xref: /freebsd/contrib/libarchive/libarchive/archive_read_support_format_tar.c (revision 185becb1e1bd2657c156f78aeb52edac05ba5fb5)
1 /*-
2  * Copyright (c) 2003-2023 Tim Kientzle
3  * Copyright (c) 2011-2012 Michihiro NAKAJIMA
4  * Copyright (c) 2016 Martin Matuska
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #include "archive_platform.h"
29 
30 #ifdef HAVE_ERRNO_H
31 #include <errno.h>
32 #endif
33 #include <stddef.h>
34 #ifdef HAVE_STDLIB_H
35 #include <stdlib.h>
36 #endif
37 #ifdef HAVE_STRING_H
38 #include <string.h>
39 #endif
40 
41 #include "archive.h"
42 #include "archive_acl_private.h" /* For ACL parsing routines. */
43 #include "archive_entry.h"
44 #include "archive_entry_locale.h"
45 #include "archive_integer.h"
46 #include "archive_private.h"
47 #include "archive_read_private.h"
48 
49 #define tar_min(a,b) ((a) < (b) ? (a) : (b))
50 
51 /*
52  * Layout of POSIX 'ustar' tar header.
53  */
54 struct archive_entry_header_ustar {
55 	char	name[100];
56 	char	mode[8];
57 	char	uid[8];
58 	char	gid[8];
59 	char	size[12];
60 	char	mtime[12];
61 	char	checksum[8];
62 	char	typeflag[1];
63 	char	linkname[100];	/* "old format" header ends here */
64 	char	magic[6];	/* For POSIX: "ustar\0" */
65 	char	version[2];	/* For POSIX: "00" */
66 	char	uname[32];
67 	char	gname[32];
68 	char	rdevmajor[8];
69 	char	rdevminor[8];
70 	char	prefix[155];
71 };
72 
73 /*
74  * Structure of GNU tar header
75  */
76 struct gnu_sparse {
77 	char	offset[12];
78 	char	numbytes[12];
79 };
80 
81 struct archive_entry_header_gnutar {
82 	char	name[100];
83 	char	mode[8];
84 	char	uid[8];
85 	char	gid[8];
86 	char	size[12];
87 	char	mtime[12];
88 	char	checksum[8];
89 	char	typeflag[1];
90 	char	linkname[100];
91 	char	magic[8];  /* "ustar  \0" (note blank/blank/null at end) */
92 	char	uname[32];
93 	char	gname[32];
94 	char	rdevmajor[8];
95 	char	rdevminor[8];
96 	char	atime[12];
97 	char	ctime[12];
98 	char	offset[12];
99 	char	longnames[4];
100 	char	unused[1];
101 	struct gnu_sparse sparse[4];
102 	char	isextended[1];
103 	char	realsize[12];
104 	/*
105 	 * Old GNU format doesn't use POSIX 'prefix' field; they use
106 	 * the 'L' (longname) entry instead.
107 	 */
108 };
109 
110 /*
111  * Data specific to this format.
112  */
113 struct sparse_block {
114 	struct sparse_block	*next;
115 	int64_t	offset;
116 	int64_t	remaining;
117 	int hole;
118 };
119 
120 struct tar {
121 	struct archive_string	 entry_pathname;
122 	/* For "GNU.sparse.name" and other similar path extensions. */
123 	struct archive_string	 entry_pathname_override;
124 	struct archive_string	 entry_uname;
125 	struct archive_string	 entry_gname;
126 	struct archive_string	 entry_linkpath;
127 	struct archive_string	 line;
128 	int			 pax_hdrcharset_utf8;
129 	int64_t			 entry_bytes_remaining;
130 	int64_t			 entry_offset;
131 	int64_t			 entry_padding;
132 	int64_t 		 entry_bytes_unconsumed;
133 	int64_t			 disk_size;
134 	int64_t			 GNU_sparse_realsize;
135 	int64_t			 GNU_sparse_size;
136 	int64_t			 SCHILY_sparse_realsize;
137 	int64_t			 pax_size;
138 	struct sparse_block	*sparse_list;
139 	struct sparse_block	*sparse_last;
140 	int64_t			 sparse_offset;
141 	int64_t			 sparse_numbytes;
142 	int			 sparse_gnu_major;
143 	int			 sparse_gnu_minor;
144 	char			 sparse_gnu_attributes_seen;
145 	char			 filetype;
146 	char			 size_fields; /* Bits defined below */
147 
148 	struct archive_string	 localname;
149 	struct archive_string_conv *opt_sconv;
150 	struct archive_string_conv *sconv;
151 	struct archive_string_conv *sconv_acl;
152 	struct archive_string_conv *sconv_default;
153 	int			 init_default_conversion;
154 	int			 compat_2x;
155 	int			 process_mac_extensions;
156 	int			 read_concatenated_archives;
157 	int			 default_inode;
158 	int			 default_dev;
159 };
160 
161 /* Track which size fields were present in the headers */
162 #define TAR_SIZE_PAX_SIZE 1
163 #define TAR_SIZE_GNU_SPARSE_REALSIZE 2
164 #define TAR_SIZE_GNU_SPARSE_SIZE 4
165 #define TAR_SIZE_SCHILY_SPARSE_REALSIZE 8
166 
167 
168 static int	archive_block_is_null(const char *p);
169 static char	*base64_decode(const char *, size_t, size_t *);
170 static int	gnu_add_sparse_entry(struct archive_read *, struct tar *,
171 		    int64_t offset, int64_t remaining);
172 
173 static void	gnu_clear_sparse_list(struct tar *);
174 static int	gnu_sparse_old_read(struct archive_read *, struct tar *,
175 		    const struct archive_entry_header_gnutar *header, int64_t *);
176 static int	gnu_sparse_old_parse(struct archive_read *, struct tar *,
177 		    const struct gnu_sparse *sparse, int length);
178 static int	gnu_sparse_01_parse(struct archive_read *, struct tar *,
179 		    const char *, size_t);
180 static int64_t	gnu_sparse_10_read(struct archive_read *, struct tar *,
181 		    int64_t *);
182 static int	header_Solaris_ACL(struct archive_read *,  struct tar *,
183 		    struct archive_entry *, const void *, int64_t *);
184 static int	header_common(struct archive_read *,  struct tar *,
185 		    struct archive_entry *, const void *);
186 static int	header_old_tar(struct archive_read *, struct tar *,
187 		    struct archive_entry *, const void *);
188 static int	header_pax_extension(struct archive_read *, struct tar *,
189 		    struct archive_entry *, const void *, int64_t *);
190 static int	header_pax_global(struct archive_read *, struct tar *,
191 		    struct archive_entry *, const void *h, int64_t *);
192 static int	header_gnu_longlink(struct archive_read *, struct tar *,
193 		    struct archive_entry *, const void *h, int64_t *);
194 static int	header_gnu_longname(struct archive_read *, struct tar *,
195 		    struct archive_entry *, const void *h, int64_t *);
196 static int	is_mac_metadata_entry(struct archive_entry *entry);
197 static int	read_mac_metadata_blob(struct archive_read *,
198 		    struct archive_entry *, int64_t *);
199 static int	header_volume(struct archive_read *, struct tar *,
200 		    struct archive_entry *, const void *h, int64_t *);
201 static int	header_ustar(struct archive_read *, struct tar *,
202 		    struct archive_entry *, const void *h);
203 static int	header_gnutar(struct archive_read *, struct tar *,
204 		    struct archive_entry *, const void *h, int64_t *);
205 static int	archive_read_format_tar_bid(struct archive_read *, int);
206 static int	archive_read_format_tar_options(struct archive_read *,
207 		    const char *, const char *);
208 static int	archive_read_format_tar_cleanup(struct archive_read *);
209 static int	archive_read_format_tar_read_data(struct archive_read *a,
210 		    const void **buff, size_t *size, int64_t *offset);
211 static int	archive_read_format_tar_skip(struct archive_read *a);
212 static int	archive_read_format_tar_read_header(struct archive_read *,
213 		    struct archive_entry *);
214 static int	checksum(struct archive_read *, const void *);
215 static int 	pax_attribute(struct archive_read *, struct tar *,
216 		    struct archive_entry *, const char *key, size_t key_length,
217 		    size_t value_length, int64_t *unconsumed);
218 static int	pax_attribute_LIBARCHIVE_xattr(struct archive_entry *,
219 		    const char *, size_t, const char *, size_t);
220 static int	pax_attribute_SCHILY_acl(struct archive_read *, struct tar *,
221 		    struct archive_entry *, size_t, int);
222 static int	pax_attribute_SUN_holesdata(struct archive_read *, struct tar *,
223 		    struct archive_entry *, const char *, size_t);
224 static void	pax_time(const char *, size_t, int64_t *sec, long *nanos);
225 static ssize_t	readline(struct archive_read *, struct tar *, const char **,
