
39 #endif
40
41 #include "archive.h"
42 #include "archive_acl_private.h" /* For ACL parsing routines. */
43 #include "archive_entry.h"
44 #include "archive_entry_locale.h"
45 #include "archive_integer.h"
46 #include "archive_private.h"
47 #include "archive_read_private.h"
48
49 #define tar_min(a,b) ((a) < (b) ? (a) : (b))
50
51 /*
52 * Layout of POSIX 'ustar' tar header.
53 */
54 struct archive_entry_header_ustar {
55 char name[100];
56 char mode[8];
57 char uid[8];
58 char gid[8];
59 char size[12];
60 char mtime[12];
61 char checksum[8];
62 char typeflag[1];
63 char linkname[100]; /* "old format" header ends here */
64 char magic[6]; /* For POSIX: "ustar\0" */
65 char version[2]; /* For POSIX: "00" */
66 char uname[32];
67 char gname[32];
68 char rdevmajor[8];
69 char rdevminor[8];
70 char prefix[155];
71 };
72
73 /*
74 * Structure of GNU tar header
75 */
76 struct gnu_sparse {
77 char offset[12];
78 char numbytes[12];
79 };
80
81 struct archive_entry_header_gnutar {
82 char name[100];
83 char mode[8];
84 char uid[8];
85 char gid[8];
86 char size[12];
87 char mtime[12];
88 char checksum[8];
89 char typeflag[1];
90 char linkname[100];
91 char magic[8]; /* "ustar \0" (note blank/blank/null at end) */
92 char uname[32];
93 char gname[32];
94 char rdevmajor[8];
95 char rdevminor[8];
96 char atime[12];
97 char ctime[12];
98 char offset[12];
99 char longnames[4];
100 char unused[1];
101 struct gnu_sparse sparse[4];
102 char isextended[1];
103 char realsize[12];
104 /*
105 * Old GNU format doesn't use POSIX 'prefix' field; they use
106 * the 'L' (longname) entry instead.
107 */
108 };
109
110 /*
111 * Data specific to this format.
112 */
113 struct sparse_block {
114 struct sparse_block *next;
115 int64_t offset;
116 int64_t remaining;
117 int hole;
118 };
119
120 struct tar {
121 struct archive_string entry_pathname;
122 /* For "GNU.sparse.name" and other similar path extensions. */
123 struct archive_string entry_pathname_override;
124 struct archive_string entry_uname;
125 struct archive_string entry_gname;
126 struct archive_string entry_linkpath;
127 struct archive_string line;
128 int pax_hdrcharset_utf8;
129 int64_t entry_bytes_remaining;
130 int64_t entry_offset;
131 int64_t entry_padding;
132 int64_t entry_bytes_unconsumed;
133 int64_t disk_size;
134 int64_t GNU_sparse_realsize;
135 int64_t GNU_sparse_size;
136 int64_t SCHILY_sparse_realsize;
137 int64_t pax_size;
138 struct sparse_block *sparse_list;
139 struct sparse_block *sparse_last;
140 int64_t sparse_offset;
141 int64_t sparse_numbytes;
142 int sparse_gnu_major;
143 int sparse_gnu_minor;
144 char sparse_gnu_attributes_seen;
145 char filetype;
146 char size_fields; /* Bits defined below */
147
148 struct archive_string localname;
149 struct archive_string_conv *opt_sconv;
150 struct archive_string_conv *sconv;
151 struct archive_string_conv *sconv_acl;
152 struct archive_string_conv *sconv_default;
153 int init_default_conversion;
154 int compat_2x;
155 int process_mac_extensions;
156 int read_concatenated_archives;
157 int default_inode;
158 int default_dev;
159 };
160
161 /* Track which size fields were present in the headers */
162 #define TAR_SIZE_PAX_SIZE 1
163 #define TAR_SIZE_GNU_SPARSE_REALSIZE 2
164 #define TAR_SIZE_GNU_SPARSE_SIZE 4
165 #define TAR_SIZE_SCHILY_SPARSE_REALSIZE 8
166
167
168 static int archive_block_is_null(const char *p);
169 static char *base64_decode(const char *, size_t, size_t *);
170 static int gnu_add_sparse_entry(struct archive_read *, struct tar *,
171 int64_t offset, int64_t remaining);
172
173 static void gnu_clear_sparse_list(struct tar *);
174 static int gnu_sparse_old_read(struct archive_read *, struct tar *,
175 const struct archive_entry_header_gnutar *header, int64_t *);
176 static int gnu_sparse_old_parse(struct archive_read *, struct tar *,
177 const struct gnu_sparse *sparse, int length);
178 static int gnu_sparse_01_parse(struct archive_read *, struct tar *,
179 const char *, size_t);
180 static int64_t gnu_sparse_10_read(struct archive_read *, struct tar *,
181 int64_t *);
182 static int header_Solaris_ACL(struct archive_read *, struct tar *,
183 struct archive_entry *, const void *, int64_t *);
184 static int header_common(struct archive_read *, struct tar *,
185 struct archive_entry *, const void *);
186 static int header_old_tar(struct archive_read *, struct tar *,
187 struct archive_entry *, const void *);
188 static int header_pax_extension(struct archive_read *, struct tar *,
189 struct archive_entry *, const void *, int64_t *);
190 static int header_pax_global(struct archive_read *, struct tar *,
191 struct archive_entry *, const void *h, int64_t *);
192 static int header_gnu_longlink(struct archive_read *, struct tar *,
193 struct archive_entry *, const void *h, int64_t *);
194 static int header_gnu_longname(struct archive_read *, struct tar *,
195 struct archive_entry *, const void *h, int64_t *);
196 static int is_mac_metadata_entry(struct archive_entry *entry);
197 static int read_mac_metadata_blob(struct archive_read *,
198 struct archive_entry *, int64_t *);
199 static int header_volume(struct archive_read *, struct tar *,
200 struct archive_entry *, const void *h, int64_t *);
201 static int header_ustar(struct archive_read *, struct tar *,
202 struct archive_entry *, const void *h);
203 static int header_gnutar(struct archive_read *, struct tar *,
204 struct archive_entry *, const void *h, int64_t *);
205 static int archive_read_format_tar_bid(struct archive_read *, int);
206 static int archive_read_format_tar_options(struct archive_read *,
207 const char *, const char *);
208 static int archive_read_format_tar_cleanup(struct archive_read *);
209 static int archive_read_format_tar_read_data(struct archive_read *a,
210 const void **buff, size_t *size, int64_t *offset);
211 static int archive_read_format_tar_skip(struct archive_read *a);
212 static int archive_read_format_tar_read_header(struct archive_read *,
213 struct archive_entry *);
214 static int checksum(struct archive_read *, const void *);
215 static int pax_attribute(struct archive_read *, struct tar *,
216 struct archive_entry *, const char *key, size_t key_length,
217 size_t value_length, int64_t *unconsumed);
218 static int pax_attribute_LIBARCHIVE_xattr(struct archive_entry *,
219 const char *, size_t, const char *, size_t);
220 static int pax_attribute_SCHILY_acl(struct archive_read *, struct tar *,
221 struct archive_entry *, size_t, int);
222 static int pax_attribute_SUN_holesdata(struct archive_read *, struct tar *,
223 struct archive_entry *, const char *, size_t);
224 static void pax_time(const char *, size_t, int64_t *sec, long *nanos);
225 static ssize_t readline(struct archive_read *, struct tar *, const char **,
226 ssize_t limit, int64_t *);
227 static int read_body_to_string(struct archive_read *, struct tar *,
228 struct archive_string *, const void *h, int64_t *);
229 static int read_bytes_to_string(struct archive_read *,
230 struct archive_string *, size_t, int64_t *);
231 static int64_t tar_atol(const char *, size_t);
232 static int64_t tar_atol10(const char *, size_t);
233 static int64_t tar_atol256(const char *, size_t);
234 static int64_t tar_atol8(const char *, size_t);
235 static int tar_read_header(struct archive_read *, struct tar *,
236 struct archive_entry *, int64_t *);
237 static int tohex(int c);
238 static char *url_decode(const char *, size_t);
239 static int tar_flush_unconsumed(struct archive_read *, int64_t *);
240
241 /* Sanity limits: These numbers should be low enough to
242 * prevent a maliciously-crafted archive from forcing us to
243 * allocate extreme amounts of memory. But of course, they
244 * need to be high enough for any correct value. These
245 * will likely need some adjustment as we get more experience. */
246 static const size_t guname_limit = 65536; /* Longest uname or gname: 64kiB */
247 static const size_t pathname_limit = 1048576; /* Longest path name: 1MiB */
248 static const size_t sparse_map_limit = 8 * 1048576; /* Longest sparse map: 8MiB */
249 static const size_t xattr_limit = 16 * 1048576; /* Longest xattr: 16MiB */
250 static const size_t fflags_limit = 512; /* Longest fflags */
251 static const size_t acl_limit = 131072; /* Longest textual ACL: 128kiB */
252 static const int64_t entry_limit = 0xfffffffffffffffLL; /* 2^60 bytes = 1 ExbiByte */
253
254 int
archive_read_support_format_gnutar(struct archive * a)255 archive_read_support_format_gnutar(struct archive *a)
256 {
257 archive_check_magic(a, ARCHIVE_READ_MAGIC,
258 ARCHIVE_STATE_NEW, "archive_read_support_format_gnutar");
259 return (archive_read_support_format_tar(a));
260 }
261
262
263 int
archive_read_support_format_tar(struct archive * _a)264 archive_read_support_format_tar(struct archive *_a)
265 {
266 struct archive_read *a = (struct archive_read *)_a;
267 struct tar *tar;
268 int r;
269
270 archive_check_magic(_a, ARCHIVE_READ_MAGIC,
271 ARCHIVE_STATE_NEW, "archive_read_support_format_tar");
272
273 tar = calloc(1, sizeof(*tar));
274 if (tar == NULL) {
275 archive_set_error(&a->archive, ENOMEM,
276 "Can't allocate tar data");
277 return (ARCHIVE_FATAL);
278 }
279 #ifdef HAVE_COPYFILE_H
280 /* Set this by default on Mac OS. */
281 tar->process_mac_extensions = 1;
282 #endif
283
284 r = __archive_read_register_format(a, tar, "tar",
285 archive_read_format_tar_bid,
286 archive_read_format_tar_options,
287 archive_read_format_tar_read_header,
288 archive_read_format_tar_read_data,
289 archive_read_format_tar_skip,
290 NULL,
291 archive_read_format_tar_cleanup,
292 NULL,
293 NULL);
294
295 if (r != ARCHIVE_OK)
296 free(tar);
297 return (ARCHIVE_OK);
298 }
299
300 static int
archive_read_format_tar_cleanup(struct archive_read * a)301 archive_read_format_tar_cleanup(struct archive_read *a)
302 {
303 struct tar *tar = a->format->data;
304
305 gnu_clear_sparse_list(tar);
306 archive_string_free(&tar->entry_pathname);
307 archive_string_free(&tar->entry_pathname_override);
308 archive_string_free(&tar->entry_uname);
309 archive_string_free(&tar->entry_gname);
310 archive_string_free(&tar->entry_linkpath);
311 archive_string_free(&tar->line);
312 archive_string_free(&tar->localname);
313 free(tar);
314 a->format->data = NULL;
315 return (ARCHIVE_OK);
316 }
317
318 /*
319 * Validate number field
320 *
321 * This has to be pretty lenient in order to accommodate the enormous
322 * variety of tar writers in the world:
323 * = POSIX (IEEE Std 1003.1-1988) ustar requires octal values with leading
324 * zeros and allows fields to be terminated with space or null characters
325 * = Many writers use different termination (in particular, libarchive
326 * omits terminator bytes to squeeze one or two more digits)
327 * = Many writers pad with space and omit leading zeros
328 * = GNU tar and star write base-256 values if numbers are too
329 * big to be represented in octal
330 *
331 * Examples of specific tar headers that we should support:
332 * = Perl Archive::Tar terminates uid, gid, devminor and devmajor with two
333 * null bytes, pads size with spaces and other numeric fields with zeroes
334 * = plexus-archiver prior to 2.6.3 (before switching to commons-compress)
335 * may have uid and gid fields filled with spaces without any octal digits
336 * at all and pads all numeric fields with spaces
337 *
338 * This should tolerate all variants in use. It will reject a field
339 * where the writer just left garbage after a trailing NUL.
340 */
341 static int
validate_number_field(const char * p_field,size_t i_size)342 validate_number_field(const char* p_field, size_t i_size)
343 {
344 unsigned char marker = (unsigned char)p_field[0];
345 if (marker == 128 || marker == 255 || marker == 0) {
346 /* Base-256 marker, there's nothing we can check. */
347 return 1;
348 } else {
349 /* Must be octal */
350 size_t i = 0;
351 /* Skip any leading spaces */
352 while (i < i_size && p_field[i] == ' ') {
353 ++i;
354 }
355 /* Skip octal digits. */
356 while (i < i_size && p_field[i] >= '0' && p_field[i] <= '7') {
357 ++i;
358 }
359 /* Any remaining characters must be space or NUL padding. */
360 while (i < i_size) {
361 if (p_field[i] != ' ' && p_field[i] != 0) {
362 return 0;
363 }
364 ++i;
365 }
366 return 1;
367 }
368 }
369
370 static int
archive_read_format_tar_bid(struct archive_read * a,int best_bid)371 archive_read_format_tar_bid(struct archive_read *a, int best_bid)
372 {
373 int bid;
374 const char *h;
375 const struct archive_entry_header_ustar *header;
376
377 (void)best_bid; /* UNUSED */
378
379 bid = 0;
380
381 /* Now let's look at the actual header and see if it matches. */
382 h = __archive_read_ahead(a, 512, NULL);
383 if (h == NULL)
384 return (-1);
385
386 /* If it's an end-of-archive mark, we can handle it. */
387 if (h[0] == 0 && archive_block_is_null(h)) {
388 /*
389 * Usually, I bid the number of bits verified, but
390 * in this case, 4096 seems excessive so I picked 10 as
391 * an arbitrary but reasonable-seeming value.
392 */
393 return (10);
394 }
395
396 /* If it's not an end-of-archive mark, it must have a valid checksum.*/
397 if (!checksum(a, h))
398 return (0);
399 bid += 48; /* Checksum is usually 6 octal digits. */
400
401 header = (const struct archive_entry_header_ustar *)h;
402
403 /* Recognize POSIX formats. */
404 if ((memcmp(header->magic, "ustar\0", 6) == 0)
405 && (memcmp(header->version, "00", 2) == 0))
406 bid += 56;
407
408 /* Recognize GNU tar format. */
409 if ((memcmp(header->magic, "ustar ", 6) == 0)
410 && (memcmp(header->version, " \0", 2) == 0))
411 bid += 56;
412
413 /* Type flag must be null, digit or A-Z, a-z. */
414 if (header->typeflag[0] != 0 &&
415 !( header->typeflag[0] >= '0' && header->typeflag[0] <= '9') &&
416 !( header->typeflag[0] >= 'A' && header->typeflag[0] <= 'Z') &&
417 !( header->typeflag[0] >= 'a' && header->typeflag[0] <= 'z') )
418 return (0);
419 bid += 2; /* 6 bits of variation in an 8-bit field leaves 2 bits. */
420
421 /*
422 * Check format of mode/uid/gid/mtime/size/rdevmajor/rdevminor fields.
423 */
424 if (validate_number_field(header->mode, sizeof(header->mode)) == 0
425 || validate_number_field(header->uid, sizeof(header->uid)) == 0
426 || validate_number_field(header->gid, sizeof(header->gid)) == 0
427 || validate_number_field(header->mtime, sizeof(header->mtime)) == 0
428 || validate_number_field(header->size, sizeof(header->size)) == 0
429 || validate_number_field(header->rdevmajor, sizeof(header->rdevmajor)) == 0
430 || validate_number_field(header->rdevminor, sizeof(header->rdevminor)) == 0) {
431 bid = 0;
432 }
433
434 return (bid);
435 }
436
437 static int
archive_read_format_tar_options(struct archive_read * a,const char * key,const char * val)438 archive_read_format_tar_options(struct archive_read *a,
439 const char *key, const char *val)
440 {
441 struct tar *tar = a->format->data;
442 int ret = ARCHIVE_FAILED;
443
444 if (strcmp(key, "compat-2x") == 0) {
445 /* Handle UTF-8 filenames as libarchive 2.x */
446 tar->compat_2x = (val != NULL && val[0] != 0);
447 tar->init_default_conversion = tar->compat_2x;
448 return (ARCHIVE_OK);
449 } else if (strcmp(key, "hdrcharset") == 0) {
450 if (val == NULL || val[0] == 0)
451 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
452 "tar: hdrcharset option needs a character-set name");
453 else {
454 tar->opt_sconv =
455 archive_string_conversion_from_charset(
456 &a->archive, val, 0);
457 if (tar->opt_sconv != NULL)
458 ret = ARCHIVE_OK;
459 else
460 ret = ARCHIVE_FATAL;
461 }
462 return (ret);
463 } else if (strcmp(key, "mac-ext") == 0) {
464 tar->process_mac_extensions = (val != NULL && val[0] != 0);
465 return (ARCHIVE_OK);
466 } else if (strcmp(key, "read_concatenated_archives") == 0) {
467 tar->read_concatenated_archives = (val != NULL && val[0] != 0);
468 return (ARCHIVE_OK);
469 }
470
471 /* Note: The "warn" return is just to inform the options
472 * supervisor that we didn't handle it. It will generate
473 * a suitable error if no one used this option. */
474 return (ARCHIVE_WARN);
475 }
476
477 /* utility function- this exists to centralize the logic of tracking
478 * how much unconsumed data we have floating around, and to consume
479 * anything outstanding since we're going to do read_aheads
480 */
481 static int
tar_flush_unconsumed(struct archive_read * a,int64_t * unconsumed)482 tar_flush_unconsumed(struct archive_read *a, int64_t *unconsumed)
483 {
484 if (*unconsumed) {
485 /*
486 void *data = (void *)__archive_read_ahead(a, *unconsumed, NULL);
487 * this block of code is to poison claimed unconsumed space, ensuring
488 * things break if it is in use still.