226 		    ssize_t limit, int64_t *);
227 static int	read_body_to_string(struct archive_read *, struct tar *,
228 		    struct archive_string *, const void *h, int64_t *);
229 static int	read_bytes_to_string(struct archive_read *,
230 		    struct archive_string *, size_t, int64_t *);
231 static int64_t	tar_atol(const char *, size_t);
232 static int64_t	tar_atol10(const char *, size_t);
233 static int64_t	tar_atol256(const char *, size_t);
234 static int64_t	tar_atol8(const char *, size_t);
235 static int	tar_read_header(struct archive_read *, struct tar *,
236 		    struct archive_entry *, int64_t *);
237 static int	tohex(int c);
238 static char	*url_decode(const char *, size_t);
239 static int	tar_flush_unconsumed(struct archive_read *, int64_t *);
240 
241 /* Sanity limits:  These numbers should be low enough to
242  * prevent a maliciously-crafted archive from forcing us to
243  * allocate extreme amounts of memory.  But of course, they
244  * need to be high enough for any correct value.  These
245  * will likely need some adjustment as we get more experience. */
246 static const size_t guname_limit = 65536; /* Longest uname or gname: 64kiB */
247 static const size_t pathname_limit = 1048576; /* Longest path name: 1MiB */
248 static const size_t sparse_map_limit = 8 * 1048576; /* Longest sparse map: 8MiB */
249 static const size_t xattr_limit = 16 * 1048576; /* Longest xattr: 16MiB */
250 static const size_t fflags_limit = 512; /* Longest fflags */
251 static const size_t acl_limit = 131072; /* Longest textual ACL: 128kiB */
252 static const int64_t entry_limit = 0xfffffffffffffffLL; /* 2^60 bytes = 1 ExbiByte */
253 
254 int
archive_read_support_format_gnutar(struct archive * a)255 archive_read_support_format_gnutar(struct archive *a)
256 {
257 	archive_check_magic(a, ARCHIVE_READ_MAGIC,
258 	    ARCHIVE_STATE_NEW, "archive_read_support_format_gnutar");
259 	return (archive_read_support_format_tar(a));
260 }
261 
262 
263 int
archive_read_support_format_tar(struct archive * _a)264 archive_read_support_format_tar(struct archive *_a)
265 {
266 	struct archive_read *a = (struct archive_read *)_a;
267 	struct tar *tar;
268 	int r;
269 
270 	archive_check_magic(_a, ARCHIVE_READ_MAGIC,
271 	    ARCHIVE_STATE_NEW, "archive_read_support_format_tar");
272 
273 	tar = calloc(1, sizeof(*tar));
274 	if (tar == NULL) {
275 		archive_set_error(&a->archive, ENOMEM,
276 		    "Can't allocate tar data");
277 		return (ARCHIVE_FATAL);
278 	}
279 #ifdef HAVE_COPYFILE_H
280 	/* Set this by default on Mac OS. */
281 	tar->process_mac_extensions = 1;
282 #endif
283 
284 	r = __archive_read_register_format(a, tar, "tar",
285 	    archive_read_format_tar_bid,
286 	    archive_read_format_tar_options,
287 	    archive_read_format_tar_read_header,
288 	    archive_read_format_tar_read_data,
289 	    archive_read_format_tar_skip,
290 	    NULL,
291 	    archive_read_format_tar_cleanup,
292 	    NULL,
293 	    NULL);
294 
295 	if (r != ARCHIVE_OK)
296 		free(tar);
297 	return (ARCHIVE_OK);
298 }
299 
300 static int
archive_read_format_tar_cleanup(struct archive_read * a)301 archive_read_format_tar_cleanup(struct archive_read *a)
302 {
303 	struct tar *tar = a->format->data;
304 
305 	gnu_clear_sparse_list(tar);
306 	archive_string_free(&tar->entry_pathname);
307 	archive_string_free(&tar->entry_pathname_override);
308 	archive_string_free(&tar->entry_uname);
309 	archive_string_free(&tar->entry_gname);
310 	archive_string_free(&tar->entry_linkpath);
311 	archive_string_free(&tar->line);
312 	archive_string_free(&tar->localname);
313 	free(tar);
314 	a->format->data = NULL;
315 	return (ARCHIVE_OK);
316 }
317 
318 /*
319  * Validate number field
320  *
321  * This has to be pretty lenient in order to accommodate the enormous
322  * variety of tar writers in the world:
323  *  = POSIX (IEEE Std 1003.1-1988) ustar requires octal values with leading
324  *    zeros and allows fields to be terminated with space or null characters
325  *  = Many writers use different termination (in particular, libarchive
326  *    omits terminator bytes to squeeze one or two more digits)
327  *  = Many writers pad with space and omit leading zeros
328  *  = GNU tar and star write base-256 values if numbers are too
329  *    big to be represented in octal
330  *
331  *  Examples of specific tar headers that we should support:
332  *  = Perl Archive::Tar terminates uid, gid, devminor and devmajor with two
333  *    null bytes, pads size with spaces and other numeric fields with zeroes
334  *  = plexus-archiver prior to 2.6.3 (before switching to commons-compress)
335  *    may have uid and gid fields filled with spaces without any octal digits
336  *    at all and pads all numeric fields with spaces
337  *
338  * This should tolerate all variants in use.  It will reject a field
339  * where the writer just left garbage after a trailing NUL.
340  */
341 static int
validate_number_field(const char * p_field,size_t i_size)342 validate_number_field(const char* p_field, size_t i_size)
343 {
344 	unsigned char marker = (unsigned char)p_field[0];
345 	if (marker == 128 || marker == 255 || marker == 0) {
346 		/* Base-256 marker, there's nothing we can check. */
347 		return 1;
348 	} else {
349 		/* Must be octal */
350 		size_t i = 0;
351 		/* Skip any leading spaces */
352 		while (i < i_size && p_field[i] == ' ') {
353 			++i;
354 		}
355 		/* Skip octal digits. */
356 		while (i < i_size && p_field[i] >= '0' && p_field[i] <= '7') {
357 			++i;
358 		}
359 		/* Any remaining characters must be space or NUL padding. */
360 		while (i < i_size) {
361 			if (p_field[i] != ' ' && p_field[i] != 0) {
362 				return 0;
363 			}
364 			++i;
365 		}
366 		return 1;
367 	}
368 }
369 
370 static int
archive_read_format_tar_bid(struct archive_read * a,int best_bid)371 archive_read_format_tar_bid(struct archive_read *a, int best_bid)
372 {
373 	int bid;
374 	const char *h;
375 	const struct archive_entry_header_ustar *header;
376 
377 	(void)best_bid; /* UNUSED */
378 
379 	bid = 0;
380 
381 	/* Now let's look at the actual header and see if it matches. */
382 	h = __archive_read_ahead(a, 512, NULL);
383 	if (h == NULL)
384 		return (-1);
385 
386 	/* If it's an end-of-archive mark, we can handle it. */
387 	if (h[0] == 0 && archive_block_is_null(h)) {
388 		/*
389 		 * Usually, I bid the number of bits verified, but
390 		 * in this case, 4096 seems excessive so I picked 10 as
391 		 * an arbitrary but reasonable-seeming value.
392 		 */
393 		return (10);
394 	}
395 
396 	/* If it's not an end-of-archive mark, it must have a valid checksum.*/
397 	if (!checksum(a, h))
398 		return (0);
399 	bid += 48;  /* Checksum is usually 6 octal digits. */
400 
401 	header = (const struct archive_entry_header_ustar *)h;
402 
403 	/* Recognize POSIX formats. */
404 	if ((memcmp(header->magic, "ustar\0", 6) == 0)
405 	    && (memcmp(header->version, "00", 2) == 0))
406 		bid += 56;
407 
408 	/* Recognize GNU tar format. */
409 	if ((memcmp(header->magic, "ustar ", 6) == 0)
410 	    && (memcmp(header->version, " \0", 2) == 0))
411 		bid += 56;
412 
413 	/* Type flag must be null, digit or A-Z, a-z. */
414 	if (header->typeflag[0] != 0 &&
415 	    !( header->typeflag[0] >= '0' && header->typeflag[0] <= '9') &&
416 	    !( header->typeflag[0] >= 'A' && header->typeflag[0] <= 'Z') &&
417 	    !( header->typeflag[0] >= 'a' && header->typeflag[0] <= 'z') )
418 		return (0);
419 	bid += 2;  /* 6 bits of variation in an 8-bit field leaves 2 bits. */
420 
421 	/*
422 	 * Check format of mode/uid/gid/mtime/size/rdevmajor/rdevminor fields.
423 	 */
424 	if (validate_number_field(header->mode, sizeof(header->mode)) == 0
425 	    || validate_number_field(header->uid, sizeof(header->uid)) == 0
426 	    || validate_number_field(header->gid, sizeof(header->gid)) == 0
427 	    || validate_number_field(header->mtime, sizeof(header->mtime)) == 0
428 	    || validate_number_field(header->size, sizeof(header->size)) == 0
429 	    || validate_number_field(header->rdevmajor, sizeof(header->rdevmajor)) == 0
430 	    || validate_number_field(header->rdevminor, sizeof(header->rdevminor)) == 0) {
431 		bid = 0;
432 	}
433 
434 	return (bid);
435 }
436 
437 static int
archive_read_format_tar_options(struct archive_read * a,const char * key,const char * val)438 archive_read_format_tar_options(struct archive_read *a,
439     const char *key, const char *val)
440 {
441 	struct tar *tar = a->format->data;
442 	int ret = ARCHIVE_FAILED;
443 
444 	if (strcmp(key, "compat-2x")  == 0) {
445 		/* Handle UTF-8 filenames as libarchive 2.x */
446 		tar->compat_2x = (val != NULL && val[0] != 0);
447 		tar->init_default_conversion = tar->compat_2x;
448 		return (ARCHIVE_OK);
449 	} else if (strcmp(key, "hdrcharset")  == 0) {
450 		if (val == NULL || val[0] == 0)
451 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
452 			    "tar: hdrcharset option needs a character-set name");
453 		else {
454 			tar->opt_sconv =
455 			    archive_string_conversion_from_charset(
456 				&a->archive, val, 0);
457 			if (tar->opt_sconv != NULL)
458 				ret = ARCHIVE_OK;
459 			else
460 				ret = ARCHIVE_FATAL;
461 		}
462 		return (ret);
463 	} else if (strcmp(key, "mac-ext") == 0) {
464 		tar->process_mac_extensions = (val != NULL && val[0] != 0);
465 		return (ARCHIVE_OK);
466 	} else if (strcmp(key, "read_concatenated_archives") == 0) {
467 		tar->read_concatenated_archives = (val != NULL && val[0] != 0);
468 		return (ARCHIVE_OK);
469 	}
470 
471 	/* Note: The "warn" return is just to inform the options
472 	 * supervisor that we didn't handle it.  It will generate
473 	 * a suitable error if no one used this option. */
474 	return (ARCHIVE_WARN);
475 }
476 
477 /* utility function- this exists to centralize the logic of tracking
478  * how much unconsumed data we have floating around, and to consume
479  * anything outstanding since we're going to do read_aheads
480  */
481 static int
tar_flush_unconsumed(struct archive_read * a,int64_t * unconsumed)482 tar_flush_unconsumed(struct archive_read *a, int64_t *unconsumed)
483 {
484 	if (*unconsumed) {
485 /*
486 		void *data = (void *)__archive_read_ahead(a, *unconsumed, NULL);
487 		 * this block of code is to poison claimed unconsumed space, ensuring
488 		 * things break if it is in use still.
489 		 * currently it WILL break things, so enable it only for debugging this issue
490 		if (data) {
491 			memset(data, 0xff, *unconsumed);
492 		}
493 */
494 		int64_t consumed = __archive_read_consume(a, *unconsumed);
495 		if (consumed != *unconsumed) {
496 			return (ARCHIVE_FATAL);
497 		}
498 		*unconsumed = 0;
499 	}
500 	return (ARCHIVE_OK);
501 }
502 
503 /*
504  * The function invoked by archive_read_next_header().  This
505  * just sets up a few things and then calls the internal
506  * tar_read_header() function below.
507  */
508 static int
archive_read_format_tar_read_header(struct archive_read * a,struct archive_entry * entry)509 archive_read_format_tar_read_header(struct archive_read *a,
510     struct archive_entry *entry)
511 {
512 	/*
513 	 * When converting tar archives to cpio archives, it is
514 	 * essential that each distinct file have a distinct inode
515 	 * number.  To simplify this, we keep a static count here to
516 	 * assign fake dev/inode numbers to each tar entry.  Note that
517 	 * pax format archives may overwrite this with something more
518 	 * useful.
519 	 *
520 	 * Ideally, we would track every file read from the archive so
521 	 * that we could assign the same dev/ino pair to hardlinks,
522 	 * but the memory required to store a complete lookup table is
523 	 * probably not worthwhile just to support the relatively
524 	 * obscure tar->cpio conversion case.
525 	 */
526 	struct tar *tar = a->format->data;
527 	const char *p;
528 	const wchar_t *wp;
529 	int r;
530 	size_t l;
531 	int64_t unconsumed = 0;
532 
533 	/* Assign default device/inode values. */
534 	archive_entry_set_dev(entry, 1 + tar->default_dev); /* Don't use zero. */
535 	archive_entry_set_ino(entry, ++tar->default_inode); /* Don't use zero. */
536 	/* Limit generated st_ino number to 16 bits. */
537 	if (tar->default_inode >= 0xffff) {
538 		++tar->default_dev;
539 		tar->default_inode = 0;
540 	}
541 
542 	tar->entry_offset = 0;
543 	gnu_clear_sparse_list(tar);
544 	tar->size_fields = 0; /* We don't have any size info yet */
545 
546 	/* Setup default string conversion. */
547 	tar->sconv = tar->opt_sconv;
548 	if (tar->sconv == NULL) {
549 		if (!tar->init_default_conversion) {
550 			tar->sconv_default =
551 			    archive_string_default_conversion_for_read(&(a->archive));
552 			tar->init_default_conversion = 1;
553 		}
554 		tar->sconv = tar->sconv_default;
555 	}
556 
557 	r = tar_read_header(a, tar, entry, &unconsumed);
558 
559 	tar_flush_unconsumed(a, &unconsumed);
560 
561 	/*
562 	 * "non-sparse" files are really just sparse files with
563 	 * a single block.
564 	 */
565 	if (tar->sparse_list == NULL) {
566 		if (gnu_add_sparse_entry(a, tar, 0, tar->entry_bytes_remaining)
567 		    != ARCHIVE_OK)
568 			return (ARCHIVE_FATAL);
569 	} else {
570 		struct sparse_block *sb;
571 
572 		for (sb = tar->sparse_list; sb != NULL; sb = sb->next) {
573 			if (!sb->hole)
574 				archive_entry_sparse_add_entry(entry,
575 				    sb->offset, sb->remaining);
576 		}
577 	}
578 
579 	if (r == ARCHIVE_OK && archive_entry_filetype(entry) == AE_IFREG) {
580 		/*
581 		 * "Regular" entry with trailing '/' is really
582 		 * directory: This is needed for certain old tar
583 		 * variants and even for some broken newer ones.
584 		 */
585 		if ((p = archive_entry_pathname(entry)) != NULL) {
586 			l = strlen(p);
587 			if (l > 0 && p[l - 1] == '/') {
588 				archive_entry_set_filetype(entry, AE_IFDIR);
589 				tar->entry_bytes_remaining = 0;
590 				tar->entry_padding = 0;
591 			}
592 		} else if ((wp = archive_entry_pathname_w(entry)) != NULL) {
593 			l = wcslen(wp);
594 			if (l > 0 && wp[l - 1] == L'/') {
595 				archive_entry_set_filetype(entry, AE_IFDIR);
596 				tar->entry_bytes_remaining = 0;
597 				tar->entry_padding = 0;
598 			}
599 		}
600 	}
601 	return (r);
602 }
603 
604 static int
archive_read_format_tar_read_data(struct archive_read * a,const void ** buff,size_t * size,int64_t * offset)605 archive_read_format_tar_read_data(struct archive_read *a,
606     const void **buff, size_t *size, int64_t *offset)
607 {
608 	struct tar *tar = a->format->data;
609 	ssize_t bytes_read;
610 	struct sparse_block *p;
611 
612 	for (;;) {
613 		/* Remove exhausted entries from sparse list. */
614 		while (tar->sparse_list != NULL &&
615 		    tar->sparse_list->remaining == 0) {
616 			p = tar->sparse_list;
617 			tar->sparse_list = p->next;
618 			free(p);
619 		}
620 
621 		if (tar->entry_bytes_unconsumed) {
622 			__archive_read_consume(a, tar->entry_bytes_unconsumed);
623 			tar->entry_bytes_unconsumed = 0;
624 		}
625 
626 		/* If we're at end of file, return EOF. */
627 		if (tar->sparse_list == NULL ||
628 		    tar->entry_bytes_remaining == 0) {
629 			int64_t request = tar->entry_bytes_remaining +
630 			    tar->entry_padding;
631 
632 			if (__archive_read_consume(a, request) != request)
633 				return (ARCHIVE_FATAL);
634 			tar->entry_padding = 0;
635 			*buff = NULL;
636 			*size = 0;
637 			*offset = tar->disk_size;
638 			return (ARCHIVE_EOF);
639 		}
640 
641 		*buff = __archive_read_ahead(a, 1, &bytes_read);
642 		if (*buff == NULL) {
643 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
644 			    "Truncated tar archive"
645 			    " detected while reading data");
646 			return (ARCHIVE_FATAL);
647 		}
648 		if (bytes_read > tar->entry_bytes_remaining)
649 			bytes_read = (ssize_t)tar->entry_bytes_remaining;
650 		/* Don't read more than is available in the
651 		 * current sparse block. */
652 		if (tar->sparse_list->remaining < bytes_read)
653 			bytes_read = (ssize_t)tar->sparse_list->remaining;
654 		*size = bytes_read;
655 		*offset = tar->sparse_list->offset;
656 		tar->sparse_list->remaining -= bytes_read;
657 		tar->sparse_list->offset += bytes_read;
658 		tar->entry_bytes_remaining -= bytes_read;
659 		tar->entry_bytes_unconsumed = bytes_read;
660 
661 		if (!tar->sparse_list->hole)
662 			return (ARCHIVE_OK);
663 		/* Current is hole data and skip this. */
664 	}
665 }
666 
667 static int
archive_read_format_tar_skip(struct archive_read * a)668 archive_read_format_tar_skip(struct archive_read *a)
669 {
670 	struct tar *tar = a->format->data;
671 	int64_t request;
672 
673 	request = tar->entry_bytes_remaining + tar->entry_padding +
674 	    tar->entry_bytes_unconsumed;
675 
676 	if (__archive_read_consume(a, request) != request)
677 		return (ARCHIVE_FATAL);
678 
679 	tar->entry_bytes_remaining = 0;
680 	tar->entry_bytes_unconsumed = 0;
681 	tar->entry_padding = 0;
682 
683 	/* Free the sparse list. */
684 	gnu_clear_sparse_list(tar);
685 
686 	return (ARCHIVE_OK);
687 }
688 
689 /*
690  * This function resets the accumulated state while reading
691  * a header.