489 * currently it WILL break things, so enable it only for debugging this issue
490 if (data) {
491 memset(data, 0xff, *unconsumed);
492 }
493 */
494 int64_t consumed = __archive_read_consume(a, *unconsumed);
495 if (consumed != *unconsumed) {
496 return (ARCHIVE_FATAL);
497 }
498 *unconsumed = 0;
499 }
500 return (ARCHIVE_OK);
501 }
502
503 /*
504 * The function invoked by archive_read_next_header(). This
505 * just sets up a few things and then calls the internal
506 * tar_read_header() function below.
507 */
508 static int
archive_read_format_tar_read_header(struct archive_read * a,struct archive_entry * entry)509 archive_read_format_tar_read_header(struct archive_read *a,
510 struct archive_entry *entry)
511 {
512 /*
513 * When converting tar archives to cpio archives, it is
514 * essential that each distinct file have a distinct inode
515 * number. To simplify this, we keep a static count here to
516 * assign fake dev/inode numbers to each tar entry. Note that
517 * pax format archives may overwrite this with something more
518 * useful.
519 *
520 * Ideally, we would track every file read from the archive so
521 * that we could assign the same dev/ino pair to hardlinks,
522 * but the memory required to store a complete lookup table is
523 * probably not worthwhile just to support the relatively
524 * obscure tar->cpio conversion case.
525 */
526 struct tar *tar = a->format->data;
527 const char *p;
528 const wchar_t *wp;
529 int r;
530 size_t l;
531 int64_t unconsumed = 0;
532
533 /* Assign default device/inode values. */
534 archive_entry_set_dev(entry, 1 + tar->default_dev); /* Don't use zero. */
535 archive_entry_set_ino(entry, ++tar->default_inode); /* Don't use zero. */
536 /* Limit generated st_ino number to 16 bits. */
537 if (tar->default_inode >= 0xffff) {
538 ++tar->default_dev;
539 tar->default_inode = 0;
540 }
541
542 tar->entry_offset = 0;
543 gnu_clear_sparse_list(tar);
544 tar->size_fields = 0; /* We don't have any size info yet */
545
546 /* Setup default string conversion. */
547 tar->sconv = tar->opt_sconv;
548 if (tar->sconv == NULL) {
549 if (!tar->init_default_conversion) {
550 tar->sconv_default =
551 archive_string_default_conversion_for_read(&(a->archive));
552 tar->init_default_conversion = 1;
553 }
554 tar->sconv = tar->sconv_default;
555 }
556
557 r = tar_read_header(a, tar, entry, &unconsumed);
558
559 tar_flush_unconsumed(a, &unconsumed);
560
561 /*
562 * "non-sparse" files are really just sparse files with
563 * a single block.
564 */
565 if (tar->sparse_list == NULL) {
566 if (gnu_add_sparse_entry(a, tar, 0, tar->entry_bytes_remaining)
567 != ARCHIVE_OK)
568 return (ARCHIVE_FATAL);
569 } else {
570 struct sparse_block *sb;
571
572 for (sb = tar->sparse_list; sb != NULL; sb = sb->next) {
573 if (!sb->hole)
574 archive_entry_sparse_add_entry(entry,
575 sb->offset, sb->remaining);
576 }
577 }
578
579 if (r == ARCHIVE_OK && archive_entry_filetype(entry) == AE_IFREG) {
580 /*
581 * "Regular" entry with trailing '/' is really
582 * directory: This is needed for certain old tar
583 * variants and even for some broken newer ones.
584 */
585 if ((p = archive_entry_pathname(entry)) != NULL) {
586 l = strlen(p);
587 if (l > 0 && p[l - 1] == '/') {
588 archive_entry_set_filetype(entry, AE_IFDIR);
589 tar->entry_bytes_remaining = 0;
590 tar->entry_padding = 0;
591 }
592 } else if ((wp = archive_entry_pathname_w(entry)) != NULL) {
593 l = wcslen(wp);
594 if (l > 0 && wp[l - 1] == L'/') {
595 archive_entry_set_filetype(entry, AE_IFDIR);
596 tar->entry_bytes_remaining = 0;
597 tar->entry_padding = 0;
598 }
599 }
600 }
601 return (r);
602 }
603
604 static int
archive_read_format_tar_read_data(struct archive_read * a,const void ** buff,size_t * size,int64_t * offset)605 archive_read_format_tar_read_data(struct archive_read *a,
606 const void **buff, size_t *size, int64_t *offset)
607 {
608 struct tar *tar = a->format->data;
609 ssize_t bytes_read;
610 struct sparse_block *p;
611
612 for (;;) {
613 /* Remove exhausted entries from sparse list. */
614 while (tar->sparse_list != NULL &&
615 tar->sparse_list->remaining == 0) {
616 p = tar->sparse_list;
617 tar->sparse_list = p->next;
618 free(p);
619 }
620
621 if (tar->entry_bytes_unconsumed) {
622 __archive_read_consume(a, tar->entry_bytes_unconsumed);
623 tar->entry_bytes_unconsumed = 0;
624 }
625
626 /* If we're at end of file, return EOF. */
627 if (tar->sparse_list == NULL ||
628 tar->entry_bytes_remaining == 0) {
629 int64_t request = tar->entry_bytes_remaining +
630 tar->entry_padding;
631
632 if (__archive_read_consume(a, request) != request)
633 return (ARCHIVE_FATAL);
634 tar->entry_padding = 0;
635 *buff = NULL;
636 *size = 0;
637 *offset = tar->disk_size;
638 return (ARCHIVE_EOF);
639 }
640
641 *buff = __archive_read_ahead(a, 1, &bytes_read);
642 if (*buff == NULL) {
643 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
644 "Truncated tar archive"
645 " detected while reading data");
646 return (ARCHIVE_FATAL);
647 }
648 if (bytes_read > tar->entry_bytes_remaining)
649 bytes_read = (ssize_t)tar->entry_bytes_remaining;
650 /* Don't read more than is available in the
651 * current sparse block. */
652 if (tar->sparse_list->remaining < bytes_read)
653 bytes_read = (ssize_t)tar->sparse_list->remaining;
654 *size = bytes_read;
655 *offset = tar->sparse_list->offset;
656 tar->sparse_list->remaining -= bytes_read;
657 tar->sparse_list->offset += bytes_read;
658 tar->entry_bytes_remaining -= bytes_read;
659 tar->entry_bytes_unconsumed = bytes_read;
660
661 if (!tar->sparse_list->hole)
662 return (ARCHIVE_OK);
663 /* Current is hole data and skip this. */
664 }
665 }
666
667 static int
archive_read_format_tar_skip(struct archive_read * a)668 archive_read_format_tar_skip(struct archive_read *a)
669 {
670 struct tar *tar = a->format->data;
671 int64_t request;
672
673 request = tar->entry_bytes_remaining + tar->entry_padding +
674 tar->entry_bytes_unconsumed;
675
676 if (__archive_read_consume(a, request) != request)
677 return (ARCHIVE_FATAL);
678
679 tar->entry_bytes_remaining = 0;
680 tar->entry_bytes_unconsumed = 0;
681 tar->entry_padding = 0;
682
683 /* Free the sparse list. */
684 gnu_clear_sparse_list(tar);
685
686 return (ARCHIVE_OK);
687 }
688
689 /*
690 * This function resets the accumulated state while reading
691 * a header.
692 */
693 static void
tar_reset_header_state(struct tar * tar)694 tar_reset_header_state(struct tar *tar)
695 {
696 tar->pax_hdrcharset_utf8 = 1;
697 tar->sparse_gnu_attributes_seen = 0;
698 archive_string_empty(&(tar->entry_gname));
699 archive_string_empty(&(tar->entry_pathname));
700 archive_string_empty(&(tar->entry_pathname_override));
701 archive_string_empty(&(tar->entry_uname));
702 archive_string_empty(&tar->entry_linkpath);
703 }
704
705 /*
706 * This function reads and interprets all of the headers associated
707 * with a single entry.
708 */
709 static int
tar_read_header(struct archive_read * a,struct tar * tar,struct archive_entry * entry,int64_t * unconsumed)710 tar_read_header(struct archive_read *a, struct tar *tar,
711 struct archive_entry *entry, int64_t *unconsumed)
712 {
713 ssize_t bytes;
714 int err = ARCHIVE_OK, err2;
715 int eof_fatal = 0; /* EOF is okay at some points... */
716 const char *h;
717 const struct archive_entry_header_ustar *header;
718 const struct archive_entry_header_gnutar *gnuheader;
719
720 /* Bitmask of what header types we've seen. */
721 int32_t seen_headers = 0;
722 static const int32_t seen_A_header = 1;
723 static const int32_t seen_g_header = 2;
724 static const int32_t seen_K_header = 4;
725 static const int32_t seen_L_header = 8;
726 static const int32_t seen_V_header = 16;
727 static const int32_t seen_x_header = 32; /* Also X */
728 static const int32_t seen_mac_metadata = 512;
729
730 tar_reset_header_state(tar);
731
732 /* Ensure format is set. */
733 if (a->archive.archive_format_name == NULL) {
734 a->archive.archive_format = ARCHIVE_FORMAT_TAR;
735 a->archive.archive_format_name = "tar";
736 }
737
738 /*
739 * TODO: Write global/default pax options into
740 * 'entry' struct here before overwriting with
741 * file-specific options.
742 */
743
744 /* Loop over all the headers needed for the next entry */
745 for (;;) {
746
747 /* Find the next valid header record. */
748 while (1) {
749 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
750 return (ARCHIVE_FATAL);
751 }
752
753 /* Read 512-byte header record */
754 h = __archive_read_ahead(a, 512, &bytes);
755 if (bytes == 0) { /* EOF at a block boundary. */
756 if (eof_fatal) {
757 /* We've read a special header already;
758 * if there's no regular header, then this is
759 * a premature EOF. */
760 archive_set_error(&a->archive, EINVAL,
761 "Damaged tar archive (end-of-archive within a sequence of headers)");
762 return (ARCHIVE_FATAL);
763 } else {
764 return (ARCHIVE_EOF);
765 }
766 }
767 if (h == NULL) { /* Short block at EOF; this is bad. */
768 archive_set_error(&a->archive,
769 ARCHIVE_ERRNO_FILE_FORMAT,
770 "Truncated tar archive"
771 " detected while reading next header");
772 return (ARCHIVE_FATAL);
773 }
774 *unconsumed += 512;
775
776 if (h[0] == 0 && archive_block_is_null(h)) {
777 /* We found a NULL block which indicates end-of-archive */
778
779 if (tar->read_concatenated_archives) {
780 /* We're ignoring NULL blocks, so keep going. */
781 continue;
782 }
783
784 /* Try to consume a second all-null record, as well. */
785 /* If we can't, that's okay. */
786 tar_flush_unconsumed(a, unconsumed);
787 h = __archive_read_ahead(a, 512, NULL);
788 if (h != NULL && h[0] == 0 && archive_block_is_null(h))
789 __archive_read_consume(a, 512);
790
791 archive_clear_error(&a->archive);
792 return (ARCHIVE_EOF);
793 }
794
795 /* This is NOT a null block, so it must be a valid header. */
796 if (!checksum(a, h)) {
797 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
798 return (ARCHIVE_FATAL);
799 }
800 archive_set_error(&a->archive, EINVAL,
801 "Damaged tar archive (bad header checksum)");
802 /* If we've read some critical information (pax headers, etc)
803 * and _then_ see a bad header, we can't really recover. */
804 if (eof_fatal) {
805 return (ARCHIVE_FATAL);
806 } else {
807 return (ARCHIVE_RETRY);
808 }
809 }
810 break;
811 }
812
813 /* Determine the format variant. */
814 header = (const struct archive_entry_header_ustar *)h;
815 switch(header->typeflag[0]) {
816 case 'A': /* Solaris tar ACL */
817 if (seen_headers & seen_A_header) {
818 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
819 "Redundant 'A' header");
820 return (ARCHIVE_FATAL);
821 }
822 seen_headers |= seen_A_header;
823 a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
824 a->archive.archive_format_name = "Solaris tar";
825 err2 = header_Solaris_ACL(a, tar, entry, h, unconsumed);
826 break;
827 case 'g': /* POSIX-standard 'g' header. */
828 if (seen_headers & seen_g_header) {
829 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
830 "Redundant 'g' header");
831 return (ARCHIVE_FATAL);
832 }
833 seen_headers |= seen_g_header;
834 a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
835 a->archive.archive_format_name = "POSIX pax interchange format";
836 err2 = header_pax_global(a, tar, entry, h, unconsumed);
837 break;
838 case 'K': /* Long link name (GNU tar, others) */
839 if (seen_headers & seen_K_header) {
840 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
841 "Damaged archive: Redundant 'K' headers may cause linknames to be incorrect");
842 err = err_combine(err, ARCHIVE_WARN);
843 }
844 seen_headers |= seen_K_header;
845 a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
846 a->archive.archive_format_name = "GNU tar format";
847 err2 = header_gnu_longlink(a, tar, entry, h, unconsumed);
848 break;
849 case 'L': /* Long filename (GNU tar, others) */
850 if (seen_headers & seen_L_header) {
851 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
852 "Damaged archive: Redundant 'L' headers may cause filenames to be incorrect");
853 err = err_combine(err, ARCHIVE_WARN);
854 }
855 seen_headers |= seen_L_header;
856 a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
857 a->archive.archive_format_name = "GNU tar format";
858 err2 = header_gnu_longname(a, tar, entry, h, unconsumed);
859 break;
860 case 'V': /* GNU volume header */
861 if (seen_headers & seen_V_header) {
862 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
863 "Redundant 'V' header");
864 err = err_combine(err, ARCHIVE_WARN);
865 }
866 seen_headers |= seen_V_header;
867 a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
868 a->archive.archive_format_name = "GNU tar format";
869 err2 = header_volume(a, tar, entry, h, unconsumed);
870 break;
871 case 'X': /* Used by SUN tar; same as 'x'. */
872 if (seen_headers & seen_x_header) {
873 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
874 "Redundant 'X'/'x' header");
875 return (ARCHIVE_FATAL);
876 }
877 seen_headers |= seen_x_header;
878 a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
879 a->archive.archive_format_name =
880 "POSIX pax interchange format (Sun variant)";
881 err2 = header_pax_extension(a, tar, entry, h, unconsumed);
882 break;
883 case 'x': /* POSIX-standard 'x' header. */
884 if (seen_headers & seen_x_header) {
885 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
886 "Redundant 'x' header");
887 return (ARCHIVE_FATAL);
888 }
889 seen_headers |= seen_x_header;
890 a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
891 a->archive.archive_format_name = "POSIX pax interchange format";
892 err2 = header_pax_extension(a, tar, entry, h, unconsumed);
893 break;
894 default: /* Regular header: Legacy tar, GNU tar, or ustar */
895 gnuheader = (const struct archive_entry_header_gnutar *)h;
896 if (memcmp(gnuheader->magic, "ustar \0", 8) == 0) {
897 a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
898 a->archive.archive_format_name = "GNU tar format";
899 err2 = header_gnutar(a, tar, entry, h, unconsumed);
900 } else if (memcmp(header->magic, "ustar", 5) == 0) {
901 if (a->archive.archive_format != ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE) {
902 a->archive.archive_format = ARCHIVE_FORMAT_TAR_USTAR;
903 a->archive.archive_format_name = "POSIX ustar format";
904 }
905 err2 = header_ustar(a, tar, entry, h);
906 } else {
907 a->archive.archive_format = ARCHIVE_FORMAT_TAR;
908 a->archive.archive_format_name = "tar (non-POSIX)";
909 err2 = header_old_tar(a, tar, entry, h);
910 }
911 err = err_combine(err, err2);
912 /* We return warnings or success as-is. Anything else is fatal. */
913 if (err < ARCHIVE_WARN) {
914 return (ARCHIVE_FATAL);
915 }
916 /* Filename of the form `._filename` is an AppleDouble
917 * extension entry. The body is the macOS metadata blob;
918 * this is followed by another entry with the actual
919 * regular file data.
920 * This design has two drawbacks:
921 * = it's brittle; you might just have a file with such a name
922 * = it duplicates any long pathname extensions
923 *
924 * TODO: This probably shouldn't be here at all. Consider
925 * just returning the contents as a regular entry here and
926 * then dealing with it when we write data to disk.