692  */
693 static void
tar_reset_header_state(struct tar * tar)694 tar_reset_header_state(struct tar *tar)
695 {
696 	tar->pax_hdrcharset_utf8 = 1;
697 	tar->sparse_gnu_attributes_seen = 0;
698 	archive_string_empty(&(tar->entry_gname));
699 	archive_string_empty(&(tar->entry_pathname));
700 	archive_string_empty(&(tar->entry_pathname_override));
701 	archive_string_empty(&(tar->entry_uname));
702 	archive_string_empty(&tar->entry_linkpath);
703 }
704 
705 /*
706  * This function reads and interprets all of the headers associated
707  * with a single entry.
708  */
709 static int
tar_read_header(struct archive_read * a,struct tar * tar,struct archive_entry * entry,int64_t * unconsumed)710 tar_read_header(struct archive_read *a, struct tar *tar,
711     struct archive_entry *entry, int64_t *unconsumed)
712 {
713 	ssize_t bytes;
714 	int err = ARCHIVE_OK, err2;
715 	int eof_fatal = 0; /* EOF is okay at some points... */
716 	const char *h;
717 	const struct archive_entry_header_ustar *header;
718 	const struct archive_entry_header_gnutar *gnuheader;
719 
720 	/* Bitmask of what header types we've seen. */
721 	int32_t seen_headers = 0;
722 	static const int32_t seen_A_header = 1;
723 	static const int32_t seen_g_header = 2;
724 	static const int32_t seen_K_header = 4;
725 	static const int32_t seen_L_header = 8;
726 	static const int32_t seen_V_header = 16;
727 	static const int32_t seen_x_header = 32; /* Also X */
728 	static const int32_t seen_mac_metadata = 512;
729 
730 	tar_reset_header_state(tar);
731 
732 	/* Ensure format is set. */
733 	if (a->archive.archive_format_name == NULL) {
734 		a->archive.archive_format = ARCHIVE_FORMAT_TAR;
735 		a->archive.archive_format_name = "tar";
736 	}
737 
738 	/*
739 	 * TODO: Write global/default pax options into
740 	 * 'entry' struct here before overwriting with
741 	 * file-specific options.
742 	 */
743 
744 	/* Loop over all the headers needed for the next entry */
745 	for (;;) {
746 
747 		/* Find the next valid header record. */
748 		while (1) {
749 			if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
750 				return (ARCHIVE_FATAL);
751 			}
752 
753 			/* Read 512-byte header record */
754 			h = __archive_read_ahead(a, 512, &bytes);
755 			if (bytes == 0) { /* EOF at a block boundary. */
756 				if (eof_fatal) {
757 					/* We've read a special header already;
758 					 * if there's no regular header, then this is
759 					 * a premature EOF. */
760 					archive_set_error(&a->archive, EINVAL,
761 							  "Damaged tar archive (end-of-archive within a sequence of headers)");
762 					return (ARCHIVE_FATAL);
763 				} else {
764 					return (ARCHIVE_EOF);
765 				}
766 			}
767 			if (h == NULL) {  /* Short block at EOF; this is bad. */
768 				archive_set_error(&a->archive,
769 				    ARCHIVE_ERRNO_FILE_FORMAT,
770 				    "Truncated tar archive"
771 				    " detected while reading next header");
772 				return (ARCHIVE_FATAL);
773 			}
774 			*unconsumed += 512;
775 
776 			if (h[0] == 0 && archive_block_is_null(h)) {
777 				/* We found a NULL block which indicates end-of-archive */
778 
779 				if (tar->read_concatenated_archives) {
780 					/* We're ignoring NULL blocks, so keep going. */
781 					continue;
782 				}
783 
784 				/* Try to consume a second all-null record, as well. */
785 				/* If we can't, that's okay. */
786 				tar_flush_unconsumed(a, unconsumed);
787 				h = __archive_read_ahead(a, 512, NULL);
788 				if (h != NULL && h[0] == 0 && archive_block_is_null(h))
789 						__archive_read_consume(a, 512);
790 
791 				archive_clear_error(&a->archive);
792 				return (ARCHIVE_EOF);
793 			}
794 
795 			/* This is NOT a null block, so it must be a valid header. */
796 			if (!checksum(a, h)) {
797 				if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
798 					return (ARCHIVE_FATAL);
799 				}
800 				archive_set_error(&a->archive, EINVAL,
801 						  "Damaged tar archive (bad header checksum)");
802 				/* If we've read some critical information (pax headers, etc)
803 				 * and _then_ see a bad header, we can't really recover. */
804 				if (eof_fatal) {
805 					return (ARCHIVE_FATAL);
806 				} else {
807 					return (ARCHIVE_RETRY);
808 				}
809 			}
810 			break;
811 		}
812 
813 		/* Determine the format variant. */
814 		header = (const struct archive_entry_header_ustar *)h;
815 		switch(header->typeflag[0]) {
816 		case 'A': /* Solaris tar ACL */
817 			if (seen_headers & seen_A_header) {
818 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
819 						  "Redundant 'A' header");
820 				return (ARCHIVE_FATAL);
821 			}
822 			seen_headers |= seen_A_header;
823 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
824 			a->archive.archive_format_name = "Solaris tar";
825 			err2 = header_Solaris_ACL(a, tar, entry, h, unconsumed);
826 			break;
827 		case 'g': /* POSIX-standard 'g' header. */
828 			if (seen_headers & seen_g_header) {
829 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
830 						  "Redundant 'g' header");
831 				return (ARCHIVE_FATAL);
832 			}
833 			seen_headers |= seen_g_header;
834 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
835 			a->archive.archive_format_name = "POSIX pax interchange format";
836 			err2 = header_pax_global(a, tar, entry, h, unconsumed);
837 			break;
838 		case 'K': /* Long link name (GNU tar, others) */
839 			if (seen_headers & seen_K_header) {
840 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
841 						  "Damaged archive: Redundant 'K' headers may cause linknames to be incorrect");
842 				err = err_combine(err, ARCHIVE_WARN);
843 			}
844 			seen_headers |= seen_K_header;
845 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
846 			a->archive.archive_format_name = "GNU tar format";
847 			err2 = header_gnu_longlink(a, tar, entry, h, unconsumed);
848 			break;
849 		case 'L': /* Long filename (GNU tar, others) */
850 			if (seen_headers & seen_L_header) {
851 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
852 						  "Damaged archive: Redundant 'L' headers may cause filenames to be incorrect");
853 				err = err_combine(err, ARCHIVE_WARN);
854 			}
855 			seen_headers |= seen_L_header;
856 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
857 			a->archive.archive_format_name = "GNU tar format";
858 			err2 = header_gnu_longname(a, tar, entry, h, unconsumed);
859 			break;
860 		case 'V': /* GNU volume header */
861 			if (seen_headers & seen_V_header) {
862 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
863 						  "Redundant 'V' header");
864 				err = err_combine(err, ARCHIVE_WARN);
865 			}
866 			seen_headers |= seen_V_header;
867 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
868 			a->archive.archive_format_name = "GNU tar format";
869 			err2 = header_volume(a, tar, entry, h, unconsumed);
870 			break;
871 		case 'X': /* Used by SUN tar; same as 'x'. */
872 			if (seen_headers & seen_x_header) {
873 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
874 						  "Redundant 'X'/'x' header");
875 				return (ARCHIVE_FATAL);
876 			}
877 			seen_headers |= seen_x_header;
878 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
879 			a->archive.archive_format_name =
880 				"POSIX pax interchange format (Sun variant)";
881 			err2 = header_pax_extension(a, tar, entry, h, unconsumed);
882 			break;
883 		case 'x': /* POSIX-standard 'x' header. */
884 			if (seen_headers & seen_x_header) {
885 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
886 						  "Redundant 'x' header");
887 				return (ARCHIVE_FATAL);
888 			}
889 			seen_headers |= seen_x_header;
890 			a->archive.archive_format = ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE;
891 			a->archive.archive_format_name = "POSIX pax interchange format";
892 			err2 = header_pax_extension(a, tar, entry, h, unconsumed);
893 			break;
894 		default: /* Regular header: Legacy tar, GNU tar, or ustar */
895 			gnuheader = (const struct archive_entry_header_gnutar *)h;
896 			if (memcmp(gnuheader->magic, "ustar  \0", 8) == 0) {
897 				a->archive.archive_format = ARCHIVE_FORMAT_TAR_GNUTAR;
898 				a->archive.archive_format_name = "GNU tar format";
899 				err2 = header_gnutar(a, tar, entry, h, unconsumed);
900 			} else if (memcmp(header->magic, "ustar", 5) == 0) {
901 				if (a->archive.archive_format != ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE) {
902 					a->archive.archive_format = ARCHIVE_FORMAT_TAR_USTAR;
903 					a->archive.archive_format_name = "POSIX ustar format";
904 				}
905 				err2 = header_ustar(a, tar, entry, h);
906 			} else {
907 				a->archive.archive_format = ARCHIVE_FORMAT_TAR;
908 				a->archive.archive_format_name = "tar (non-POSIX)";
909 				err2 = header_old_tar(a, tar, entry, h);
910 			}
911 			err = err_combine(err, err2);
912 			/* We return warnings or success as-is.  Anything else is fatal. */
913 			if (err < ARCHIVE_WARN) {
914 				return (ARCHIVE_FATAL);
915 			}
916 			/* Filename of the form `._filename` is an AppleDouble
917 			 * extension entry.  The body is the macOS metadata blob;
918 			 * this is followed by another entry with the actual
919 			 * regular file data.