927 */
928 if (tar->process_mac_extensions
929 && ((seen_headers & seen_mac_metadata) == 0)
930 && is_mac_metadata_entry(entry)) {
931 err2 = read_mac_metadata_blob(a, entry, unconsumed);
932 if (err2 < ARCHIVE_WARN) {
933 return (ARCHIVE_FATAL);
934 }
935 err = err_combine(err, err2);
936 /* Note: Other headers can appear again. */
937 seen_headers = seen_mac_metadata;
938 tar_reset_header_state(tar);
939 break;
940 }
941
942 /* Reconcile GNU sparse attributes */
943 if (tar->sparse_gnu_attributes_seen) {
944 /* Only 'S' (GNU sparse) and ustar '0' regular files can be sparse */
945 if (tar->filetype != 'S' && tar->filetype != '0') {
946 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
947 "Non-regular file cannot be sparse");
948 return (ARCHIVE_WARN);
949 } else if (tar->sparse_gnu_major == 0 &&
950 tar->sparse_gnu_minor == 0) {
951 /* Sparse map already parsed from 'x' header */
952 } else if (tar->sparse_gnu_major == 0 &&
953 tar->sparse_gnu_minor == 1) {
954 /* Sparse map already parsed from 'x' header */
955 } else if (tar->sparse_gnu_major == 1 &&
956 tar->sparse_gnu_minor == 0) {
957 /* Sparse map is prepended to file contents */
958 ssize_t bytes_read;
959 bytes_read = gnu_sparse_10_read(a, tar, unconsumed);
960 if (bytes_read < 0)
961 return ((int)bytes_read);
962 tar->entry_bytes_remaining -= bytes_read;
963 } else {
964 archive_set_error(&a->archive,
965 ARCHIVE_ERRNO_MISC,
966 "Unrecognized GNU sparse file format");
967 return (ARCHIVE_WARN);
968 }
969 }
970 return (err);
971 }
972
973 /* We're between headers ... */
974 err = err_combine(err, err2);
975 if (err == ARCHIVE_FATAL)
976 return (err);
977
978 /* The GNU volume header and the pax `g` global header
979 * are both allowed to be the only header in an
980 * archive. If we've seen any other header, a
981 * following EOF is fatal. */
982 if ((seen_headers & ~seen_V_header & ~seen_g_header) != 0) {
983 eof_fatal = 1;
984 }
985 }
986 }
987
988 /*
989 * Return true if block checksum is correct.
990 */
991 static int
checksum(struct archive_read * a,const void * h)992 checksum(struct archive_read *a, const void *h)
993 {
994 const unsigned char *bytes;
995 const struct archive_entry_header_ustar *header;
996 int check, sum;
997 size_t i;
998
999 (void)a; /* UNUSED */
1000 bytes = (const unsigned char *)h;
1001 header = (const struct archive_entry_header_ustar *)h;
1002
1003 /* Checksum field must hold an octal number */
1004 for (i = 0; i < sizeof(header->checksum); ++i) {
1005 char c = header->checksum[i];
1006 if (c != ' ' && c != '\0' && (c < '0' || c > '7'))
1007 return 0;
1008 }
1009
1010 /*
1011 * Test the checksum. Note that POSIX specifies _unsigned_
1012 * bytes for this calculation.
1013 */
1014 sum = (int)tar_atol(header->checksum, sizeof(header->checksum));
1015 check = 0;
1016 for (i = 0; i < 148; i++)
1017 check += (unsigned char)bytes[i];
1018 for (; i < 156; i++)
1019 check += 32;
1020 for (; i < 512; i++)
1021 check += (unsigned char)bytes[i];
1022 if (sum == check)
1023 return (1);
1024
1025 /*
1026 * Repeat test with _signed_ bytes, just in case this archive
1027 * was created by an old BSD, Solaris, or HP-UX tar with a
1028 * broken checksum calculation.
1029 */
1030 check = 0;
1031 for (i = 0; i < 148; i++)
1032 check += (signed char)bytes[i];
1033 for (; i < 156; i++)
1034 check += 32;
1035 for (; i < 512; i++)
1036 check += (signed char)bytes[i];
1037 if (sum == check)
1038 return (1);
1039
1040 #if DONT_FAIL_ON_CRC_ERROR
1041 /* Speed up fuzzing by pretending the checksum is always right. */
1042 return (1);
1043 #else
1044 return (0);
1045 #endif
1046 }
1047
1048 /*
1049 * Return true if this block contains only nulls.
1050 */
1051 static int
archive_block_is_null(const char * p)1052 archive_block_is_null(const char *p)
1053 {
1054 unsigned i;
1055
1056 for (i = 0; i < 512; i++)
1057 if (*p++)
1058 return (0);
1059 return (1);
1060 }
1061
1062 /*
1063 * Interpret 'A' Solaris ACL header
1064 */
1065 static int
header_Solaris_ACL(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1066 header_Solaris_ACL(struct archive_read *a, struct tar *tar,
1067 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1068 {
1069 struct archive_string acl_text;
1070 size_t size;
1071 int err, acl_type;
1072 uint64_t type;
1073 char *acl, *p;
1074
1075 archive_string_init(&acl_text);
1076 err = read_body_to_string(a, tar, &acl_text, h, unconsumed);
1077 if (err != ARCHIVE_OK) {
1078 archive_string_free(&acl_text);
1079 return (err);
1080 }
1081 size = archive_strlen(&acl_text);
1082
1083 /* TODO: Examine the first characters to see if this
1084 * is an AIX ACL descriptor. We'll likely never support
1085 * them, but it would be polite to recognize and warn when
1086 * we do see them. */
1087
1088 /* Leading octal number indicates ACL type and number of entries. */
1089 p = acl = acl_text.s;
1090 type = 0;
1091 while (*p != '\0' && p < acl + size) {
1092 if (*p < '0' || *p > '7') {
1093 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1094 "Malformed Solaris ACL attribute (invalid digit)");
1095 archive_string_free(&acl_text);
1096 return(ARCHIVE_WARN);
1097 }
1098 type <<= 3;
1099 type += *p - '0';
1100 if (type > 077777777) {
1101 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1102 "Malformed Solaris ACL attribute (count too large)");
1103 archive_string_free(&acl_text);
1104 return (ARCHIVE_WARN);
1105 }
1106 p++;
1107 }
1108 switch (type & ~0777777) {
1109 case 01000000:
1110 /* POSIX.1e ACL */
1111 acl_type = ARCHIVE_ENTRY_ACL_TYPE_ACCESS;
1112 break;
1113 case 03000000:
1114 /* NFSv4 ACL */
1115 acl_type = ARCHIVE_ENTRY_ACL_TYPE_NFS4;
1116 break;
1117 default:
1118 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1119 "Malformed Solaris ACL attribute (unsupported type %llu)",
1120 (unsigned long long)type);
1121 archive_string_free(&acl_text);
1122 return (ARCHIVE_WARN);
1123 }
1124 p++;
1125
1126 if (p >= acl + size) {
1127 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1128 "Malformed Solaris ACL attribute (body overflow)");
1129 archive_string_free(&acl_text);
1130 return(ARCHIVE_WARN);
1131 }
1132
1133 /* ACL text is null-terminated; find the end. */
1134 size -= (p - acl);
1135 acl = p;
1136
1137 while (*p != '\0' && p < acl + size)
1138 p++;
1139
1140 if (tar->sconv_acl == NULL) {
1141 tar->sconv_acl = archive_string_conversion_from_charset(
1142 &(a->archive), "UTF-8", 1);
1143 if (tar->sconv_acl == NULL) {
1144 archive_string_free(&acl_text);
1145 return (ARCHIVE_FATAL);
1146 }
1147 }
1148 archive_strncpy(&(tar->localname), acl, p - acl);
1149 err = archive_acl_from_text_l(archive_entry_acl(entry),
1150 tar->localname.s, acl_type, tar->sconv_acl);
1151 /* Workaround: Force perm_is_set() to be correct */
1152 /* If this bit were stored in the ACL, this wouldn't be needed */
1153 archive_entry_set_perm(entry, archive_entry_perm(entry));
1154 if (err != ARCHIVE_OK) {
1155 if (errno == ENOMEM) {
1156 archive_set_error(&a->archive, ENOMEM,
1157 "Can't allocate memory for ACL");
1158 } else
1159 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1160 "Malformed Solaris ACL attribute (unparsable)");
1161 }
1162 archive_string_free(&acl_text);
1163 return (err);
1164 }
1165
1166 /*
1167 * Interpret 'K' long linkname header.
1168 */
1169 static int
header_gnu_longlink(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1170 header_gnu_longlink(struct archive_read *a, struct tar *tar,
1171 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1172 {
1173 int err;
1174
1175 struct archive_string linkpath;
1176 archive_string_init(&linkpath);
1177 err = read_body_to_string(a, tar, &linkpath, h, unconsumed);
1178 if (err == ARCHIVE_OK) {
1179 archive_entry_set_link(entry, linkpath.s);
1180 }
1181 archive_string_free(&linkpath);
1182 return (err);
1183 }
1184
1185 static int
set_conversion_failed_error(struct archive_read * a,struct archive_string_conv * sconv,const char * name)1186 set_conversion_failed_error(struct archive_read *a,
1187 struct archive_string_conv *sconv, const char *name)
1188 {
1189 if (errno == ENOMEM) {
1190 archive_set_error(&a->archive, ENOMEM,
1191 "Can't allocate memory for %s", name);
1192 return (ARCHIVE_FATAL);
1193 }
1194 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1195 "%s can't be converted from %s to current locale",
1196 name, archive_string_conversion_charset_name(sconv));
1197 return (ARCHIVE_WARN);
1198 }
1199
1200 /*
1201 * Interpret 'L' long filename header.
1202 */
1203 static int
header_gnu_longname(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1204 header_gnu_longname(struct archive_read *a, struct tar *tar,
1205 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1206 {
1207 int err;
1208 struct archive_string longname;
1209
1210 archive_string_init(&longname);
1211 err = read_body_to_string(a, tar, &longname, h, unconsumed);
1212 if (err == ARCHIVE_OK) {
1213 if (archive_entry_copy_pathname_l(entry, longname.s,
1214 archive_strlen(&longname), tar->sconv) != 0)
1215 err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1216 }
1217 archive_string_free(&longname);
1218 return (err);
1219 }
1220
1221 /*
1222 * Interpret 'V' GNU tar volume header.
1223 */
1224 static int
header_volume(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1225 header_volume(struct archive_read *a, struct tar *tar,
1226 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1227 {
1228 const struct archive_entry_header_ustar *header;
1229 int64_t size, to_consume;
1230
1231 (void)a; /* UNUSED */
1232 (void)tar; /* UNUSED */
1233 (void)entry; /* UNUSED */
1234
1235 header = (const struct archive_entry_header_ustar *)h;
1236 size = tar_atol(header->size, sizeof(header->size));
1237 if (size < 0 || size > (int64_t)pathname_limit) {
1238 return (ARCHIVE_FATAL);
1239 }
1240 to_consume = ((size + 511) & ~511);
1241 *unconsumed += to_consume;
1242 return (ARCHIVE_OK);
1243 }
1244
1245 /*
1246 * Read the next `size` bytes into the provided string.
1247 * Null-terminate the string.
1248 */
1249 static int
read_bytes_to_string(struct archive_read * a,struct archive_string * as,size_t size,int64_t * unconsumed)1250 read_bytes_to_string(struct archive_read *a,
1251 struct archive_string *as, size_t size,
1252 int64_t *unconsumed) {
1253 const void *src;
1254
1255 /* Fail if we can't make our buffer big enough. */
1256 if (archive_string_ensure(as, size + 1) == NULL) {
1257 archive_set_error(&a->archive, ENOMEM,
1258 "No memory");
1259 return (ARCHIVE_FATAL);
1260 }
1261
1262 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1263 return (ARCHIVE_FATAL);
1264 }
1265
1266 /* Read the body into the string. */
1267 src = __archive_read_ahead(a, size, NULL);
1268 if (src == NULL) {
1269 archive_set_error(&a->archive, EINVAL,
1270 "Truncated archive"
1271 " detected while reading metadata");
1272 *unconsumed = 0;
1273 return (ARCHIVE_FATAL);
1274 }
1275 memcpy(as->s, src, size);
1276 as->s[size] = '\0';
1277 as->length = size;
1278 *unconsumed += size;
1279 return (ARCHIVE_OK);
1280 }
1281
1282 /*
1283 * Read body of an archive entry into an archive_string object.
1284 */
1285 static int
read_body_to_string(struct archive_read * a,struct tar * tar,struct archive_string * as,const void * h,int64_t * unconsumed)1286 read_body_to_string(struct archive_read *a, struct tar *tar,
1287 struct archive_string *as, const void *h, int64_t *unconsumed)
1288 {
1289 int64_t size;
1290 const struct archive_entry_header_ustar *header;
1291 int r;
1292
1293 (void)tar; /* UNUSED */
1294 header = (const struct archive_entry_header_ustar *)h;
1295 size = tar_atol(header->size, sizeof(header->size));
1296 if (size < 0 || size > entry_limit) {
1297 archive_set_error(&a->archive, EINVAL,
1298 "Special header has invalid size: %lld",
1299 (long long)size);
1300 return (ARCHIVE_FATAL);
1301 }
1302 if (size > (int64_t)pathname_limit) {
1303 archive_string_empty(as);
1304 int64_t to_consume = ((size + 511) & ~511);
1305 if (to_consume != __archive_read_consume(a, to_consume)) {
1306 return (ARCHIVE_FATAL);
1307 }
1308 archive_set_error(&a->archive, EINVAL,
1309 "Special header too large: %lld > 1MiB",
1310 (long long)size);
1311 return (ARCHIVE_WARN);
1312 }
1313 r = read_bytes_to_string(a, as, size, unconsumed);
1314 *unconsumed += 0x1ff & (-size);
1315 return(r);
1316 }
1317
1318 /*
1319 * Parse out common header elements.
1320 *
1321 * This would be the same as header_old_tar, except that the
1322 * filename is handled slightly differently for old and POSIX
1323 * entries (POSIX entries support a 'prefix'). This factoring
1324 * allows header_old_tar and header_ustar
1325 * to handle filenames differently, while still putting most of the
1326 * common parsing into one place.
1327 *
1328 * This is called _after_ ustar, GNU tar, Schily, etc, special
1329 * fields have already been parsed into the `tar` structure.
1330 * So we can make final decisions here about how to reconcile
1331 * size, mode, etc, information.
1332 */
1333 static int
header_common(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1334 header_common(struct archive_read *a, struct tar *tar,
1335 struct archive_entry *entry, const void *h)
1336 {
1337 const struct archive_entry_header_ustar *header;
1338 const char *existing_linkpath;
1339 const wchar_t *existing_wcs_linkpath;
1340 mode_t header_mode;
1341 int err = ARCHIVE_OK;
1342
1343 header = (const struct archive_entry_header_ustar *)h;
1344
1345 /* Parse out the numeric fields (all are octal) */
1346
1347 /* Split mode handling: Set filetype always, perm only if not already set */
1348 header_mode = (mode_t)tar_atol(header->mode, sizeof(header->mode));
1349 archive_entry_set_filetype(entry, header_mode);
1350 if (!archive_entry_perm_is_set(entry))
1351 archive_entry_set_perm(entry, header_mode);
1352
1353 /* Set uid, gid, mtime if not already set */
1354 if (!archive_entry_uid_is_set(entry)) {
1355 archive_entry_set_uid(entry, tar_atol(header->uid, sizeof(header->uid)));
1356 }
1357 if (!archive_entry_gid_is_set(entry)) {
1358 archive_entry_set_gid(entry, tar_atol(header->gid, sizeof(header->gid)));
1359 }
1360 if (!archive_entry_mtime_is_set(entry)) {
1361 int64_t t64 = tar_atol(header->mtime, sizeof(header->mtime));
1362 time_t t = (time_t)t64;
1363 if ((int64_t)t != t64) { /* time_t overflowed */
1364 t = TIME_MAX;
1365 }
1366 archive_entry_set_mtime(entry, t, 0);
1367 }
1368
1369 /* Reconcile the size info. */
1370 /* First, how big is the file on disk? */
1371 if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_REALSIZE) != 0) {
1372 /* GNU sparse format 1.0 uses `GNU.sparse.realsize`
1373 * to hold the size of the file on disk. */
1374 tar->disk_size = tar->GNU_sparse_realsize;
1375 } else if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_SIZE) != 0
1376 && (tar->sparse_gnu_major == 0)) {
1377 /* GNU sparse format 0.0 and 0.1 use `GNU.sparse.size`
1378 * to hold the size of the file on disk. */
1379 tar->disk_size = tar->GNU_sparse_size;
1380 } else if ((tar->size_fields & TAR_SIZE_SCHILY_SPARSE_REALSIZE) != 0) {
1381 tar->disk_size = tar->SCHILY_sparse_realsize;
1382 } else if ((tar->size_fields & TAR_SIZE_PAX_SIZE) != 0) {
1383 tar->disk_size = tar->pax_size;
1384 } else {
1385 /* There wasn't a suitable pax header, so use the ustar info */
1386 tar->disk_size = tar_atol(header->size, sizeof(header->size));
1387 }
1388
1389 if (tar->disk_size < 0) {
1390 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1391 "Tar entry has negative file size");
1392 return (ARCHIVE_FATAL);
1393 } else if (tar->disk_size > entry_limit) {
1394 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1395 "Tar entry size overflow");
1396 return (ARCHIVE_FATAL);
1397 } else {
1398 archive_entry_set_size(entry, tar->disk_size);
1399 }
1400
1401 /* Second, how big is the data in the archive? */
1402 if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_SIZE) != 0
1403 && (tar->sparse_gnu_major == 1)) {
1404 /* GNU sparse format 1.0 uses `GNU.sparse.size`
1405 * to hold the size of the data in the archive. */
1406 tar->entry_bytes_remaining = tar->GNU_sparse_size;
1407 } else if ((tar->size_fields & TAR_SIZE_PAX_SIZE) != 0) {
1408 tar->entry_bytes_remaining = tar->pax_size;
1409 } else {
1410 tar->entry_bytes_remaining
1411 = tar_atol(header->size, sizeof(header->size));
1412 }
1413 if (tar->entry_bytes_remaining < 0) {
1414 tar->entry_bytes_remaining = 0;
1415 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1416 "Tar entry has negative size");
1417 return (ARCHIVE_FATAL);
1418 } else if (tar->entry_bytes_remaining > entry_limit) {
1419 tar->entry_bytes_remaining = 0;
1420 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1421 "Tar entry size overflow");
1422 return (ARCHIVE_FATAL);
1423 }
1424
1425 /* Handle the tar type flag appropriately. */
1426 tar->filetype = header->typeflag[0];
1427
1428 /*
1429 * TODO: If the linkpath came from Pax extension header, then
1430 * we should obey the hdrcharset_utf8 flag when converting these.