920 			 * This design has two drawbacks:
921 			 * = it's brittle; you might just have a file with such a name
922 			 * = it duplicates any long pathname extensions
923 			 *
924 			 * TODO: This probably shouldn't be here at all.  Consider
925 			 * just returning the contents as a regular entry here and
926 			 * then dealing with it when we write data to disk.
927 			 */
928 			if (tar->process_mac_extensions
929 			    && ((seen_headers & seen_mac_metadata) == 0)
930 			    && is_mac_metadata_entry(entry)) {
931 				err2 = read_mac_metadata_blob(a, entry, unconsumed);
932 				if (err2 < ARCHIVE_WARN) {
933 					return (ARCHIVE_FATAL);
934 				}
935 				err = err_combine(err, err2);
936 				/* Note: Other headers can appear again. */
937 				seen_headers = seen_mac_metadata;
938 				tar_reset_header_state(tar);
939 				break;
940 			}
941 
942 			/* Reconcile GNU sparse attributes */
943 			if (tar->sparse_gnu_attributes_seen) {
944 				/* Only 'S' (GNU sparse) and ustar '0' regular files can be sparse */
945 				if (tar->filetype != 'S' && tar->filetype != '0') {
946 					archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
947 							  "Non-regular file cannot be sparse");
948 					return (ARCHIVE_WARN);
949 				} else if (tar->sparse_gnu_major == 0 &&
950 				    tar->sparse_gnu_minor == 0) {
951 					/* Sparse map already parsed from 'x' header */
952 				} else if (tar->sparse_gnu_major == 0 &&
953 				    tar->sparse_gnu_minor == 1) {
954 					/* Sparse map already parsed from 'x' header */
955 				} else if (tar->sparse_gnu_major == 1 &&
956 				    tar->sparse_gnu_minor == 0) {
957 					/* Sparse map is prepended to file contents */
958 					ssize_t bytes_read;
959 					bytes_read = gnu_sparse_10_read(a, tar, unconsumed);
960 					if (bytes_read < 0)
961 						return ((int)bytes_read);
962 					tar->entry_bytes_remaining -= bytes_read;
963 				} else {
964 					archive_set_error(&a->archive,
965 							  ARCHIVE_ERRNO_MISC,
966 							  "Unrecognized GNU sparse file format");
967 					return (ARCHIVE_WARN);
968 				}
969 			}
970 			return (err);
971 		}
972 
973 		/* We're between headers ... */
974 		err = err_combine(err, err2);
975 		if (err == ARCHIVE_FATAL)
976 			return (err);
977 
978 		/* The GNU volume header and the pax `g` global header
979 		 * are both allowed to be the only header in an
980 		 * archive.  If we've seen any other header, a
981 		 * following EOF is fatal. */
982 		if ((seen_headers & ~seen_V_header & ~seen_g_header) != 0) {
983 			eof_fatal = 1;
984 		}
985 	}
986 }
987 
988 /*
989  * Return true if block checksum is correct.
990  */
991 static int
checksum(struct archive_read * a,const void * h)992 checksum(struct archive_read *a, const void *h)
993 {
994 	const unsigned char *bytes;
995 	const struct archive_entry_header_ustar	*header;
996 	int check, sum;
997 	size_t i;
998 
999 	(void)a; /* UNUSED */
1000 	bytes = (const unsigned char *)h;
1001 	header = (const struct archive_entry_header_ustar *)h;
1002 
1003 	/* Checksum field must hold an octal number */
1004 	for (i = 0; i < sizeof(header->checksum); ++i) {
1005 		char c = header->checksum[i];
1006 		if (c != ' ' && c != '\0' && (c < '0' || c > '7'))
1007 			return 0;
1008 	}
1009 
1010 	/*
1011 	 * Test the checksum.  Note that POSIX specifies _unsigned_
1012 	 * bytes for this calculation.
1013 	 */
1014 	sum = (int)tar_atol(header->checksum, sizeof(header->checksum));
1015 	check = 0;
1016 	for (i = 0; i < 148; i++)
1017 		check += (unsigned char)bytes[i];
1018 	for (; i < 156; i++)
1019 		check += 32;
1020 	for (; i < 512; i++)
1021 		check += (unsigned char)bytes[i];
1022 	if (sum == check)
1023 		return (1);
1024 
1025 	/*
1026 	 * Repeat test with _signed_ bytes, just in case this archive
1027 	 * was created by an old BSD, Solaris, or HP-UX tar with a
1028 	 * broken checksum calculation.
1029 	 */
1030 	check = 0;
1031 	for (i = 0; i < 148; i++)
1032 		check += (signed char)bytes[i];
1033 	for (; i < 156; i++)
1034 		check += 32;
1035 	for (; i < 512; i++)
1036 		check += (signed char)bytes[i];
1037 	if (sum == check)
1038 		return (1);
1039 
1040 #if DONT_FAIL_ON_CRC_ERROR
1041 	/* Speed up fuzzing by pretending the checksum is always right. */
1042 	return (1);
1043 #else
1044 	return (0);
1045 #endif
1046 }
1047 
1048 /*
1049  * Return true if this block contains only nulls.
1050  */
1051 static int
archive_block_is_null(const char * p)1052 archive_block_is_null(const char *p)
1053 {
1054 	unsigned i;
1055 
1056 	for (i = 0; i < 512; i++)
1057 		if (*p++)
1058 			return (0);
1059 	return (1);
1060 }
1061 
1062 /*
1063  * Interpret 'A' Solaris ACL header
1064  */
1065 static int
header_Solaris_ACL(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1066 header_Solaris_ACL(struct archive_read *a, struct tar *tar,
1067     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1068 {
1069 	struct archive_string	 acl_text;
1070 	size_t size;
1071 	int err, acl_type;
1072 	uint64_t type;
1073 	char *acl, *p;
1074 
1075 	archive_string_init(&acl_text);
1076 	err = read_body_to_string(a, tar, &acl_text, h, unconsumed);
1077 	if (err != ARCHIVE_OK) {
1078 		archive_string_free(&acl_text);
1079 		return (err);
1080 	}
1081 	size = archive_strlen(&acl_text);
1082 
1083 	/* TODO: Examine the first characters to see if this
1084 	 * is an AIX ACL descriptor.  We'll likely never support
1085 	 * them, but it would be polite to recognize and warn when
1086 	 * we do see them. */
1087 
1088 	/* Leading octal number indicates ACL type and number of entries. */
1089 	p = acl = acl_text.s;
1090 	type = 0;
1091 	while (*p != '\0' && p < acl + size) {
1092 		if (*p < '0' || *p > '7') {
1093 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1094 			    "Malformed Solaris ACL attribute (invalid digit)");
1095 			archive_string_free(&acl_text);
1096 			return(ARCHIVE_WARN);
1097 		}
1098 		type <<= 3;
1099 		type += *p - '0';
1100 		if (type > 077777777) {
1101 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1102 			    "Malformed Solaris ACL attribute (count too large)");
1103 			archive_string_free(&acl_text);
1104 			return (ARCHIVE_WARN);
1105 		}
1106 		p++;
1107 	}
1108 	switch (type & ~0777777) {
1109 	case 01000000:
1110 		/* POSIX.1e ACL */
1111 		acl_type = ARCHIVE_ENTRY_ACL_TYPE_ACCESS;
1112 		break;
1113 	case 03000000:
1114 		/* NFSv4 ACL */
1115 		acl_type = ARCHIVE_ENTRY_ACL_TYPE_NFS4;
1116 		break;
1117 	default:
1118 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1119 		    "Malformed Solaris ACL attribute (unsupported type %llu)",
1120 		    (unsigned long long)type);
1121 		archive_string_free(&acl_text);
1122 		return (ARCHIVE_WARN);
1123 	}
1124 	p++;
1125 
1126 	if (p >= acl + size) {
1127 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1128 		    "Malformed Solaris ACL attribute (body overflow)");
1129 		archive_string_free(&acl_text);
1130 		return(ARCHIVE_WARN);
1131 	}
1132 
1133 	/* ACL text is null-terminated; find the end. */
1134 	size -= (p - acl);
1135 	acl = p;
1136 
1137 	while (*p != '\0' && p < acl + size)
1138 		p++;
1139 
1140 	if (tar->sconv_acl == NULL) {
1141 		tar->sconv_acl = archive_string_conversion_from_charset(
1142 		    &(a->archive), "UTF-8", 1);
1143 		if (tar->sconv_acl == NULL) {
1144 			archive_string_free(&acl_text);
1145 			return (ARCHIVE_FATAL);
1146 		}
1147 	}
1148 	archive_strncpy(&(tar->localname), acl, p - acl);
1149 	err = archive_acl_from_text_l(archive_entry_acl(entry),
1150 	    tar->localname.s, acl_type, tar->sconv_acl);
1151 	/* Workaround: Force perm_is_set() to be correct */
1152 	/* If this bit were stored in the ACL, this wouldn't be needed */
1153 	archive_entry_set_perm(entry, archive_entry_perm(entry));
1154 	if (err != ARCHIVE_OK) {
1155 		if (errno == ENOMEM) {
1156 			archive_set_error(&a->archive, ENOMEM,
1157 			    "Can't allocate memory for ACL");
1158 		} else
1159 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1160 			    "Malformed Solaris ACL attribute (unparsable)");
1161 	}
1162 	archive_string_free(&acl_text);
1163 	return (err);
1164 }
1165 
1166 /*
1167  * Interpret 'K' long linkname header.