1431 */
1432 switch (tar->filetype) {
1433 case '1': /* Hard link */
1434 archive_entry_set_link_to_hardlink(entry);
1435 existing_wcs_linkpath = archive_entry_hardlink_w(entry);
1436 existing_linkpath = archive_entry_hardlink(entry);
1437 if ((existing_linkpath == NULL || existing_linkpath[0] == '\0')
1438 && (existing_wcs_linkpath == NULL || existing_wcs_linkpath[0] == '\0')) {
1439 struct archive_string linkpath;
1440 archive_string_init(&linkpath);
1441 archive_strncpy(&linkpath,
1442 header->linkname, sizeof(header->linkname));
1443 if (archive_entry_copy_hardlink_l(entry, linkpath.s,
1444 archive_strlen(&linkpath), tar->sconv) != 0) {
1445 err = set_conversion_failed_error(a, tar->sconv,
1446 "Linkname");
1447 if (err == ARCHIVE_FATAL) {
1448 archive_string_free(&linkpath);
1449 return (err);
1450 }
1451 }
1452 archive_string_free(&linkpath);
1453 }
1454 /*
1455 * The following may seem odd, but: Technically, tar
1456 * does not store the file type for a "hard link"
1457 * entry, only the fact that it is a hard link. So, I
1458 * leave the type zero normally. But, pax interchange
1459 * format allows hard links to have data, which
1460 * implies that the underlying entry is a regular
1461 * file.
1462 */
1463 if (archive_entry_size(entry) > 0)
1464 archive_entry_set_filetype(entry, AE_IFREG);
1465
1466 /*
1467 * A tricky point: Traditionally, tar readers have
1468 * ignored the size field when reading hardlink
1469 * entries, and some writers put non-zero sizes even
1470 * though the body is empty. POSIX blessed this
1471 * convention in the 1988 standard, but broke with
1472 * this tradition in 2001 by permitting hardlink
1473 * entries to store valid bodies in pax interchange
1474 * format, but not in ustar format. Since there is no
1475 * hard and fast way to distinguish pax interchange
1476 * from earlier archives (the 'x' and 'g' entries are
1477 * optional, after all), we need a heuristic.
1478 */
1479 if (archive_entry_size(entry) == 0) {
1480 /* If the size is already zero, we're done. */
1481 } else if (a->archive.archive_format
1482 == ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE) {
1483 /* Definitely pax extended; must obey hardlink size. */
1484 } else if (a->archive.archive_format == ARCHIVE_FORMAT_TAR
1485 || a->archive.archive_format == ARCHIVE_FORMAT_TAR_GNUTAR)
1486 {
1487 /* Old-style or GNU tar: we must ignore the size. */
1488 archive_entry_set_size(entry, 0);
1489 tar->entry_bytes_remaining = 0;
1490 } else if (archive_read_format_tar_bid(a, 50) > 50) {
1491 /*
1492 * We don't know if it's pax: If the bid
1493 * function sees a valid ustar header
1494 * immediately following, then let's ignore
1495 * the hardlink size.
1496 */
1497 archive_entry_set_size(entry, 0);
1498 tar->entry_bytes_remaining = 0;
1499 }
1500 /*
1501 * TODO: There are still two cases I'd like to handle:
1502 * = a ustar non-pax archive with a hardlink entry at
1503 * end-of-archive. (Look for block of nulls following?)
1504 * = a pax archive that has not seen any pax headers
1505 * and has an entry which is a hardlink entry storing
1506 * a body containing an uncompressed tar archive.
1507 * The first is worth addressing; I don't see any reliable
1508 * way to deal with the second possibility.
1509 */
1510 break;
1511 case '2': /* Symlink */
1512 archive_entry_set_link_to_symlink(entry);
1513 existing_wcs_linkpath = archive_entry_symlink_w(entry);
1514 existing_linkpath = archive_entry_symlink(entry);
1515 if ((existing_linkpath == NULL || existing_linkpath[0] == '\0')
1516 && (existing_wcs_linkpath == NULL || existing_wcs_linkpath[0] == '\0')) {
1517 struct archive_string linkpath;
1518 archive_string_init(&linkpath);
1519 archive_strncpy(&linkpath,
1520 header->linkname, sizeof(header->linkname));
1521 if (archive_entry_copy_symlink_l(entry, linkpath.s,
1522 archive_strlen(&linkpath), tar->sconv) != 0) {
1523 err = set_conversion_failed_error(a, tar->sconv,
1524 "Linkname");
1525 if (err == ARCHIVE_FATAL) {
1526 archive_string_free(&linkpath);
1527 return (err);
1528 }
1529 }
1530 archive_string_free(&linkpath);
1531 }
1532 archive_entry_set_filetype(entry, AE_IFLNK);
1533 archive_entry_set_size(entry, 0);
1534 tar->entry_bytes_remaining = 0;
1535 break;
1536 case '3': /* Character device */
1537 archive_entry_set_filetype(entry, AE_IFCHR);
1538 archive_entry_set_size(entry, 0);
1539 tar->entry_bytes_remaining = 0;
1540 break;
1541 case '4': /* Block device */
1542 archive_entry_set_filetype(entry, AE_IFBLK);
1543 archive_entry_set_size(entry, 0);
1544 tar->entry_bytes_remaining = 0;
1545 break;
1546 case '5': /* Dir */
1547 archive_entry_set_filetype(entry, AE_IFDIR);
1548 archive_entry_set_size(entry, 0);
1549 tar->entry_bytes_remaining = 0;
1550 break;
1551 case '6': /* FIFO device */
1552 archive_entry_set_filetype(entry, AE_IFIFO);
1553 archive_entry_set_size(entry, 0);
1554 tar->entry_bytes_remaining = 0;
1555 break;
1556 case 'D': /* GNU incremental directory type */
1557 /*
1558 * No special handling is actually required here.
1559 * It might be nice someday to preprocess the file list and
1560 * provide it to the client, though.
1561 */
1562 archive_entry_set_filetype(entry, AE_IFDIR);
1563 break;
1564 case 'M': /* GNU "Multi-volume" (remainder of file from last archive)*/
1565 /*
1566 * As far as I can tell, this is just like a regular file
1567 * entry, except that the contents should be _appended_ to
1568 * the indicated file at the indicated offset. This may
1569 * require some API work to fully support.
1570 */
1571 break;
1572 case 'N': /* Old GNU "long filename" entry. */
1573 /* The body of this entry is a script for renaming
1574 * previously-extracted entries. Ugh. It will never
1575 * be supported by libarchive. */
1576 archive_entry_set_filetype(entry, AE_IFREG);
1577 break;
1578 case 'S': /* GNU sparse files */
1579 /*
1580 * Sparse files are really just regular files with
1581 * sparse information in the extended area.
1582 */
1583 /* FALLTHROUGH */
1584 case '0': /* ustar "regular" file */
1585 /* FALLTHROUGH */
1586 default: /* Non-standard file types */
1587 /*
1588 * Per POSIX: non-recognized types should always be
1589 * treated as regular files.
1590 */
1591 archive_entry_set_filetype(entry, AE_IFREG);
1592 break;
1593 }
1594 return (err);
1595 }
1596
1597 /*
1598 * Parse out header elements for "old-style" tar archives.
1599 */
1600 static int
header_old_tar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1601 header_old_tar(struct archive_read *a, struct tar *tar,
1602 struct archive_entry *entry, const void *h)
1603 {
1604 const struct archive_entry_header_ustar *header;
1605 int err = ARCHIVE_OK, err2;
1606
1607 /*
1608 * Copy filename over (to ensure null termination).
1609 * Skip if pathname was already set e.g. by header_gnu_longname()
1610 */
1611 header = (const struct archive_entry_header_ustar *)h;
1612
1613 const char *existing_pathname = archive_entry_pathname(entry);
1614 const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
1615 if ((existing_pathname == NULL || existing_pathname[0] == '\0')
1616 && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == '\0') &&
1617 archive_entry_copy_pathname_l(entry,
1618 header->name, sizeof(header->name), tar->sconv) != 0) {
1619 err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1620 if (err == ARCHIVE_FATAL)
1621 return (err);
1622 }
1623
1624 /* Grab rest of common fields */
1625 err2 = header_common(a, tar, entry, h);
1626 if (err > err2)
1627 err = err2;
1628
1629 tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
1630 return (err);
1631 }
1632
1633 /*
1634 * Is this likely an AppleDouble extension?
1635 */
1636 static int
is_mac_metadata_entry(struct archive_entry * entry)1637 is_mac_metadata_entry(struct archive_entry *entry) {
1638 const char *p, *name;
1639 const wchar_t *wp, *wname;
1640
1641 name = p = archive_entry_pathname(entry);
1642 if (p != NULL) {
1643 /* Find the last path element. */
1644 for (; *p != '\0'; ++p) {
1645 if (p[0] == '/' && p[1] != '\0')
1646 name = p + 1;
1647 }
1648 /*
1649 * If last path element starts with "._", then
1650 * this is a Mac extension.
1651 */
1652 if (name[0] == '.' && name[1] == '_' && name[2] != '\0')
1653 return 1;
1654 } else {
1655 /* Find the last path element. */
1656 wname = wp = archive_entry_pathname_w(entry);
1657 if (wp == NULL)
1658 return 0;
1659 for (; *wp != L'\0'; ++wp) {
1660 if (wp[0] == L'/' && wp[1] != L'\0')
1661 wname = wp + 1;
1662 }
1663 /*
1664 * If last path element starts with "._", then
1665 * this is a Mac extension.
1666 */
1667 if (wname[0] == L'.' && wname[1] == L'_' && wname[2] != L'\0')
1668 return 1;
1669 }
1670 /* Not a mac extension */
1671 return 0;
1672 }
1673
1674 /*
1675 * Read a Mac AppleDouble-encoded blob of file metadata,
1676 * if there is one.
1677 *
1678 * TODO: In Libarchive 4, we should consider ripping this
1679 * out -- instead, return a file starting with `._` as
1680 * a regular file and let the client (or archive_write logic)
1681 * handle it.
1682 */
1683 static int
read_mac_metadata_blob(struct archive_read * a,struct archive_entry * entry,int64_t * unconsumed)1684 read_mac_metadata_blob(struct archive_read *a,
1685 struct archive_entry *entry, int64_t *unconsumed)
1686 {
1687 int64_t size;
1688 size_t msize;
1689 const void *data;
1690
1691 /* Read the body as a Mac OS metadata blob. */
1692 size = archive_entry_size(entry);
1693 msize = (size_t)size;
1694 if (size < 0 || (uintmax_t)msize != (uintmax_t)size) {
1695 *unconsumed = 0;
1696 return (ARCHIVE_FATAL);
1697 }
1698
1699 /* TODO: Should this merely skip the overlarge entry and
1700 * WARN? Or is xattr_limit sufficiently large that we can
1701 * safely assume anything larger is malicious? */
1702 if (size > (int64_t)xattr_limit) {
1703 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1704 "Oversized AppleDouble extension has size %llu > %llu",
1705 (unsigned long long)size,
1706 (unsigned long long)xattr_limit);
1707 return (ARCHIVE_FATAL);
1708 }
1709
1710 /*
1711 * TODO: Look beyond the body here to peek at the next header.
1712 * If it's a regular header (not an extension header)
1713 * that has the wrong name, just return the current
1714 * entry as-is, without consuming the body here.
1715 * That would reduce the risk of us mis-identifying
1716 * an ordinary file that just happened to have
1717 * a name starting with "._".
1718 *
1719 * Q: Is the above idea really possible? Even
1720 * when there are GNU or pax extension entries?
1721 */
1722 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1723 return (ARCHIVE_FATAL);
1724 }
1725 data = __archive_read_ahead(a, msize, NULL);
1726 if (data == NULL) {
1727 archive_set_error(&a->archive, EINVAL,
1728 "Truncated archive"
1729 " detected while reading macOS metadata");
1730 *unconsumed = 0;
1731 return (ARCHIVE_FATAL);
1732 }
1733 archive_entry_clear(entry);
1734 archive_entry_copy_mac_metadata(entry, data, msize);
1735 *unconsumed = (msize + 511) & ~ 511;
1736 return (ARCHIVE_OK);
1737 }
1738
1739 /*
1740 * Parse a file header for a pax extended archive entry.
1741 */
1742 static int
header_pax_global(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1743 header_pax_global(struct archive_read *a, struct tar *tar,
1744 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1745 {
1746 const struct archive_entry_header_ustar *header;
1747 int64_t size, to_consume;
1748
1749 (void)tar; /* UNUSED */
1750 (void)entry; /* UNUSED */
1751
1752 header = (const struct archive_entry_header_ustar *)h;
1753 size = tar_atol(header->size, sizeof(header->size));
1754 if (size < 0 || size > entry_limit) {
1755 archive_set_error(&a->archive, EINVAL,
1756 "Special header has invalid size: %lld",
1757 (long long)size);
1758 return (ARCHIVE_FATAL);
1759 }
1760 if (size == 0) {
1761 archive_set_error(&a->archive, EINVAL,
1762 "Invalid empty pax global extended header");
1763 return (ARCHIVE_FATAL);
1764 }
1765 to_consume = ((size + 511) & ~511);
1766 *unconsumed += to_consume;
1767 return (ARCHIVE_OK);
1768 }
1769
1770 /*
1771 * Parse a file header for a Posix "ustar" archive entry. This also
1772 * handles "pax" or "extended ustar" entries.
1773 *
1774 * In order to correctly handle pax attributes (which precede this),
1775 * we have to skip parsing any field for which the entry already has
1776 * contents.
1777 */
1778 static int
header_ustar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1779 header_ustar(struct archive_read *a, struct tar *tar,
1780 struct archive_entry *entry, const void *h)
1781 {
1782 const struct archive_entry_header_ustar *header;
1783 int err = ARCHIVE_OK, r;
1784
1785 header = (const struct archive_entry_header_ustar *)h;
1786
1787 /*
1788 * The name field is fixed-width and may not be NUL-terminated.
1789 * Use a temporary string only when prefix/name joining is required.
1790 */
1791 const char *existing_pathname = archive_entry_pathname(entry);
1792 const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
1793 if ((existing_pathname == NULL || existing_pathname[0] == '\0')
1794 && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == '\0')) {
1795 struct archive_string as;
1796 const char *pathname;
1797 size_t pathname_length;
1798
1799 archive_string_init(&as);
1800 if (header->prefix[0]) {
1801 archive_strncpy(&as, header->prefix, sizeof(header->prefix));
1802 if (as.s[archive_strlen(&as) - 1] != '/')
1803 archive_strappend_char(&as, '/');
1804 archive_strncat(&as, header->name, sizeof(header->name));
1805 pathname = as.s;
1806 pathname_length = archive_strlen(&as);
1807 } else {
1808 pathname = header->name;
1809 pathname_length = sizeof(header->name);
1810 }
1811 r = archive_entry_copy_pathname_l(entry, pathname,
1812 pathname_length, tar->sconv);
1813 archive_string_free(&as);
1814 if (r != 0) {
1815 err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1816 if (err == ARCHIVE_FATAL)
1817 return (err);
1818 }
1819 }
1820
1821 /* Handle rest of common fields. */
1822 r = header_common(a, tar, entry, h);
1823 if (r == ARCHIVE_FATAL)
1824 return (r);
1825 if (r < err)
1826 err = r;
1827
1828 /* Handle POSIX ustar fields. */
1829 const char *existing_uname = archive_entry_uname(entry);
1830 if (existing_uname == NULL || existing_uname[0] == '\0') {
1831 if (archive_entry_copy_uname_l(entry,
1832 header->uname, sizeof(header->uname), tar->sconv) != 0) {
1833 err = set_conversion_failed_error(a, tar->sconv, "Uname");
1834 if (err == ARCHIVE_FATAL)
1835 return (err);
1836 }
1837 }
1838
1839 const char *existing_gname = archive_entry_gname(entry);
1840 if (existing_gname == NULL || existing_gname[0] == '\0') {
1841 if (archive_entry_copy_gname_l(entry,
1842 header->gname, sizeof(header->gname), tar->sconv) != 0) {
1843 err = set_conversion_failed_error(a, tar->sconv, "Gname");
1844 if (err == ARCHIVE_FATAL)
1845 return (err);
1846 }
1847 }
1848
1849 /* Parse out device numbers only for char and block specials. */
1850 if (header->typeflag[0] == '3' || header->typeflag[0] == '4') {
1851 if (!archive_entry_rdev_is_set(entry)) {
1852 archive_entry_set_rdevmajor(entry, (dev_t)
1853 tar_atol(header->rdevmajor, sizeof(header->rdevmajor)));
1854 archive_entry_set_rdevminor(entry, (dev_t)
1855 tar_atol(header->rdevminor, sizeof(header->rdevminor)));
1856 }
1857 } else {
1858 archive_entry_set_rdev(entry, 0);
1859 }
1860
1861 tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
1862
1863 return (err);
1864 }
1865
1866 static int
header_pax_extension(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1867 header_pax_extension(struct archive_read *a, struct tar *tar,
1868 struct archive_entry *entry, const void *h, int64_t *unconsumed)
1869 {
1870 /* Sanity checks: The largest `x` body I've ever heard of was
1871 * a little over 4MB. So I doubt there has ever been a
1872 * well-formed archive with an `x` body over 1GiB. Similarly,
1873 * it seems plausible that no single attribute has ever been
1874 * larger than 100MB. So if we see a larger value here, it's
1875 * almost certainly a sign of a corrupted/malicious archive. */
1876
1877 /* Maximum sane size for extension body: 1 GiB */
1878 /* This cannot be raised to larger than 8GiB without
1879 * exceeding the maximum size for a standard ustar
1880 * entry. */
1881 const int64_t ext_size_limit = 1024 * 1024 * (int64_t)1024;
1882 /* Maximum size for a single line/attr: 100 million characters */
1883 /* This cannot be raised to more than 2GiB without exceeding
1884 * a `size_t` on 32-bit platforms. */
1885 const size_t max_parsed_line_length = 99999999ULL;
1886 /* Largest attribute prolog: size + name. */
1887 const size_t max_size_name = 512;
1888
1889 /* Size and padding of the full extension body */
1890 int64_t ext_size, ext_padding;
1891 size_t line_length, value_length, name_length;
1892 ssize_t to_read, did_read;
1893 const struct archive_entry_header_ustar *header;
1894 const char *p, *attr_start, *name_start;
1895 struct archive_string_conv *sconv;
1896 struct archive_string *pas = NULL;
1897 struct archive_string attr_name;
1898 int err = ARCHIVE_OK, r;
1899
1900 header = (const struct archive_entry_header_ustar *)h;
1901 ext_size = tar_atol(header->size, sizeof(header->size));
1902 if (ext_size > entry_limit) {
1903 return (ARCHIVE_FATAL);
1904 }
1905 if (ext_size < 0) {
1906 archive_set_error(&a->archive, EINVAL,
1907 "pax extension header has invalid size: %lld",
1908 (long long)ext_size);
1909 return (ARCHIVE_FATAL);
1910 }
1911 if (ext_size == 0) {
1912 archive_set_error(&a->archive, EINVAL,
1913 "Invalid empty pax extended header");
1914 return (ARCHIVE_FATAL);
1915 }
1916
1917 ext_padding = 0x1ff & (-ext_size);
1918 if (ext_size > ext_size_limit) {
1919 /* Consume the pax extension body and return an error */
1920 if (ext_size + ext_padding != __archive_read_consume(a, ext_size + ext_padding)) {
1921 return (ARCHIVE_FATAL);
1922 }
1923 archive_set_error(&a->archive, EINVAL,
1924 "Ignoring oversized pax extensions: %lld > %lld",
1925 (long long)ext_size, (long long)ext_size_limit);
1926 return (ARCHIVE_WARN);
1927 }
1928 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1929 return (ARCHIVE_FATAL);
1930 }
1931
1932 /* Parse the size/name of each pax attribute in the body */
1933 archive_string_init(&attr_name);
1934 while (ext_size > 0) {
1935 /* Read enough bytes to parse the size/name of the next attribute */
1936 to_read = max_size_name;
1937 if (to_read > ext_size) {
1938 to_read = ext_size;
1939 }
1940 p = __archive_read_ahead(a, to_read, &did_read);
1941 if (p == NULL) { /* EOF */
1942 archive_set_error(&a->archive, EINVAL,
1943 "Truncated tar archive"
1944 " detected while reading pax attribute name");
1945 return (ARCHIVE_FATAL);
1946 }
1947 if (did_read > ext_size) {
1948 did_read = ext_size;
1949 }
1950
1951 /* Parse size of attribute */
1952 line_length = 0;
1953 attr_start = p;
1954 while (1) {
1955 if (p >= attr_start + did_read) {
1956 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1957 "Ignoring malformed pax attributes: overlarge attribute size field");
1958 *unconsumed += ext_size + ext_padding;
1959 return (ARCHIVE_WARN);
1960 }
1961 if (*p == ' ') {
1962 p++;
1963 break;
1964 }
1965 if (*p < '0' || *p > '9') {
1966 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1967 "Ignoring malformed pax attributes: malformed attribute size field");
1968 *unconsumed += ext_size + ext_padding;
1969 return (ARCHIVE_WARN);
1970 }
1971 line_length *= 10;
1972 line_length += *p - '0';
1973 if (line_length > max_parsed_line_length) {
1974 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1975 "Ignoring malformed pax attribute: size > %lld",
1976 (long long)max_parsed_line_length);
1977 *unconsumed += ext_size + ext_padding;
1978 return (ARCHIVE_WARN);
1979 }
1980 p++;
1981 }
1982
1983 if ((int64_t)line_length > ext_size) {
1984 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1985 "Ignoring malformed pax attribute: %lld > %lld",
1986 (long long)line_length, (long long)ext_size);
1987 *unconsumed += ext_size + ext_padding;
1988 return (ARCHIVE_WARN);
1989 }
1990
1991 /* Parse name of attribute */
1992 if (p >= attr_start + did_read
1993 || p >= attr_start + line_length
1994 || *p == '=') {
1995 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1996 "Ignoring malformed pax attributes: empty name found");
1997 *unconsumed += ext_size + ext_padding;
1998 return (ARCHIVE_WARN);
1999 }
2000 name_start = p;
2001 while (1) {
2002 if (p >= attr_start + did_read || p >= attr_start + line_length) {
2003 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2004 "Ignoring malformed pax attributes: overlarge attribute name");
2005 *unconsumed += ext_size + ext_padding;
2006 return (ARCHIVE_WARN);
2007 }
2008 if (*p == '=') {
2009 break;
2010 }
2011 p++;
2012 }
2013 name_length = p - name_start;
2014 p++; // Skip '='
2015
2016 // Save the name before we consume it
2017 archive_strncpy(&attr_name, name_start, name_length);
2018
2019 ext_size -= p - attr_start;
2020 value_length = line_length - (p - attr_start);
2021
2022 /* Consume size, name, and `=` */
2023 *unconsumed += p - attr_start;
2024 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2025 archive_string_free(&attr_name);
2026 return (ARCHIVE_FATAL);
2027 }
2028
2029 if (value_length == 0) {
2030 archive_set_error(&a->archive, EINVAL,
2031 "Malformed pax attributes");
2032 *unconsumed += ext_size + ext_padding;
2033 archive_string_free(&attr_name);
2034 return (ARCHIVE_WARN);
2035 }
2036
2037 /* pax_attribute will consume value_length - 1 */
2038 r = pax_attribute(a, tar, entry, attr_name.s, archive_strlen(&attr_name), value_length - 1, unconsumed);
2039 ext_size -= value_length - 1;
2040
2041 // Release the allocated attr_name (either here or before every return in this function)
2042 archive_string_free(&attr_name);
2043
2044 if (r < ARCHIVE_WARN) {
2045 *unconsumed += ext_size + ext_padding;
2046 return (r);
2047 }
2048 err = err_combine(err, r);
2049
2050 /* Consume the `\n` that follows the pax attribute value. */
2051 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2052 return (ARCHIVE_FATAL);
2053 }
2054 p = __archive_read_ahead(a, 1, &did_read);
2055 if (p == NULL) {
2056 archive_set_error(&a->archive, EINVAL,
2057 "Truncated tar archive"
2058 " detected while completing pax attribute");
2059 return (ARCHIVE_FATAL);
2060 }
2061 if (p[0] != '\n') {
2062 archive_set_error(&a->archive, EINVAL,
2063 "Malformed pax attributes");
2064 *unconsumed += ext_size + ext_padding;
2065 return (ARCHIVE_WARN);
2066 }
2067 ext_size -= 1;
2068 *unconsumed += 1;
2069 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2070 return (ARCHIVE_FATAL);
2071 }
2072 }
2073 *unconsumed += ext_size + ext_padding;
2074
2075 /*
2076 * Some PAX values -- pathname, linkpath, uname, gname --
2077 * can't be copied into the entry until we know the character
2078 * set to use:
2079 */
2080 if (!tar->pax_hdrcharset_utf8)
2081 /* PAX specified "BINARY", so use the default charset */
2082 sconv = tar->opt_sconv;
2083 else {
2084 /* PAX default UTF-8 */
2085 sconv = archive_string_conversion_from_charset(
2086 &(a->archive), "UTF-8", 1);
2087 if (sconv == NULL)
2088 return (ARCHIVE_FATAL);
2089 if (tar->compat_2x)
2090 archive_string_conversion_set_opt(sconv,
2091 SCONV_SET_OPT_UTF8_LIBARCHIVE2X);
2092 }
2093
2094 /* Pathname */
2095 pas = NULL;
2096 if (archive_strlen(&(tar->entry_pathname_override)) > 0) {
2097 /* Prefer GNU.sparse.name attribute if present */
2098 /* GNU sparse files store a fake name under the standard
2099 * "pathname" key. */
2100 pas = &(tar->entry_pathname_override);
2101 } else if (archive_strlen(&(tar->entry_pathname)) > 0) {
2102 /* Use standard "pathname" PAX extension */
2103 pas = &(tar->entry_pathname);
2104 }
2105 if (pas != NULL) {
2106 if (archive_entry_copy_pathname_l(entry, pas->s,
2107 archive_strlen(pas), sconv) != 0) {
2108 err = set_conversion_failed_error(a, sconv, "Pathname");
2109 if (err == ARCHIVE_FATAL)
2110 return (err);
2111 /* Use raw name without conversion */
2112 archive_entry_copy_pathname(entry, pas->s);
2113 }
2114 }
2115 /* Uname */
2116 if (archive_strlen(&(tar->entry_uname)) > 0) {
2117 if (archive_entry_copy_uname_l(entry, tar->entry_uname.s,
2118 archive_strlen(&(tar->entry_uname)), sconv) != 0) {
2119 err = set_conversion_failed_error(a, sconv, "Uname");
2120 if (err == ARCHIVE_FATAL)
2121 return (err);
2122 /* Use raw name without conversion */
2123 archive_entry_copy_uname(entry, tar->entry_uname.s);
2124 }
2125 }
2126 /* Gname */
2127 if (archive_strlen(&(tar->entry_gname)) > 0) {
2128 if (archive_entry_copy_gname_l(entry, tar->entry_gname.s,
2129 archive_strlen(&(tar->entry_gname)), sconv) != 0) {
2130 err = set_conversion_failed_error(a, sconv, "Gname");
2131 if (err == ARCHIVE_FATAL)
2132 return (err);
2133 /* Use raw name without conversion */
2134 archive_entry_copy_gname(entry, tar->entry_gname.s);
2135 }
2136 }
2137 /* Linkpath */
2138 if (archive_strlen(&(tar->entry_linkpath)) > 0) {
2139 if (archive_entry_copy_link_l(entry, tar->entry_linkpath.s,
2140 archive_strlen(&(tar->entry_linkpath)), sconv) != 0) {
2141 err = set_conversion_failed_error(a, sconv, "Linkpath");
2142 if (err == ARCHIVE_FATAL)
2143 return (err);
2144 /* Use raw name without conversion */
2145 archive_entry_copy_link(entry, tar->entry_linkpath.s);
2146 }
2147 }
2148
2149 /* Extension may have given us a corrected `entry_bytes_remaining` for
2150 * the main entry; update the padding appropriately. */
2151 tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
2152 return (err);
2153 }
2154
2155 static int
pax_attribute_LIBARCHIVE_xattr(struct archive_entry * entry,const char * name,size_t name_length,const char * value,size_t value_length)2156 pax_attribute_LIBARCHIVE_xattr(struct archive_entry *entry,
2157 const char *name, size_t name_length, const char *value, size_t value_length)
2158 {
2159 char *name_decoded;
2160 void *value_decoded;
2161 size_t value_len;
2162
2163 if (name_length < 1)
2164 return 3;
2165
2166 /* URL-decode name */
2167 name_decoded = url_decode(name, name_length);
2168 if (name_decoded == NULL)
2169 return 2;
2170
2171 /* Base-64 decode value */
2172 value_decoded = base64_decode(value, value_length, &value_len);
2173 if (value_decoded == NULL) {
2174 free(name_decoded);
2175 return 1;
2176 }
2177
2178 archive_entry_xattr_add_entry(entry, name_decoded,
2179 value_decoded, value_len);
2180
2181 free(name_decoded);
2182 free(value_decoded);
2183 return 0;
2184 }
2185
2186 static int
pax_attribute_SCHILY_xattr(struct archive_entry * entry,const char * name,size_t name_length,const char * value,size_t value_length)2187 pax_attribute_SCHILY_xattr(struct archive_entry *entry,
2188 const char *name, size_t name_length, const char *value, size_t value_length)
2189 {
2190 if (name_length < 1 || name_length > 128) {
2191 return 1;
2192 }
2193
2194 char * null_terminated_name = malloc(name_length + 1);
2195 if (null_terminated_name != NULL) {
2196 memcpy(null_terminated_name, name, name_length);
2197 null_terminated_name[name_length] = '\0';
2198 archive_entry_xattr_add_entry(entry, null_terminated_name, value, value_length);
2199 free(null_terminated_name);
2200 }
2201
2202 return 0;
2203 }
2204
2205 static int
pax_attribute_RHT_security_selinux(struct archive_entry * entry,const char * value,size_t value_length)2206 pax_attribute_RHT_security_selinux(struct archive_entry *entry,
2207 const char *value, size_t value_length)
2208 {
2209 archive_entry_xattr_add_entry(entry, "security.selinux",
2210 value, value_length);
2211
2212 return 0;
2213 }
2214
2215 static int
pax_attribute_SCHILY_acl(struct archive_read * a,struct tar * tar,struct archive_entry * entry,size_t value_length,int type)2216 pax_attribute_SCHILY_acl(struct archive_read *a, struct tar *tar,
2217 struct archive_entry *entry, size_t value_length, int type)
2218 {
2219 int r;
2220 const char *p;
2221 const char* errstr;
2222
2223 switch (type) {
2224 case ARCHIVE_ENTRY_ACL_TYPE_ACCESS:
2225 errstr = "SCHILY.acl.access";
2226 break;
2227 case ARCHIVE_ENTRY_ACL_TYPE_DEFAULT:
2228 errstr = "SCHILY.acl.default";
2229 break;
2230 case ARCHIVE_ENTRY_ACL_TYPE_NFS4:
2231 errstr = "SCHILY.acl.ace";
2232 break;
2233 default:
2234 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2235 "Unknown ACL type: %d", type);
2236 return(ARCHIVE_FATAL);
2237 }
2238
2239 if (tar->sconv_acl == NULL) {
2240 tar->sconv_acl =
2241 archive_string_conversion_from_charset(
2242 &(a->archive), "UTF-8", 1);
2243 if (tar->sconv_acl == NULL)
2244 return (ARCHIVE_FATAL);
2245 }
2246
2247 if (value_length > acl_limit) {
2248 __archive_read_consume(a, value_length);
2249 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2250 "Unreasonably large ACL: %llu > %llu",
2251 (unsigned long long)value_length,
2252 (unsigned long long)acl_limit);
2253 return (ARCHIVE_WARN);
2254 }
2255
2256 p = __archive_read_ahead(a, value_length, NULL);
2257 if (p == NULL) {
2258 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2259 "Truncated tar archive "
2260 "detected while reading ACL data");
2261 return (ARCHIVE_FATAL);
2262 }
2263
2264 r = archive_acl_from_text_nl(archive_entry_acl(entry), p, value_length,
2265 type, tar->sconv_acl);
2266 __archive_read_consume(a, value_length);
2267 /* Workaround: Force perm_is_set() to be correct */
2268 /* If this bit were stored in the ACL, this wouldn't be needed */
2269 archive_entry_set_perm(entry, archive_entry_perm(entry));
2270 if (r != ARCHIVE_OK) {
2271 if (r == ARCHIVE_FATAL) {
2272 archive_set_error(&a->archive, ENOMEM,
2273 "%s %s", "Can't allocate memory for",
2274 errstr);
2275 return (r);
2276 }
2277 archive_set_error(&a->archive,
2278 ARCHIVE_ERRNO_MISC, "%s %s", "Parse error:", errstr);
2279 }
2280 return (r);
2281 }
2282
2283 static int
pax_attribute_read_time(struct archive_read * a,size_t value_length,__LA_TIME_T * ps,long * pn,int64_t * unconsumed)2284 pax_attribute_read_time(struct archive_read *a, size_t value_length, __LA_TIME_T *ps, long *pn, int64_t *unconsumed) {
2285 struct archive_string as;
2286 int r;
2287
2288 if (value_length > 128) {
2289 __archive_read_consume(a, value_length);
2290 *ps = 0;
2291 *pn = 0;
2292 return (ARCHIVE_FATAL);
2293 }
2294
2295 archive_string_init(&as);
2296 r = read_bytes_to_string(a, &as, value_length, unconsumed);
2297 if (r < ARCHIVE_OK) {
2298 archive_string_free(&as);
2299 *ps = 0;
2300 *pn = 0;
2301 return (r);
2302 }
2303
2304 int64_t sec = 0;
2305 pax_time(as.s, archive_strlen(&as), &sec, pn);
2306 archive_string_free(&as);
2307
2308 if (sec == INT64_MIN) {
2309 *ps = 0;
2310 *pn = 0;
2311 return (ARCHIVE_WARN);
2312 } else {
2313 *ps = (__LA_TIME_T)sec;
2314 }
2315 return (ARCHIVE_OK);
2316 }
2317
2318 static int
pax_attribute_read_number(struct archive_read * a,size_t value_length,int64_t * result)2319 pax_attribute_read_number(struct archive_read *a, size_t value_length, int64_t *result) {
2320 struct archive_string as;
2321 int64_t unconsumed = 0;
2322 int r;
2323
2324 if (value_length > 64) {
2325 __archive_read_consume(a, value_length);
2326 *result = 0;
2327 return (ARCHIVE_FATAL);
2328 }
2329
2330 archive_string_init(&as);
2331 r = read_bytes_to_string(a, &as, value_length, &unconsumed);
2332 if (tar_flush_unconsumed(a, &unconsumed) != ARCHIVE_OK) {
2333 *result = 0;
2334 return (ARCHIVE_FATAL);
2335 }
2336 if (r < ARCHIVE_OK) {
2337 archive_string_free(&as);
2338 *result = 0;
2339 return (r);
2340 }
2341
2342 *result = tar_atol10(as.s, archive_strlen(&as));
2343 archive_string_free(&as);
2344 if (*result < 0 || *result == INT64_MAX) {
2345 *result = INT64_MAX;
2346 return (ARCHIVE_WARN);
2347 }
2348 return (ARCHIVE_OK);
2349 }
2350
2351 /*
2352 * Parse a single key=value attribute.