1168  */
1169 static int
header_gnu_longlink(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1170 header_gnu_longlink(struct archive_read *a, struct tar *tar,
1171     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1172 {
1173 	int err;
1174 
1175 	struct archive_string linkpath;
1176 	archive_string_init(&linkpath);
1177 	err = read_body_to_string(a, tar, &linkpath, h, unconsumed);
1178 	if (err == ARCHIVE_OK) {
1179 		archive_entry_set_link(entry, linkpath.s);
1180 	}
1181 	archive_string_free(&linkpath);
1182 	return (err);
1183 }
1184 
1185 static int
set_conversion_failed_error(struct archive_read * a,struct archive_string_conv * sconv,const char * name)1186 set_conversion_failed_error(struct archive_read *a,
1187     struct archive_string_conv *sconv, const char *name)
1188 {
1189 	if (errno == ENOMEM) {
1190 		archive_set_error(&a->archive, ENOMEM,
1191 		    "Can't allocate memory for %s", name);
1192 		return (ARCHIVE_FATAL);
1193 	}
1194 	archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
1195 	    "%s can't be converted from %s to current locale",
1196 	    name, archive_string_conversion_charset_name(sconv));
1197 	return (ARCHIVE_WARN);
1198 }
1199 
1200 /*
1201  * Interpret 'L' long filename header.
1202  */
1203 static int
header_gnu_longname(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1204 header_gnu_longname(struct archive_read *a, struct tar *tar,
1205     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1206 {
1207 	int err;
1208 	struct archive_string longname;
1209 
1210 	archive_string_init(&longname);
1211 	err = read_body_to_string(a, tar, &longname, h, unconsumed);
1212 	if (err == ARCHIVE_OK) {
1213 		if (archive_entry_copy_pathname_l(entry, longname.s,
1214 		    archive_strlen(&longname), tar->sconv) != 0)
1215 			err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1216 	}
1217 	archive_string_free(&longname);
1218 	return (err);
1219 }
1220 
1221 /*
1222  * Interpret 'V' GNU tar volume header.
1223  */
1224 static int
header_volume(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1225 header_volume(struct archive_read *a, struct tar *tar,
1226     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1227 {
1228 	const struct archive_entry_header_ustar *header;
1229 	int64_t size, to_consume;
1230 
1231 	(void)a; /* UNUSED */
1232 	(void)tar; /* UNUSED */
1233 	(void)entry; /* UNUSED */
1234 
1235 	header = (const struct archive_entry_header_ustar *)h;
1236 	size = tar_atol(header->size, sizeof(header->size));
1237 	if (size < 0 || size > (int64_t)pathname_limit) {
1238 		return (ARCHIVE_FATAL);
1239 	}
1240 	to_consume = ((size + 511) & ~511);
1241 	*unconsumed += to_consume;
1242 	return (ARCHIVE_OK);
1243 }
1244 
1245 /*
1246  * Read the next `size` bytes into the provided string.
1247  * Null-terminate the string.
1248  */
1249 static int
read_bytes_to_string(struct archive_read * a,struct archive_string * as,size_t size,int64_t * unconsumed)1250 read_bytes_to_string(struct archive_read *a,
1251 		     struct archive_string *as, size_t size,
1252 		     int64_t *unconsumed) {
1253 	const void *src;
1254 
1255 	/* Fail if we can't make our buffer big enough. */
1256 	if (archive_string_ensure(as, size + 1) == NULL) {
1257 		archive_set_error(&a->archive, ENOMEM,
1258 		    "No memory");
1259 		return (ARCHIVE_FATAL);
1260 	}
1261 
1262 	if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1263 		return (ARCHIVE_FATAL);
1264 	}
1265 
1266 	/* Read the body into the string. */
1267 	src = __archive_read_ahead(a, size, NULL);
1268 	if (src == NULL) {
1269 		archive_set_error(&a->archive, EINVAL,
1270 		    "Truncated archive"
1271 		    " detected while reading metadata");
1272 		*unconsumed = 0;
1273 		return (ARCHIVE_FATAL);
1274 	}
1275 	memcpy(as->s, src, size);
1276 	as->s[size] = '\0';
1277 	as->length = size;
1278 	*unconsumed += size;
1279 	return (ARCHIVE_OK);
1280 }
1281 
1282 /*
1283  * Read body of an archive entry into an archive_string object.
1284  */
1285 static int
read_body_to_string(struct archive_read * a,struct tar * tar,struct archive_string * as,const void * h,int64_t * unconsumed)1286 read_body_to_string(struct archive_read *a, struct tar *tar,
1287     struct archive_string *as, const void *h, int64_t *unconsumed)
1288 {
1289 	int64_t size;
1290 	const struct archive_entry_header_ustar *header;
1291 	int r;
1292 
1293 	(void)tar; /* UNUSED */
1294 	header = (const struct archive_entry_header_ustar *)h;
1295 	size  = tar_atol(header->size, sizeof(header->size));
1296 	if (size < 0 || size > entry_limit) {
1297 		archive_set_error(&a->archive, EINVAL,
1298 		    "Special header has invalid size: %lld",
1299 		    (long long)size);
1300 		return (ARCHIVE_FATAL);
1301 	}
1302 	if (size > (int64_t)pathname_limit) {
1303 		archive_string_empty(as);
1304 		int64_t to_consume = ((size + 511) & ~511);
1305 		if (to_consume != __archive_read_consume(a, to_consume)) {
1306 			return (ARCHIVE_FATAL);
1307 		}
1308 		archive_set_error(&a->archive, EINVAL,
1309 		    "Special header too large: %lld > 1MiB",
1310 		    (long long)size);
1311 		return (ARCHIVE_WARN);
1312 	}
1313 	r = read_bytes_to_string(a, as, size, unconsumed);
1314 	*unconsumed += 0x1ff & (-size);
1315 	return(r);
1316 }
1317 
1318 /*
1319  * Parse out common header elements.
1320  *
1321  * This would be the same as header_old_tar, except that the
1322  * filename is handled slightly differently for old and POSIX
1323  * entries  (POSIX entries support a 'prefix').  This factoring
1324  * allows header_old_tar and header_ustar
1325  * to handle filenames differently, while still putting most of the
1326  * common parsing into one place.
1327  *
1328  * This is called _after_ ustar, GNU tar, Schily, etc, special
1329  * fields have already been parsed into the `tar` structure.
1330  * So we can make final decisions here about how to reconcile
1331  * size, mode, etc, information.