2353 *
2354 * POSIX reserves all-lowercase keywords. Vendor-specific extensions
2355 * should always have keywords of the form "VENDOR.attribute" In
2356 * particular, it's quite feasible to support many different vendor
2357 * extensions here. I'm using "LIBARCHIVE" for extensions unique to
2358 * this library.
2359 *
2360 * TODO: Investigate other vendor-specific extensions and see if
2361 * any of them look useful.
2362 */
2363 static int
pax_attribute(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const char * key,size_t key_length,size_t value_length,int64_t * unconsumed)2364 pax_attribute(struct archive_read *a, struct tar *tar, struct archive_entry *entry,
2365 const char *key, size_t key_length, size_t value_length, int64_t *unconsumed)
2366 {
2367 int64_t t;
2368 long n;
2369 const char *p;
2370 int err = ARCHIVE_OK;
2371
2372 switch (key[0]) {
2373 case 'G':
2374 /* GNU.* extensions */
2375 if (key_length > 4 && memcmp(key, "GNU.", 4) == 0) {
2376 key += 4;
2377 key_length -= 4;
2378
2379 /* GNU.sparse marks the existence of GNU sparse information */
2380 if (key_length == 6 && memcmp(key, "sparse", 6) == 0) {
2381 tar->sparse_gnu_attributes_seen = 1;
2382 }
2383
2384 /* GNU.sparse.* extensions */
2385 else if (key_length > 7 && memcmp(key, "sparse.", 7) == 0) {
2386 tar->sparse_gnu_attributes_seen = 1;
2387 key += 7;
2388 key_length -= 7;
2389
2390 /* GNU "0.0" sparse pax format. */
2391 if (key_length == 9 && memcmp(key, "numblocks", 9) == 0) {
2392 /* GNU.sparse.numblocks */
2393 tar->sparse_offset = -1;
2394 tar->sparse_numbytes = -1;
2395 tar->sparse_gnu_major = 0;
2396 tar->sparse_gnu_minor = 0;
2397 }
2398 else if (key_length == 6 && memcmp(key, "offset", 6) == 0) {
2399 /* GNU.sparse.offset */
2400 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2401 tar->sparse_offset = t;
2402 if (tar->sparse_numbytes != -1) {
2403 if (gnu_add_sparse_entry(a, tar,
2404 tar->sparse_offset, tar->sparse_numbytes)
2405 != ARCHIVE_OK)
2406 return (ARCHIVE_FATAL);
2407 tar->sparse_offset = -1;
2408 tar->sparse_numbytes = -1;
2409 }
2410 }
2411 return (err);
2412 }
2413 else if (key_length == 8 && memcmp(key, "numbytes", 8) == 0) {
2414 /* GNU.sparse.numbytes */
2415 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2416 tar->sparse_numbytes = t;
2417 if (tar->sparse_offset != -1) {
2418 if (gnu_add_sparse_entry(a, tar,
2419 tar->sparse_offset, tar->sparse_numbytes)
2420 != ARCHIVE_OK)
2421 return (ARCHIVE_FATAL);
2422 tar->sparse_offset = -1;
2423 tar->sparse_numbytes = -1;
2424 }
2425 }
2426 return (err);
2427 }
2428 else if (key_length == 4 && memcmp(key, "size", 4) == 0) {
2429 /* GNU.sparse.size */
2430 /* This is either the size of stored entry OR the size of data on disk,
2431 * depending on which GNU sparse format version is in use.
2432 * Since pax attributes can be in any order, we may not actually
2433 * know at this point how to interpret this. */
2434 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2435 tar->GNU_sparse_size = t;
2436 tar->size_fields |= TAR_SIZE_GNU_SPARSE_SIZE;
2437 }
2438 return (err);
2439 }
2440
2441 /* GNU "0.1" sparse pax format. */
2442 else if (key_length == 3 && memcmp(key, "map", 3) == 0) {
2443 /* GNU.sparse.map */
2444 tar->sparse_gnu_major = 0;
2445 tar->sparse_gnu_minor = 1;
2446 if (value_length > sparse_map_limit) {
2447 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2448 "Unreasonably large sparse map: %llu > %llu",
2449 (unsigned long long)value_length,
2450 (unsigned long long)sparse_map_limit);
2451 err = ARCHIVE_FAILED;
2452 } else {
2453 p = __archive_read_ahead(a, value_length, NULL);
2454 if (p == NULL) {
2455 archive_set_error(&a->archive, EINVAL,
2456 "Truncated archive"
2457 " detected while reading GNU sparse data");
2458 return (ARCHIVE_FATAL);
2459 }
2460 if (gnu_sparse_01_parse(a, tar, p, value_length) != ARCHIVE_OK) {
2461 err = ARCHIVE_WARN;
2462 }
2463 }
2464 __archive_read_consume(a, value_length);
2465 return (err);
2466 }
2467
2468 /* GNU "1.0" sparse pax format */
2469 else if (key_length == 5 && memcmp(key, "major", 5) == 0) {
2470 /* GNU.sparse.major */
2471 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK
2472 && t >= 0
2473 && t <= 10) {
2474 tar->sparse_gnu_major = (int)t;
2475 }
2476 return (err);
2477 }
2478 else if (key_length == 5 && memcmp(key, "minor", 5) == 0) {
2479 /* GNU.sparse.minor */
2480 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK
2481 && t >= 0
2482 && t <= 10) {
2483 tar->sparse_gnu_minor = (int)t;
2484 }
2485 return (err);
2486 }
2487 else if (key_length == 4 && memcmp(key, "name", 4) == 0) {
2488 /* GNU.sparse.name */
2489 /*
2490 * The real filename; when storing sparse
2491 * files, GNU tar puts a synthesized name into
2492 * the regular 'path' attribute in an attempt
2493 * to limit confusion. ;-)
2494 */
2495 if (value_length > pathname_limit) {
2496 *unconsumed += value_length;
2497 err = ARCHIVE_WARN;
2498 } else {
2499 err = read_bytes_to_string(a, &(tar->entry_pathname_override),
2500 value_length, unconsumed);
2501 }
2502 return (err);
2503 }
2504 else if (key_length == 8 && memcmp(key, "realsize", 8) == 0) {
2505 /* GNU.sparse.realsize = size of file on disk */
2506 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2507 tar->GNU_sparse_realsize = t;
2508 tar->size_fields |= TAR_SIZE_GNU_SPARSE_REALSIZE;
2509 }
2510 return (err);
2511 }
2512 }
2513 }
2514 break;
2515 case 'L':
2516 /* LIBARCHIVE extensions */
2517 if (key_length > 11 && memcmp(key, "LIBARCHIVE.", 11) == 0) {
2518 key_length -= 11;
2519 key += 11;
2520
2521 /* TODO: Handle arbitrary extended attributes... */
2522 /*
2523 if (strcmp(key, "LIBARCHIVE.xxxxxxx") == 0)
2524 archive_entry_set_xxxxxx(entry, value);
2525 */
2526 if (key_length == 12 && memcmp(key, "creationtime", 12) == 0) {
2527 /* LIBARCHIVE.creationtime */
2528 __LA_TIME_T sec = 0;
2529 if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2530 archive_entry_set_birthtime(entry, sec, n);
2531 } else {
2532 archive_set_error(&a->archive,
2533 ARCHIVE_ERRNO_MISC,
2534 "Ignoring malformed pax creationtime");
2535 }
2536 return (err);
2537 }
2538 else if (key_length == 11 && memcmp(key, "symlinktype", 11) == 0) {
2539 /* LIBARCHIVE.symlinktype */
2540 if (value_length < 16) {
2541 p = __archive_read_ahead(a, value_length, NULL);
2542 if (p == NULL) {
2543 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2544 "Truncated tar archive "
2545 "detected while reading `symlinktype` attribute");
2546 return (ARCHIVE_FATAL);
2547 }
2548 if (value_length == 4 && memcmp(p, "file", 4) == 0) {
2549 archive_entry_set_symlink_type(entry,
2550 AE_SYMLINK_TYPE_FILE);
2551 } else if (value_length == 3 && memcmp(p, "dir", 3) == 0) {
2552 archive_entry_set_symlink_type(entry,
2553 AE_SYMLINK_TYPE_DIRECTORY);
2554 } else {
2555 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2556 "Unrecognized symlink type");
2557 err = ARCHIVE_WARN;
2558 }
2559 } else {
2560 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2561 "symlink type is very long"
2562 "(longest recognized value is 4 bytes, this is %llu)",
2563 (unsigned long long)value_length);
2564 err = ARCHIVE_WARN;
2565 }
2566 __archive_read_consume(a, value_length);
2567 return (err);
2568 }
2569 else if (key_length > 6 && memcmp(key, "xattr.", 6) == 0) {
2570 key_length -= 6;
2571 key += 6;
2572 if (value_length > xattr_limit) {
2573 err = ARCHIVE_WARN;
2574 } else {
2575 p = __archive_read_ahead(a, value_length, NULL);
2576 if (p == NULL) {
2577 archive_set_error(&a->archive, EINVAL,
2578 "Truncated archive"
2579 " detected while reading xattr information");
2580 return (ARCHIVE_FATAL);
2581 }
2582 if (pax_attribute_LIBARCHIVE_xattr(entry, key, key_length, p, value_length)) {
2583 /* TODO: Unable to parse xattr */
2584 err = ARCHIVE_WARN;
2585 }
2586 }
2587 __archive_read_consume(a, value_length);
2588 return (err);
2589 }
2590 }
2591 break;
2592 case 'R':
2593 /* GNU tar uses RHT.security header to store SELinux xattrs
2594 * SCHILY.xattr.security.selinux == RHT.security.selinux */
2595 if (key_length == 20 && memcmp(key, "RHT.security.selinux", 20) == 0) {
2596 if (value_length > xattr_limit) {
2597 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2598 "Ignoring unreasonably large security.selinux attribute:"
2599 " %llu > %llu",
2600 (unsigned long long)value_length,
2601 (unsigned long long)xattr_limit);
2602 /* TODO: Should this be FAILED instead? */
2603 err = ARCHIVE_WARN;
2604 } else {
2605 p = __archive_read_ahead(a, value_length, NULL);
2606 if (p == NULL) {
2607 archive_set_error(&a->archive, EINVAL,
2608 "Truncated archive"
2609 " detected while reading selinux data");
2610 return (ARCHIVE_FATAL);
2611 }
2612 if (pax_attribute_RHT_security_selinux(entry, p, value_length)) {
2613 /* TODO: Unable to parse xattr */
2614 err = ARCHIVE_WARN;
2615 }
2616 }
2617 __archive_read_consume(a, value_length);
2618 return (err);
2619 }
2620 break;
2621 case 'S':
2622 /* SCHILY.* extensions used by "star" archiver */
2623 if (key_length > 7 && memcmp(key, "SCHILY.", 7) == 0) {
2624 key_length -= 7;
2625 key += 7;
2626
2627 if (key_length == 10 && memcmp(key, "acl.access", 10) == 0) {
2628 err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2629 ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
2630 // TODO: Mark mode as set
2631 return (err);
2632 }
2633 else if (key_length == 11 && memcmp(key, "acl.default", 11) == 0) {
2634 err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2635 ARCHIVE_ENTRY_ACL_TYPE_DEFAULT);
2636 return (err);
2637 }
2638 else if (key_length == 7 && memcmp(key, "acl.ace", 7) == 0) {
2639 err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2640 ARCHIVE_ENTRY_ACL_TYPE_NFS4);
2641 // TODO: Mark mode as set
2642 return (err);
2643 }
2644 else if (key_length == 8 && memcmp(key, "devmajor", 8) == 0) {
2645 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2646 archive_entry_set_rdevmajor(entry, (dev_t)t);
2647 }
2648 return (err);
2649 }
2650 else if (key_length == 8 && memcmp(key, "devminor", 8) == 0) {
2651 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2652 archive_entry_set_rdevminor(entry, (dev_t)t);
2653 }
2654 return (err);
2655 }
2656 else if (key_length == 6 && memcmp(key, "fflags", 6) == 0) {
2657 if (value_length < fflags_limit) {
2658 p = __archive_read_ahead(a, value_length, NULL);
2659 if (p == NULL) {
2660 /* Truncated archive */
2661 archive_set_error(&a->archive, EINVAL,
2662 "Truncated archive"
2663 " detected while reading SCHILY.fflags");
2664 return (ARCHIVE_FATAL);
2665 }
2666 archive_entry_copy_fflags_text_len(entry, p, value_length);
2667 err = ARCHIVE_OK;
2668 } else {
2669 /* Overlong fflags field */
2670 err = ARCHIVE_WARN;
2671 }
2672 __archive_read_consume(a, value_length);
2673 return (err);
2674 }
2675 else if (key_length == 3 && memcmp(key, "dev", 3) == 0) {
2676 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2677 archive_entry_set_dev(entry, (dev_t)t);
2678 }
2679 return (err);
2680 }
2681 else if (key_length == 3 && memcmp(key, "ino", 3) == 0) {
2682 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2683 archive_entry_set_ino(entry, t);
2684 }
2685 return (err);
2686 }
2687 else if (key_length == 5 && memcmp(key, "nlink", 5) == 0) {
2688 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2689 archive_entry_set_nlink(entry, (unsigned int)t);
2690 }
2691 return (err);
2692 }
2693 else if (key_length == 8 && memcmp(key, "realsize", 8) == 0) {
2694 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2695 tar->SCHILY_sparse_realsize = t;
2696 tar->size_fields |= TAR_SIZE_SCHILY_SPARSE_REALSIZE;
2697 }
2698 return (err);
2699 }
2700 /* TODO: Is there a SCHILY.sparse.size similar to GNU.sparse.size ? */
2701 else if (key_length > 6 && memcmp(key, "xattr.", 6) == 0) {
2702 key_length -= 6;
2703 key += 6;
2704 if (value_length < xattr_limit) {
2705 p = __archive_read_ahead(a, value_length, NULL);
2706 if (p == NULL) {
2707 archive_set_error(&a->archive, EINVAL,
2708 "Truncated archive"
2709 " detected while reading SCHILY.xattr");
2710 return (ARCHIVE_FATAL);
2711 }
2712 if (pax_attribute_SCHILY_xattr(entry, key, key_length, p, value_length)) {
2713 /* TODO: Unable to parse xattr */
2714 err = ARCHIVE_WARN;
2715 }
2716 } else {
2717 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2718 "Unreasonably large xattr: %llu > %llu",
2719 (unsigned long long)value_length,
2720 (unsigned long long)xattr_limit);
2721 err = ARCHIVE_WARN;
2722 }
2723 __archive_read_consume(a, value_length);
2724 return (err);
2725 }
2726 }
2727 /* SUN.* extensions from Solaris tar */
2728 if (key_length > 4 && memcmp(key, "SUN.", 4) == 0) {
2729 key_length -= 4;
2730 key += 4;
2731
2732 if (key_length == 9 && memcmp(key, "holesdata", 9) == 0) {
2733 /* SUN.holesdata */
2734 if (value_length < sparse_map_limit) {
2735 p = __archive_read_ahead(a, value_length, NULL);
2736 if (p == NULL) {
2737 archive_set_error(&a->archive, EINVAL,
2738 "Truncated archive"
2739 " detected while reading SUN.holesdata");
2740 return (ARCHIVE_FATAL);
2741 }
2742 err = pax_attribute_SUN_holesdata(a, tar, entry, p, value_length);
2743 if (err < ARCHIVE_OK) {
2744 archive_set_error(&a->archive,
2745 ARCHIVE_ERRNO_MISC,
2746 "Parse error: SUN.holesdata");
2747 }
2748 } else {
2749 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2750 "Unreasonably large sparse map: %llu > %llu",
2751 (unsigned long long)value_length,
2752 (unsigned long long)sparse_map_limit);
2753 err = ARCHIVE_FAILED;
2754 }
2755 __archive_read_consume(a, value_length);
2756 return (err);
2757 }
2758 }
2759 break;
2760 case 'a':
2761 if (key_length == 5 && memcmp(key, "atime", 5) == 0) {
2762 __LA_TIME_T sec = 0;
2763 if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2764 archive_entry_set_atime(entry, sec, n);
2765 } else {
2766 archive_set_error(&a->archive,
2767 ARCHIVE_ERRNO_MISC,
2768 "Ignoring malformed pax atime");
2769 }
2770 return (err);
2771 }
2772 break;
2773 case 'c':
2774 if (key_length == 5 && memcmp(key, "ctime", 5) == 0) {
2775 __LA_TIME_T sec = 0;
2776 if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2777 archive_entry_set_ctime(entry, sec, n);
2778 } else {
2779 archive_set_error(&a->archive,
2780 ARCHIVE_ERRNO_MISC,
2781 "Ignoring malformed pax ctime");
2782 }
2783 return (err);
2784 } else if (key_length == 7 && memcmp(key, "charset", 7) == 0) {
2785 /* TODO: Publish charset information in entry. */
2786 } else if (key_length == 7 && memcmp(key, "comment", 7) == 0) {
2787 /* TODO: Publish comment in entry. */
2788 }
2789 break;
2790 case 'g':
2791 if (key_length == 3 && memcmp(key, "gid", 3) == 0) {
2792 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2793 archive_entry_set_gid(entry, t);
2794 }
2795 return (err);
2796 } else if (key_length == 5 && memcmp(key, "gname", 5) == 0) {
2797 if (value_length > guname_limit) {
2798 *unconsumed += value_length;
2799 err = ARCHIVE_WARN;
2800 } else {
2801 err = read_bytes_to_string(a, &(tar->entry_gname), value_length, unconsumed);
2802 }
2803 return (err);
2804 }
2805 break;
2806 case 'h':
2807 if (key_length == 10 && memcmp(key, "hdrcharset", 10) == 0) {
2808 if (value_length < 64) {
2809 p = __archive_read_ahead(a, value_length, NULL);
2810 if (p == NULL) {
2811 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2812 "Truncated tar archive "
2813 "detected while reading hdrcharset attribute");
2814 return (ARCHIVE_FATAL);
2815 }
2816 if (value_length == 6
2817 && memcmp(p, "BINARY", 6) == 0) {
2818 /* Binary mode. */
2819 tar->pax_hdrcharset_utf8 = 0;
2820 err = ARCHIVE_OK;
2821 } else if (value_length == 23
2822 && memcmp(p, "ISO-IR 10646 2000 UTF-8", 23) == 0) {
2823 tar->pax_hdrcharset_utf8 = 1;
2824 err = ARCHIVE_OK;
2825 } else {
2826 /* TODO: Unrecognized character set */
2827 err = ARCHIVE_WARN;
2828 }
2829 } else {
2830 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2831 "hdrcharset attribute is unreasonably large (%llu bytes)",
2832 (unsigned long long)value_length);
2833 err = ARCHIVE_WARN;
2834 }
2835 __archive_read_consume(a, value_length);
2836 return (err);
2837 }
2838 break;
2839 case 'l':
2840 /* pax interchange doesn't distinguish hardlink vs. symlink. */
2841 if (key_length == 8 && memcmp(key, "linkpath", 8) == 0) {
2842 if (value_length > pathname_limit) {
2843 *unconsumed += value_length;
2844 err = ARCHIVE_WARN;
2845 } else {
2846 err = read_bytes_to_string(a, &tar->entry_linkpath, value_length, unconsumed);
2847 }
2848 return (err);
2849 }
2850 break;
2851 case 'm':
2852 if (key_length == 5 && memcmp(key, "mtime", 5) == 0) {
2853 __LA_TIME_T sec;
2854 if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2855 archive_entry_set_mtime(entry, sec, n);
2856 } else {
2857 archive_set_error(&a->archive,
2858 ARCHIVE_ERRNO_MISC,
2859 "Ignoring malformed pax mtime");
2860 }
2861 return (err);
2862 }
2863 break;
2864 case 'p':
2865 if (key_length == 4 && memcmp(key, "path", 4) == 0) {
2866 if (value_length > pathname_limit) {
2867 *unconsumed += value_length;
2868 err = ARCHIVE_WARN;
2869 } else {
2870 err = read_bytes_to_string(a, &(tar->entry_pathname), value_length, unconsumed);
2871 }
2872 return (err);
2873 }
2874 break;
2875 case 'r':
2876 /* POSIX has reserved 'realtime.*' */
2877 break;
2878 case 's':
2879 /* POSIX has reserved 'security.*' */
2880 /* Someday: if (strcmp(key, "security.acl") == 0) { ... } */
2881 if (key_length == 4 && memcmp(key, "size", 4) == 0) {
2882 /* "size" is the size of the data in the entry. */
2883 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2884 tar->pax_size = t;
2885 tar->size_fields |= TAR_SIZE_PAX_SIZE;
2886 }
2887 else if (t == INT64_MAX) {
2888 /* Note: pax_attr_read_number returns INT64_MAX on overflow or < 0 */
2889 tar->entry_bytes_remaining = 0;
2890 archive_set_error(&a->archive,
2891 ARCHIVE_ERRNO_MISC,
2892 "Tar size attribute overflow");
2893 return (ARCHIVE_FATAL);
2894 }
2895 return (err);
2896 }
2897 break;
2898 case 'u':
2899 if (key_length == 3 && memcmp(key, "uid", 3) == 0) {
2900 if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2901 archive_entry_set_uid(entry, t);
2902 }
2903 return (err);
2904 } else if (key_length == 5 && memcmp(key, "uname", 5) == 0) {
2905 if (value_length > guname_limit) {
2906 *unconsumed += value_length;
2907 err = ARCHIVE_WARN;
2908 } else {
2909 err = read_bytes_to_string(a, &(tar->entry_uname), value_length, unconsumed);
2910 }
2911 return (err);
2912 }
2913 break;
2914 }
2915
2916 /* Unrecognized key, just skip the entire value. */
2917 __archive_read_consume(a, value_length);
2918 return (err);
2919 }
2920
2921
2922
2923 /*
2924 * Parse a decimal time value, which may include a fractional portion
2925 *
2926 * Sets ps to INT64_MIN on error, including syntax issues such as non-digits,
2927 * or a time value that's outside the range of time_t.