1332  */
1333 static int
header_common(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1334 header_common(struct archive_read *a, struct tar *tar,
1335     struct archive_entry *entry, const void *h)
1336 {
1337 	const struct archive_entry_header_ustar	*header;
1338 	const char *existing_linkpath;
1339 	const wchar_t *existing_wcs_linkpath;
1340 	mode_t header_mode;
1341 	int     err = ARCHIVE_OK;
1342 
1343 	header = (const struct archive_entry_header_ustar *)h;
1344 
1345 	/* Parse out the numeric fields (all are octal) */
1346 
1347 	/* Split mode handling: Set filetype always, perm only if not already set */
1348 	header_mode = (mode_t)tar_atol(header->mode, sizeof(header->mode));
1349 	archive_entry_set_filetype(entry, header_mode);
1350 	if (!archive_entry_perm_is_set(entry))
1351 		archive_entry_set_perm(entry, header_mode);
1352 
1353 	/* Set uid, gid, mtime if not already set */
1354 	if (!archive_entry_uid_is_set(entry)) {
1355 		archive_entry_set_uid(entry, tar_atol(header->uid, sizeof(header->uid)));
1356 	}
1357 	if (!archive_entry_gid_is_set(entry)) {
1358 		archive_entry_set_gid(entry, tar_atol(header->gid, sizeof(header->gid)));
1359 	}
1360 	if (!archive_entry_mtime_is_set(entry)) {
1361 		int64_t t64 = tar_atol(header->mtime, sizeof(header->mtime));
1362 		time_t t = (time_t)t64;
1363 		if ((int64_t)t != t64) { /* time_t overflowed */
1364 			t = TIME_MAX;
1365 		}
1366 		archive_entry_set_mtime(entry, t, 0);
1367 	}
1368 
1369 	/* Reconcile the size info. */
1370 	/* First, how big is the file on disk? */
1371 	if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_REALSIZE) != 0) {
1372 		/* GNU sparse format 1.0 uses `GNU.sparse.realsize`
1373 		 * to hold the size of the file on disk. */
1374 		tar->disk_size = tar->GNU_sparse_realsize;
1375 	} else if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_SIZE) != 0
1376 		   && (tar->sparse_gnu_major == 0)) {
1377 		/* GNU sparse format 0.0 and 0.1 use `GNU.sparse.size`
1378 		 * to hold the size of the file on disk. */
1379 		tar->disk_size = tar->GNU_sparse_size;
1380 	} else if ((tar->size_fields & TAR_SIZE_SCHILY_SPARSE_REALSIZE) != 0) {
1381 		tar->disk_size = tar->SCHILY_sparse_realsize;
1382 	} else if ((tar->size_fields & TAR_SIZE_PAX_SIZE) != 0) {
1383 		tar->disk_size = tar->pax_size;
1384 	} else {
1385 		/* There wasn't a suitable pax header, so use the ustar info */
1386 		tar->disk_size = tar_atol(header->size, sizeof(header->size));
1387 	}
1388 
1389 	if (tar->disk_size < 0) {
1390 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1391 				  "Tar entry has negative file size");
1392 		return (ARCHIVE_FATAL);
1393 	} else if (tar->disk_size > entry_limit) {
1394 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1395 				  "Tar entry size overflow");
1396 		return (ARCHIVE_FATAL);
1397 	} else {
1398 		archive_entry_set_size(entry, tar->disk_size);
1399 	}
1400 
1401 	/* Second, how big is the data in the archive? */
1402 	if ((tar->size_fields & TAR_SIZE_GNU_SPARSE_SIZE) != 0
1403 	    && (tar->sparse_gnu_major == 1)) {
1404 		/* GNU sparse format 1.0 uses `GNU.sparse.size`
1405 		 * to hold the size of the data in the archive. */
1406 		tar->entry_bytes_remaining = tar->GNU_sparse_size;
1407 	} else if ((tar->size_fields & TAR_SIZE_PAX_SIZE) != 0) {
1408 		tar->entry_bytes_remaining = tar->pax_size;
1409 	} else {
1410 		tar->entry_bytes_remaining
1411 			= tar_atol(header->size, sizeof(header->size));
1412 	}
1413 	if (tar->entry_bytes_remaining < 0) {
1414 		tar->entry_bytes_remaining = 0;
1415 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1416 				  "Tar entry has negative size");
1417 		return (ARCHIVE_FATAL);
1418 	} else if (tar->entry_bytes_remaining > entry_limit) {
1419 		tar->entry_bytes_remaining = 0;
1420 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1421 				  "Tar entry size overflow");
1422 		return (ARCHIVE_FATAL);
1423 	}
1424 
1425 	/* Handle the tar type flag appropriately. */
1426 	tar->filetype = header->typeflag[0];
1427 
1428 	/*
1429 	 * TODO: If the linkpath came from Pax extension header, then
1430 	 * we should obey the hdrcharset_utf8 flag when converting these.
1431 	 */
1432 	switch (tar->filetype) {
1433 	case '1': /* Hard link */
1434 		archive_entry_set_link_to_hardlink(entry);
1435 		existing_wcs_linkpath = archive_entry_hardlink_w(entry);
1436 		existing_linkpath = archive_entry_hardlink(entry);
1437 		if ((existing_linkpath == NULL || existing_linkpath[0] == '\0')
1438 		    && (existing_wcs_linkpath == NULL || existing_wcs_linkpath[0] == '\0')) {
1439 			struct archive_string linkpath;
1440 			archive_string_init(&linkpath);
1441 			archive_strncpy(&linkpath,
1442 					header->linkname, sizeof(header->linkname));
1443 			if (archive_entry_copy_hardlink_l(entry, linkpath.s,
1444 							  archive_strlen(&linkpath), tar->sconv) != 0) {
1445 				err = set_conversion_failed_error(a, tar->sconv,
1446 								  "Linkname");
1447 				if (err == ARCHIVE_FATAL) {
1448 					archive_string_free(&linkpath);
1449 					return (err);
1450 				}
1451 			}
1452 			archive_string_free(&linkpath);
1453 		}
1454 		/*
1455 		 * The following may seem odd, but: Technically, tar
1456 		 * does not store the file type for a "hard link"
1457 		 * entry, only the fact that it is a hard link.  So, I
1458 		 * leave the type zero normally.  But, pax interchange
1459 		 * format allows hard links to have data, which
1460 		 * implies that the underlying entry is a regular
1461 		 * file.
1462 		 */
1463 		if (archive_entry_size(entry) > 0)
1464 			archive_entry_set_filetype(entry, AE_IFREG);
1465 
1466 		/*
1467 		 * A tricky point: Traditionally, tar readers have
1468 		 * ignored the size field when reading hardlink
1469 		 * entries, and some writers put non-zero sizes even
1470 		 * though the body is empty.  POSIX blessed this
1471 		 * convention in the 1988 standard, but broke with
1472 		 * this tradition in 2001 by permitting hardlink
1473 		 * entries to store valid bodies in pax interchange
1474 		 * format, but not in ustar format.  Since there is no
1475 		 * hard and fast way to distinguish pax interchange
1476 		 * from earlier archives (the 'x' and 'g' entries are
1477 		 * optional, after all), we need a heuristic.
1478 		 */
1479 		if (archive_entry_size(entry) == 0) {
1480 			/* If the size is already zero, we're done. */
1481 		}  else if (a->archive.archive_format
1482 		    == ARCHIVE_FORMAT_TAR_PAX_INTERCHANGE) {
1483 			/* Definitely pax extended; must obey hardlink size. */
1484 		} else if (a->archive.archive_format == ARCHIVE_FORMAT_TAR
1485 		    || a->archive.archive_format == ARCHIVE_FORMAT_TAR_GNUTAR)
1486 		{
1487 			/* Old-style or GNU tar: we must ignore the size. */
1488 			archive_entry_set_size(entry, 0);
1489 			tar->entry_bytes_remaining = 0;
1490 		} else if (archive_read_format_tar_bid(a, 50) > 50) {
1491 			/*
1492 			 * We don't know if it's pax: If the bid
1493 			 * function sees a valid ustar header
1494 			 * immediately following, then let's ignore
1495 			 * the hardlink size.
1496 			 */
1497 			archive_entry_set_size(entry, 0);
1498 			tar->entry_bytes_remaining = 0;
1499 		}
1500 		/*
1501 		 * TODO: There are still two cases I'd like to handle:
1502 		 *   = a ustar non-pax archive with a hardlink entry at
1503 		 *     end-of-archive.  (Look for block of nulls following?)
1504 		 *   = a pax archive that has not seen any pax headers
1505 		 *     and has an entry which is a hardlink entry storing
1506 		 *     a body containing an uncompressed tar archive.
1507 		 * The first is worth addressing; I don't see any reliable
1508 		 * way to deal with the second possibility.