2928 */
2929 static void
pax_time(const char * p,size_t length,int64_t * ps,long * pn)2930 pax_time(const char *p, size_t length, int64_t *ps, long *pn)
2931 {
2932 char digit;
2933 int64_t s;
2934 unsigned long l;
2935 int sign;
2936
2937 if (length <= 0) {
2938 *ps = 0;
2939 *pn = 0;
2940 return;
2941 }
2942 s = 0;
2943 sign = 1;
2944 if (*p == '-') {
2945 sign = -1;
2946 p++;
2947 length--;
2948 }
2949 while (length > 0 && *p >= '0' && *p <= '9') {
2950 digit = *p - '0';
2951 if (archive_ckd_mul_i64(&s, s, 10) ||
2952 archive_ckd_add_i64(&s, s, digit)) {
2953 *ps = INT64_MIN;
2954 *pn = 0;
2955 return;
2956 }
2957 ++p;
2958 --length;
2959 }
2960
2961 *ps = s * sign;
2962
2963 #if ARCHIVE_VERSION_NUMBER < 4000000
2964 /* Libarchive 4.0 will have __LA_TIME_T == int64_t, so
2965 this will be unnecessary. */
2966 /* Test whether it overflows __LA_TIME_T */
2967 __LA_TIME_T sec = (__LA_TIME_T)*ps;
2968 if ((int64_t)sec != *ps) {
2969 *ps = INT64_MIN;
2970 *pn = 0;
2971 return;
2972 }
2973 #endif
2974
2975 /* Calculate nanoseconds. */
2976 *pn = 0;
2977
2978 if (length <= 0) {
2979 return;
2980 }
2981
2982 /* Skip `.` */
2983 if (*p != '.') {
2984 *ps = INT64_MIN;
2985 *pn = 0;
2986 return;
2987 }
2988 ++p;
2989 --length;
2990
2991 l = 100000000UL;
2992 do {
2993 if (length <= 0) {
2994 return;
2995 }
2996 if (*p >= '0' && *p <= '9') {
2997 *pn += (*p - '0') * l;
2998 } else {
2999 *ps = INT64_MIN;
3000 *pn = 0;
3001 return;
3002 }
3003 ++p;
3004 --length;
3005 } while (l /= 10);
3006
3007 /* Ignore resolution beyond nanoseconds,
3008 but verify it's all decimal digits. */
3009 while (length > 0) {
3010 if (*p < '0' || *p > '9') {
3011 *ps = INT64_MIN;
3012 *pn = 0;
3013 return;
3014 }
3015 ++p;
3016 --length;
3017 }
3018 }
3019
3020 /*
3021 * Parse GNU tar header
3022 */
3023 static int
header_gnutar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)3024 header_gnutar(struct archive_read *a, struct tar *tar,
3025 struct archive_entry *entry, const void *h, int64_t *unconsumed)
3026 {
3027 struct archive_entry_header_gnutar header_copy;
3028 const struct archive_entry_header_gnutar *header;
3029 int64_t t;
3030 int err = ARCHIVE_OK;
3031
3032 /*
3033 * GNU header is like POSIX ustar, except 'prefix' is
3034 * replaced with some other fields. This also means the
3035 * filename is stored as in old-style archives.
3036 */
3037
3038 /*
3039 * Sparse extension reads can reuse the callback buffer containing h,
3040 * so preserve the main header until common fields are parsed.
3041 */
3042 memcpy(&header_copy, h, sizeof(header_copy));
3043 header = &header_copy;
3044
3045 /* Copy filename over (to ensure null termination). */
3046 const char *existing_pathname = archive_entry_pathname(entry);
3047 const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
3048 if ((existing_pathname == NULL || existing_pathname[0] == '\0')
3049 && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == L'\0')) {
3050 if (archive_entry_copy_pathname_l(entry,
3051 header->name, sizeof(header->name), tar->sconv) != 0) {
3052 err = set_conversion_failed_error(a, tar->sconv, "Pathname");
3053 if (err == ARCHIVE_FATAL)
3054 return (err);
3055 }
3056 }
3057
3058 /* Fields common to ustar and GNU */
3059 /* XXX Can the following be factored out since it's common
3060 * to ustar and gnu tar? Is it okay to move it down into
3061 * header_common, perhaps? */
3062 const char *existing_uname = archive_entry_uname(entry);
3063 if (existing_uname == NULL || existing_uname[0] == '\0') {
3064 if (archive_entry_copy_uname_l(entry,
3065 header->uname, sizeof(header->uname), tar->sconv) != 0) {
3066 err = set_conversion_failed_error(a, tar->sconv, "Uname");
3067 if (err == ARCHIVE_FATAL)
3068 return (err);
3069 }
3070 }
3071
3072 const char *existing_gname = archive_entry_gname(entry);
3073 if (existing_gname == NULL || existing_gname[0] == '\0') {
3074 if (archive_entry_copy_gname_l(entry,
3075 header->gname, sizeof(header->gname), tar->sconv) != 0) {
3076 err = set_conversion_failed_error(a, tar->sconv, "Gname");
3077 if (err == ARCHIVE_FATAL)
3078 return (err);
3079 }
3080 }
3081
3082 /* Parse out device numbers only for char and block specials */
3083 if (header->typeflag[0] == '3' || header->typeflag[0] == '4') {
3084 if (!archive_entry_rdev_is_set(entry)) {
3085 archive_entry_set_rdevmajor(entry, (dev_t)
3086 tar_atol(header->rdevmajor, sizeof(header->rdevmajor)));
3087 archive_entry_set_rdevminor(entry, (dev_t)
3088 tar_atol(header->rdevminor, sizeof(header->rdevminor)));
3089 }
3090 } else {
3091 archive_entry_set_rdev(entry, 0);
3092 }
3093
3094 /* Grab GNU-specific fields. */
3095 if (!archive_entry_atime_is_set(entry)) {
3096 t = tar_atol(header->atime, sizeof(header->atime));
3097 if (t > 0)
3098 archive_entry_set_atime(entry, t, 0);
3099 }
3100 if (!archive_entry_ctime_is_set(entry)) {
3101 t = tar_atol(header->ctime, sizeof(header->ctime));
3102 if (t > 0)
3103 archive_entry_set_ctime(entry, t, 0);
3104 }
3105
3106 if (header->realsize[0] != 0) {
3107 /* Treat as a synonym for the pax GNU.sparse.realsize attr */
3108 tar->GNU_sparse_realsize
3109 = tar_atol(header->realsize, sizeof(header->realsize));
3110 tar->size_fields |= TAR_SIZE_GNU_SPARSE_REALSIZE;
3111 }
3112
3113 if (header->sparse[0].offset[0] != 0) {
3114 if (gnu_sparse_old_read(a, tar, header, unconsumed)
3115 != ARCHIVE_OK)
3116 return (ARCHIVE_FATAL);
3117 } else {
3118 if (header->isextended[0] != 0) {
3119 /* XXX WTF? XXX */
3120 }
3121 }
3122
3123 /* Grab fields common to all tar variants. */
3124 err = header_common(a, tar, entry, header);
3125 if (err == ARCHIVE_FATAL)
3126 return (err);
3127
3128 tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
3129
3130 return (err);
3131 }
3132
3133 static int
gnu_add_sparse_entry(struct archive_read * a,struct tar * tar,int64_t offset,int64_t remaining)3134 gnu_add_sparse_entry(struct archive_read *a, struct tar *tar,
3135 int64_t offset, int64_t remaining)
3136 {
3137 struct sparse_block *p;
3138
3139 p = calloc(1, sizeof(*p));
3140 if (p == NULL) {
3141 archive_set_error(&a->archive, ENOMEM, "Out of memory");
3142 return (ARCHIVE_FATAL);
3143 }
3144 if (tar->sparse_last != NULL)
3145 tar->sparse_last->next = p;
3146 else
3147 tar->sparse_list = p;
3148 tar->sparse_last = p;
3149 if (remaining < 0 || offset < 0 || offset > INT64_MAX - remaining) {
3150 archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, "Malformed sparse map data");
3151 return (ARCHIVE_FATAL);
3152 }
3153 p->offset = offset;
3154 p->remaining = remaining;
3155 return (ARCHIVE_OK);
3156 }
3157
3158 static void
gnu_clear_sparse_list(struct tar * tar)3159 gnu_clear_sparse_list(struct tar *tar)
3160 {
3161 struct sparse_block *p;
3162
3163 while (tar->sparse_list != NULL) {
3164 p = tar->sparse_list;
3165 tar->sparse_list = p->next;
3166 free(p);
3167 }
3168 tar->sparse_last = NULL;
3169 }
3170
3171 /*
3172 * GNU tar old-format sparse data.
3173 *
3174 * GNU old-format sparse data is stored in a fixed-field
3175 * format. Offset/size values are 11-byte octal fields (same
3176 * format as 'size' field in ustart header). These are
3177 * stored in the header, allocating subsequent header blocks
3178 * as needed. Extending the header in this way is a pretty
3179 * severe POSIX violation; this design has earned GNU tar a
3180 * lot of criticism.
3181 */
3182
3183 static int
gnu_sparse_old_read(struct archive_read * a,struct tar * tar,const struct archive_entry_header_gnutar * header,int64_t * unconsumed)3184 gnu_sparse_old_read(struct archive_read *a, struct tar *tar,
3185 const struct archive_entry_header_gnutar *header, int64_t *unconsumed)
3186 {
3187 const void *data;
3188 struct extended {
3189 struct gnu_sparse sparse[21];
3190 char isextended[1];
3191 char padding[7];
3192 };
3193 const struct extended *ext;
3194
3195 if (gnu_sparse_old_parse(a, tar, header->sparse, 4) != ARCHIVE_OK)
3196 return (ARCHIVE_FATAL);
3197 if (header->isextended[0] == 0)
3198 return (ARCHIVE_OK);
3199
3200 do {
3201 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3202 return (ARCHIVE_FATAL);
3203 }
3204 data = __archive_read_ahead(a, 512, NULL);
3205 if (data == NULL) {
3206 archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
3207 "Truncated tar archive "
3208 "detected while reading sparse file data");
3209 return (ARCHIVE_FATAL);
3210 }
3211 *unconsumed = 512;
3212 ext = (const struct extended *)data;
3213 if (gnu_sparse_old_parse(a, tar, ext->sparse, 21) != ARCHIVE_OK)
3214 return (ARCHIVE_FATAL);
3215 } while (ext->isextended[0] != 0);
3216 if (tar->sparse_list != NULL)
3217 tar->entry_offset = tar->sparse_list->offset;
3218 return (ARCHIVE_OK);
3219 }
3220
3221 static int
gnu_sparse_old_parse(struct archive_read * a,struct tar * tar,const struct gnu_sparse * sparse,int length)3222 gnu_sparse_old_parse(struct archive_read *a, struct tar *tar,
3223 const struct gnu_sparse *sparse, int length)
3224 {
3225 while (length > 0 && sparse->offset[0] != 0) {
3226 if (gnu_add_sparse_entry(a, tar,
3227 tar_atol(sparse->offset, sizeof(sparse->offset)),
3228 tar_atol(sparse->numbytes, sizeof(sparse->numbytes)))
3229 != ARCHIVE_OK)
3230 return (ARCHIVE_FATAL);
3231 sparse++;
3232 length--;
3233 }
3234 return (ARCHIVE_OK);
3235 }
3236
3237 /*
3238 * GNU tar sparse format 0.0
3239 *
3240 * Beginning with GNU tar 1.15, sparse files are stored using
3241 * information in the pax extended header. The GNU tar maintainers
3242 * have gone through a number of variations in the process of working
3243 * out this scheme; fortunately, they're all numbered.
3244 *
3245 * Sparse format 0.0 uses attribute GNU.sparse.numblocks to store the
3246 * number of blocks, and GNU.sparse.offset/GNU.sparse.numbytes to
3247 * store offset/size for each block. The repeated instances of these
3248 * latter fields violate the pax specification (which frowns on
3249 * duplicate keys), so this format was quickly replaced.
3250 */
3251
3252 /*
3253 * GNU tar sparse format 0.1
3254 *
3255 * This version replaced the offset/numbytes attributes with
3256 * a single "map" attribute that stored a list of integers. This
3257 * format had two problems: First, the "map" attribute could be very
3258 * long, which caused problems for some implementations. More
3259 * importantly, the sparse data was lost when extracted by archivers
3260 * that didn't recognize this extension.
3261 */
3262 static int
gnu_sparse_01_parse(struct archive_read * a,struct tar * tar,const char * p,size_t length)3263 gnu_sparse_01_parse(struct archive_read *a, struct tar *tar, const char *p, size_t length)
3264 {
3265 const char *e;
3266 int64_t offset = -1, size = -1;
3267
3268 for (;;) {
3269 e = p;
3270 while (length > 0 && *e != ',') {
3271 if (*e < '0' || *e > '9')
3272 return (ARCHIVE_WARN);
3273 e++;
3274 length--;
3275 }
3276 if (offset < 0) {
3277 offset = tar_atol10(p, e - p);
3278 if (offset < 0)
3279 return (ARCHIVE_WARN);
3280 } else {
3281 size = tar_atol10(p, e - p);
3282 if (size < 0)
3283 return (ARCHIVE_WARN);
3284 if (gnu_add_sparse_entry(a, tar, offset, size)
3285 != ARCHIVE_OK)
3286 return (ARCHIVE_FATAL);
3287 offset = -1;
3288 }
3289 if (length == 0)
3290 return (ARCHIVE_OK);
3291 p = e + 1;
3292 length--;
3293 }
3294 }
3295
3296 /*
3297 * GNU tar sparse format 1.0
3298 *
3299 * The idea: The offset/size data is stored as a series of base-10
3300 * ASCII numbers prepended to the file data, so that dearchivers that
3301 * don't support this format will extract the block map along with the
3302 * data and a separate post-process can restore the sparseness.
3303 *
3304 * Unfortunately, GNU tar 1.16 had a bug that added unnecessary
3305 * padding to the body of the file when using this format. GNU tar
3306 * 1.17 corrected this bug without bumping the version number, so
3307 * it's not possible to support both variants. This code supports
3308 * the later variant at the expense of not supporting the former.
3309 *
3310 * This variant also introduced the GNU.sparse.major/GNU.sparse.minor attributes.
3311 */
3312
3313 /*
3314 * Read the next line from the input, and parse it as a decimal
3315 * integer followed by '\n'. Returns positive integer value or
3316 * negative on error.
3317 */
3318 static int64_t
gnu_sparse_10_atol(struct archive_read * a,struct tar * tar,int64_t * remaining,int64_t * unconsumed)3319 gnu_sparse_10_atol(struct archive_read *a, struct tar *tar,
3320 int64_t *remaining, int64_t *unconsumed)
3321 {
3322 int64_t l;
3323 const char *p;
3324 ssize_t bytes_read;
3325 int base, digit;
3326
3327 base = 10;
3328
3329 /*
3330 * Skip any lines starting with '#'; GNU tar specs
3331 * don't require this, but they should.
3332 */
3333 do {
3334 bytes_read = readline(a, tar, &p,
3335 (ssize_t)tar_min(*remaining, 100), unconsumed);
3336 if (bytes_read <= 0)
3337 return (ARCHIVE_FATAL);
3338 *remaining -= bytes_read;
3339 } while (p[0] == '#');
3340
3341 l = 0;
3342 while (bytes_read > 0) {
3343 if (*p == '\n')
3344 return (l);
3345 if (*p < '0' || *p >= '0' + base)
3346 return (ARCHIVE_WARN);
3347 digit = *p - '0';
3348 if (archive_ckd_mul_i64(&l, l, base) ||
3349 archive_ckd_add_i64(&l, l, digit)) {
3350 l = INT64_MAX; /* Truncate on overflow. */
3351 }
3352 p++;
3353 bytes_read--;
3354 }
3355 /* TODO: Error message. */
3356 return (ARCHIVE_WARN);
3357 }
3358
3359 /*
3360 * Returns length (in bytes) of the sparse data description
3361 * that was read.
3362 */
3363 static int64_t
gnu_sparse_10_read(struct archive_read * a,struct tar * tar,int64_t * unconsumed)3364 gnu_sparse_10_read(struct archive_read *a, struct tar *tar, int64_t *unconsumed)
3365 {
3366 int64_t bytes_read, entries, offset, size, to_skip, remaining;
3367
3368 /* Clear out the existing sparse list. */
3369 gnu_clear_sparse_list(tar);
3370
3371 remaining = tar->entry_bytes_remaining;
3372
3373 /* Parse entries. */
3374 entries = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3375 if (entries < 0)
3376 return (ARCHIVE_FATAL);
3377 /* Parse the individual entries. */
3378 while (entries-- > 0) {
3379 /* Parse offset/size */
3380 offset = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3381 if (offset < 0)
3382 return (ARCHIVE_FATAL);
3383 size = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3384 if (size < 0)
3385 return (ARCHIVE_FATAL);
3386 /* Add a new sparse entry. */
3387 if (gnu_add_sparse_entry(a, tar, offset, size) != ARCHIVE_OK)
3388 return (ARCHIVE_FATAL);
3389 }
3390 /* Skip rest of block... */
3391 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3392 return (ARCHIVE_FATAL);
3393 }
3394 bytes_read = tar->entry_bytes_remaining - remaining;
3395 to_skip = 0x1ff & -bytes_read;
3396 /* Fail if tar->entry_bytes_remaing would get negative */
3397 if (to_skip > remaining)
3398 return (ARCHIVE_FATAL);
3399 if (to_skip != __archive_read_consume(a, to_skip))
3400 return (ARCHIVE_FATAL);
3401 return (bytes_read + to_skip);
3402 }
3403
3404 /*
3405 * Solaris pax extension for a sparse file. This is recorded with the
3406 * data and hole pairs. The way recording sparse information by Solaris'
3407 * pax simply indicates where data and sparse are, so the stored contents
3408 * consist of both data and hole.
3409 */
3410 static int
pax_attribute_SUN_holesdata(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const char * p,size_t length)3411 pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar,
3412 struct archive_entry *entry, const char *p, size_t length)
3413 {
3414 const char *e;
3415 int64_t start, end;
3416 int hole = 1;
3417
3418 (void)entry; /* UNUSED */
3419
3420 end = 0;
3421 if (length <= 0)
3422 return (ARCHIVE_WARN);
3423 if (*p == ' ') {
3424 p++;
3425 length--;
3426 } else {
3427 return (ARCHIVE_WARN);
3428 }
3429 for (;;) {
3430 e = p;
3431 while (length > 0 && *e != ' ') {
3432 if (*e < '0' || *e > '9')
3433 return (ARCHIVE_WARN);
3434 e++;
3435 length--;
3436 }
3437 start = end;
3438 end = tar_atol10(p, e - p);
3439 if (end < 0)
3440 return (ARCHIVE_WARN);
3441 if (start < end) {
3442 if (gnu_add_sparse_entry(a, tar, start,
3443 end - start) != ARCHIVE_OK)
3444 return (ARCHIVE_FATAL);
3445 tar->sparse_last->hole = hole;
3446 }
3447 if (length == 0)
3448 return (ARCHIVE_OK);
3449 if (*e == '\n')
3450 return (ARCHIVE_WARN);
3451 p = e + 1;
3452 length--;
3453 hole = hole == 0;
3454 }
3455 }
3456
3457 /*-
3458 * Convert text->integer.
3459 *
3460 * Traditional tar formats (including POSIX) specify base-8 for
3461 * all of the standard numeric fields. This is a significant limitation
3462 * in practice:
3463 * = file size is limited to 8GB
3464 * = rdevmajor and rdevminor are limited to 21 bits
3465 * = uid/gid are limited to 21 bits
3466 *
3467 * There are two workarounds for this:
3468 * = pax extended headers, which use variable-length string fields
3469 * = GNU tar and STAR both allow either base-8 or base-256 in
3470 * most fields. The high bit is set to indicate base-256.
3471 *
3472 * On read, this implementation supports both extensions.
3473 */
3474 static int64_t
tar_atol(const char * p,size_t char_cnt)3475 tar_atol(const char *p, size_t char_cnt)
3476 {
3477 /*
3478 * Technically, GNU tar considers a field to be in base-256
3479 * only if the first byte is 0xff or 0x80.
3480 */
3481 if (*p & 0x80)
3482 return (tar_atol256(p, char_cnt));
3483 return (tar_atol8(p, char_cnt));
3484 }
3485
3486 /*
3487 * Note that this implementation does not (and should not!) obey
3488 * locale settings; you cannot simply substitute strtol here, since
3489 * it does obey locale.
3490 */
3491 static int64_t
tar_atol_base_n(const char * p,size_t char_cnt,int base)3492 tar_atol_base_n(const char *p, size_t char_cnt, int base)
3493 {
3494 int64_t l;
3495 int digit, sign;
3496
3497 /* the pointer will not be dereferenced if char_cnt is zero
3498 * due to the way the && operator is evaluated.
3499 */
3500 while (char_cnt != 0 && (*p == ' ' || *p == '\t')) {
3501 p++;
3502 char_cnt--;
3503 }
3504
3505 sign = 1;
3506 if (char_cnt != 0 && *p == '-') {
3507 sign = -1;
3508 p++;
3509 char_cnt--;
3510 }
3511
3512 l = 0;
3513 while (char_cnt != 0) {
3514 digit = *p - '0';
3515 if (digit < 0 || digit >= base)
3516 break;
3517 if (archive_ckd_mul_i64(&l, l, base) ||
3518 archive_ckd_add_i64(&l, l, sign * digit)) {
3519 /* Truncate on overflow. */
3520 return sign < 0 ? INT64_MIN : INT64_MAX;
3521 }
3522 p++;
3523 char_cnt--;
3524 }
3525 return l;
3526 }
3527
3528 static int64_t
tar_atol8(const char * p,size_t char_cnt)3529 tar_atol8(const char *p, size_t char_cnt)
3530 {
3531 return tar_atol_base_n(p, char_cnt, 8);
3532 }
3533
3534 static int64_t
tar_atol10(const char * p,size_t char_cnt)3535 tar_atol10(const char *p, size_t char_cnt)
3536 {
3537 return tar_atol_base_n(p, char_cnt, 10);
3538 }
3539
3540 /*
3541 * Parse a base-256 integer. This is just a variable-length
3542 * twos-complement signed binary value in big-endian order, except
3543 * that the high-order bit is ignored. The values here can be up to
3544 * 12 bytes, so we need to be careful about overflowing 64-bit
3545 * (8-byte) integers.
3546 *
3547 * This code unashamedly assumes that the local machine uses 8-bit
3548 * bytes and twos-complement arithmetic.
3549 */
3550 static int64_t
tar_atol256(const char * _p,size_t char_cnt)3551 tar_atol256(const char *_p, size_t char_cnt)
3552 {
3553 uint64_t l;
3554 const unsigned char *p = (const unsigned char *)_p;
3555 unsigned char c, neg;
3556
3557 /* Extend 7-bit 2s-comp to 8-bit 2s-comp, decide sign. */
3558 c = *p;
3559 if (c & 0x40) {
3560 neg = 0xff;
3561 c |= 0x80;
3562 l = ~ARCHIVE_LITERAL_ULL(0);
3563 } else {
3564 neg = 0;
3565 c &= 0x7f;
3566 l = 0;
3567 }
3568
3569 /* If more than 8 bytes, check that we can ignore
3570 * high-order bits without overflow. */
3571 while (char_cnt > sizeof(int64_t)) {
3572 --char_cnt;
3573 if (c != neg)
3574 return neg ? INT64_MIN : INT64_MAX;
3575 c = *++p;
3576 }
3577
3578 /* c is first byte that fits; if sign mismatch, return overflow */
3579 if ((c ^ neg) & 0x80) {
3580 return neg ? INT64_MIN : INT64_MAX;
3581 }
3582
3583 /* Accumulate remaining bytes. */
3584 while (--char_cnt > 0) {
3585 l = (l << 8) | c;
3586 c = *++p;
3587 }
3588 l = (l << 8) | c;
3589 /* Return signed twos-complement value. */
3590 return (int64_t)(l);
3591 }
3592
3593 /*
3594 * Returns length of line (including trailing newline)
3595 * or negative on error. 'start' argument is updated to
3596 * point to first character of line. This avoids copying
3597 * when possible.
3598 */
3599 static ssize_t
readline(struct archive_read * a,struct tar * tar,const char ** start,ssize_t limit,int64_t * unconsumed)3600 readline(struct archive_read *a, struct tar *tar, const char **start,
3601 ssize_t limit, int64_t *unconsumed)
3602 {
3603 ssize_t bytes_read;
3604 ssize_t total_size = 0;
3605 const void *p, *t;
3606 const char *s;
3607
3608 if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3609 return (ARCHIVE_FATAL);
3610 }
3611
3612 t = __archive_read_ahead(a, 1, &bytes_read);
3613 if (bytes_read <= 0 || t == NULL)
3614 return (ARCHIVE_FATAL);
3615 s = t; /* Start of line? */
3616 p = memchr(t, '\n', bytes_read);
3617 /* If we found '\n' in the read buffer, return pointer to that. */
3618 if (p != NULL) {
3619 bytes_read = 1 + ((const char *)p) - s;
3620 if (bytes_read > limit) {
3621 archive_set_error(&a->archive,
3622 ARCHIVE_ERRNO_FILE_FORMAT,
3623 "Line too long");
3624 return (ARCHIVE_FATAL);
3625 }
3626 *unconsumed = bytes_read;
3627 *start = s;
3628 return (bytes_read);
3629 }
3630 *unconsumed = bytes_read;
3631 /* Otherwise, we need to accumulate in a line buffer. */
3632 for (;;) {
3633 if (total_size + bytes_read > limit) {
3634 archive_set_error(&a->archive,
3635 ARCHIVE_ERRNO_FILE_FORMAT,
3636 "Line too long");
3637 return (ARCHIVE_FATAL);
3638 }
3639 if (archive_string_ensure(&tar->line, total_size + bytes_read) == NULL) {
3640 archive_set_error(&a->archive, ENOMEM,
3641 "Can't allocate working buffer");
3642 return (ARCHIVE_FATAL);
3643 }
3644 memcpy(tar->line.s + total_size, t, bytes_read);
3645 tar_flush_unconsumed(a, unconsumed);
3646 total_size += bytes_read;
3647 /* If we found '\n', clean up and return. */
3648 if (p != NULL) {
3649 *start = tar->line.s;
3650 return (total_size);
3651 }
3652 /* Read some more. */
3653 t = __archive_read_ahead(a, 1, &bytes_read);
3654 if (bytes_read <= 0 || t == NULL)
3655 return (ARCHIVE_FATAL);
3656 s = t; /* Start of line? */
3657 p = memchr(t, '\n', bytes_read);
3658 /* If we found '\n', trim the read. */
3659 if (p != NULL) {
3660 bytes_read = 1 + ((const char *)p) - s;
3661 }
3662 *unconsumed = bytes_read;
3663 }
3664 }
3665
3666 /*
3667 * base64_decode - Base64 decode
3668 *
3669 * This accepts most variations of base-64 encoding, including:
3670 * * with or without line breaks
3671 * * with or without the final group padded with '=' or '_' characters
3672 * (The most economical Base-64 variant does not pad the last group and
3673 * omits line breaks; RFC1341 used for MIME requires both.)
3674 */
3675 static char *
base64_decode(const char * s,size_t len,size_t * out_len)3676 base64_decode(const char *s, size_t len, size_t *out_len)
3677 {
3678 static const unsigned char decode_table[128] = {
3679 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3680 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3681 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3682 255, 255, 255, 255, 255, 255, 255, 62, 255, 255, 255, 63,
3683 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, 255, 255,
3684 255, 255, 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
3685 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255,
3686 255, 255, 255, 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35,
3687 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
3688 51, 255, 255, 255, 255, 255 };
3689 char *out, *d;
3690 const unsigned char *src = (const unsigned char *)s;
3691
3692 /* Allocate enough space to hold the entire output. */
3693 /* Note that we may not use all of this... */
3694 out = malloc(len - len / 4 + 1);
3695 if (out == NULL) {
3696 *out_len = 0;
3697 return (NULL);
3698 }
3699 d = out;
3700
3701 while (len > 0) {
3702 /* Collect the next group of (up to) four characters. */
3703 int v = 0;
3704 int group_size = 0;
3705 while (group_size < 4 && len > 0) {
3706 /* '=' or '_' padding indicates final group. */
3707 if (*src == '=' || *src == '_') {
3708 len = 0;
3709 break;
3710 }
3711 /* Skip illegal characters (including line breaks) */
3712 if (*src > 127 || *src < 32
3713 || decode_table[*src] == 0xff) {
3714 len--;
3715 src++;
3716 continue;
3717 }
3718 v <<= 6;
3719 v |= decode_table[*src++];
3720 len --;
3721 group_size++;
3722 }
3723 /* Align a short group properly. */
3724 v <<= 6 * (4 - group_size);
3725 /* Unpack the group we just collected. */
3726 switch (group_size) {
3727 case 4: d[2] = v & 0xff;
3728 /* FALLTHROUGH */
3729 case 3: d[1] = (v >> 8) & 0xff;
3730 /* FALLTHROUGH */
3731 case 2: d[0] = (v >> 16) & 0xff;
3732 break;
3733 case 1: /* this is invalid! */
3734 break;
3735 }
3736 d += group_size * 3 / 4;
3737 }
3738
3739 *out_len = d - out;
3740 return (out);
3741 }
3742
3743 static char *
url_decode(const char * in,size_t length)3744 url_decode(const char *in, size_t length)
3745 {
3746 char *out, *d;
3747 const char *s;
3748
3749 out = malloc(length + 1);
3750 if (out == NULL)
3751 return (NULL);
3752 for (s = in, d = out; length > 0 && *s != '\0'; ) {
3753 if (s[0] == '%' && length > 2) {
3754 /* Try to convert % escape */
3755 int digit1 = tohex(s[1]);
3756 int digit2 = tohex(s[2]);
3757 if (digit1 >= 0 && digit2 >= 0) {
3758 /* Looks good, consume three chars */
3759 s += 3;
3760 length -= 3;
3761 /* Convert output */
3762 *d++ = ((digit1 << 4) | digit2);
3763 continue;
3764 }
3765 /* Else fall through and treat '%' as normal char */
3766 }
3767 *d++ = *s++;
3768 --length;
3769 }
3770 *d = '\0';
3771 return (out);
3772 }
3773
3774 static int
tohex(int c)3775 tohex(int c)
3776 {
3777 if (c >= '0' && c <= '9')
3778 return (c - '0');
3779 else if (c >= 'A' && c <= 'F')
3780 return (c - 'A' + 10);
3781 else if (c >= 'a' && c <= 'f')
3782 return (c - 'a' + 10);
3783 else
3784 return (-1);
3785 }
3786