1509 		 */
1510 		break;
1511 	case '2': /* Symlink */
1512 		archive_entry_set_link_to_symlink(entry);
1513 		existing_wcs_linkpath = archive_entry_symlink_w(entry);
1514 		existing_linkpath = archive_entry_symlink(entry);
1515 		if ((existing_linkpath == NULL || existing_linkpath[0] == '\0')
1516 		    && (existing_wcs_linkpath == NULL || existing_wcs_linkpath[0] == '\0')) {
1517 			struct archive_string linkpath;
1518 			archive_string_init(&linkpath);
1519 			archive_strncpy(&linkpath,
1520 					header->linkname, sizeof(header->linkname));
1521 			if (archive_entry_copy_symlink_l(entry, linkpath.s,
1522 			    archive_strlen(&linkpath), tar->sconv) != 0) {
1523 				err = set_conversion_failed_error(a, tar->sconv,
1524 				    "Linkname");
1525 				if (err == ARCHIVE_FATAL) {
1526 					archive_string_free(&linkpath);
1527 					return (err);
1528 				}
1529 			}
1530 			archive_string_free(&linkpath);
1531 		}
1532 		archive_entry_set_filetype(entry, AE_IFLNK);
1533 		archive_entry_set_size(entry, 0);
1534 		tar->entry_bytes_remaining = 0;
1535 		break;
1536 	case '3': /* Character device */
1537 		archive_entry_set_filetype(entry, AE_IFCHR);
1538 		archive_entry_set_size(entry, 0);
1539 		tar->entry_bytes_remaining = 0;
1540 		break;
1541 	case '4': /* Block device */
1542 		archive_entry_set_filetype(entry, AE_IFBLK);
1543 		archive_entry_set_size(entry, 0);
1544 		tar->entry_bytes_remaining = 0;
1545 		break;
1546 	case '5': /* Dir */
1547 		archive_entry_set_filetype(entry, AE_IFDIR);
1548 		archive_entry_set_size(entry, 0);
1549 		tar->entry_bytes_remaining = 0;
1550 		break;
1551 	case '6': /* FIFO device */
1552 		archive_entry_set_filetype(entry, AE_IFIFO);
1553 		archive_entry_set_size(entry, 0);
1554 		tar->entry_bytes_remaining = 0;
1555 		break;
1556 	case 'D': /* GNU incremental directory type */
1557 		/*
1558 		 * No special handling is actually required here.
1559 		 * It might be nice someday to preprocess the file list and
1560 		 * provide it to the client, though.
1561 		 */
1562 		archive_entry_set_filetype(entry, AE_IFDIR);
1563 		break;
1564 	case 'M': /* GNU "Multi-volume" (remainder of file from last archive)*/
1565 		/*
1566 		 * As far as I can tell, this is just like a regular file
1567 		 * entry, except that the contents should be _appended_ to
1568 		 * the indicated file at the indicated offset.  This may
1569 		 * require some API work to fully support.
1570 		 */
1571 		break;
1572 	case 'N': /* Old GNU "long filename" entry. */
1573 		/* The body of this entry is a script for renaming
1574 		 * previously-extracted entries.  Ugh.  It will never
1575 		 * be supported by libarchive. */
1576 		archive_entry_set_filetype(entry, AE_IFREG);
1577 		break;
1578 	case 'S': /* GNU sparse files */
1579 		/*
1580 		 * Sparse files are really just regular files with
1581 		 * sparse information in the extended area.
1582 		 */
1583 		/* FALLTHROUGH */
1584 	case '0': /* ustar "regular" file */
1585 		/* FALLTHROUGH */
1586 	default: /* Non-standard file types */
1587 		/*
1588 		 * Per POSIX: non-recognized types should always be
1589 		 * treated as regular files.
1590 		 */
1591 		archive_entry_set_filetype(entry, AE_IFREG);
1592 		break;
1593 	}
1594 	return (err);
1595 }
1596 
1597 /*
1598  * Parse out header elements for "old-style" tar archives.
1599  */
1600 static int
header_old_tar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1601 header_old_tar(struct archive_read *a, struct tar *tar,
1602     struct archive_entry *entry, const void *h)
1603 {
1604 	const struct archive_entry_header_ustar	*header;
1605 	int err = ARCHIVE_OK, err2;
1606 
1607 	/*
1608 	 * Copy filename over (to ensure null termination).
1609 	 * Skip if pathname was already set e.g. by header_gnu_longname()
1610 	 */
1611 	header = (const struct archive_entry_header_ustar *)h;
1612 
1613 	const char *existing_pathname = archive_entry_pathname(entry);
1614 	const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
1615 	if ((existing_pathname == NULL || existing_pathname[0] == '\0')
1616 	    && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == '\0') &&
1617 	    archive_entry_copy_pathname_l(entry,
1618 	    header->name, sizeof(header->name), tar->sconv) != 0) {
1619 		err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1620 		if (err == ARCHIVE_FATAL)
1621 			return (err);
1622 	}
1623 
1624 	/* Grab rest of common fields */
1625 	err2 = header_common(a, tar, entry, h);
1626 	if (err > err2)
1627 		err = err2;
1628 
1629 	tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
1630 	return (err);
1631 }
1632 
1633 /*
1634  * Is this likely an AppleDouble extension?
1635  */
1636 static int
is_mac_metadata_entry(struct archive_entry * entry)1637 is_mac_metadata_entry(struct archive_entry *entry) {
1638 	const char *p, *name;
1639 	const wchar_t *wp, *wname;
1640 
1641 	name = p = archive_entry_pathname(entry);
1642 	if (p != NULL) {
1643 		/* Find the last path element. */
1644 		for (; *p != '\0'; ++p) {
1645 			if (p[0] == '/' && p[1] != '\0')
1646 				name = p + 1;
1647 		}
1648 		/*
1649 		 * If last path element starts with "._", then
1650 		 * this is a Mac extension.
1651 		 */
1652 		if (name[0] == '.' && name[1] == '_' && name[2] != '\0')
1653 			return 1;
1654 	} else {
1655 		/* Find the last path element. */
1656 		wname = wp = archive_entry_pathname_w(entry);
1657 		if (wp == NULL)
1658 			return 0;
1659 		for (; *wp != L'\0'; ++wp) {
1660 			if (wp[0] == L'/' && wp[1] != L'\0')
1661 				wname = wp + 1;
1662 		}
1663 		/*
1664 		 * If last path element starts with "._", then
1665 		 * this is a Mac extension.
1666 		 */
1667 		if (wname[0] == L'.' && wname[1] == L'_' && wname[2] != L'\0')
1668 			return 1;
1669 	}
1670 	/* Not a mac extension */
1671 	return 0;
1672 }
1673 
1674 /*
1675  * Read a Mac AppleDouble-encoded blob of file metadata,
1676  * if there is one.
1677  *
1678  * TODO: In Libarchive 4, we should consider ripping this
1679  * out -- instead, return a file starting with `._` as
1680  * a regular file and let the client (or archive_write logic)
1681  * handle it.
1682  */
1683 static int
read_mac_metadata_blob(struct archive_read * a,struct archive_entry * entry,int64_t * unconsumed)1684 read_mac_metadata_blob(struct archive_read *a,
1685     struct archive_entry *entry, int64_t *unconsumed)
1686 {
1687 	int64_t size;
1688 	size_t msize;
1689 	const void *data;
1690 
1691  	/* Read the body as a Mac OS metadata blob. */
1692 	size = archive_entry_size(entry);
1693 	msize = (size_t)size;
1694 	if (size < 0 || (uintmax_t)msize != (uintmax_t)size) {
1695 		*unconsumed = 0;
1696 		return (ARCHIVE_FATAL);
1697 	}
1698 
1699 	/* TODO: Should this merely skip the overlarge entry and
1700 	 * WARN?  Or is xattr_limit sufficiently large that we can
1701 	 * safely assume anything larger is malicious? */
1702 	if (size > (int64_t)xattr_limit) {
1703 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1704 		    "Oversized AppleDouble extension has size %llu > %llu",
1705 		    (unsigned long long)size,
1706 		    (unsigned long long)xattr_limit);
1707 		return (ARCHIVE_FATAL);
1708 	}
1709 
1710 	/*
1711 	 * TODO: Look beyond the body here to peek at the next header.
1712 	 * If it's a regular header (not an extension header)
1713 	 * that has the wrong name, just return the current
1714 	 * entry as-is, without consuming the body here.
1715 	 * That would reduce the risk of us mis-identifying
1716 	 * an ordinary file that just happened to have
1717 	 * a name starting with "._".
1718 	 *
1719 	 * Q: Is the above idea really possible?  Even
1720 	 * when there are GNU or pax extension entries?
1721 	 */
1722 	if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1723 		return (ARCHIVE_FATAL);
1724 	}
1725 	data = __archive_read_ahead(a, msize, NULL);
1726 	if (data == NULL) {
1727 		archive_set_error(&a->archive, EINVAL,
1728 		    "Truncated archive"
1729 		    " detected while reading macOS metadata");
1730 		*unconsumed = 0;
1731 		return (ARCHIVE_FATAL);
1732 	}
1733 	archive_entry_clear(entry);
1734 	archive_entry_copy_mac_metadata(entry, data, msize);
1735 	*unconsumed = (msize + 511) & ~ 511;
1736 	return (ARCHIVE_OK);
1737 }
1738 
1739 /*
1740  * Parse a file header for a pax extended archive entry.
1741  */
1742 static int
header_pax_global(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1743 header_pax_global(struct archive_read *a, struct tar *tar,
1744     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1745 {
1746 	const struct archive_entry_header_ustar *header;
1747 	int64_t size, to_consume;
1748 
1749 	(void)tar; /* UNUSED */
1750 	(void)entry; /* UNUSED */
1751 
1752 	header = (const struct archive_entry_header_ustar *)h;
1753 	size = tar_atol(header->size, sizeof(header->size));
1754 	if (size < 0 || size > entry_limit) {
1755 		archive_set_error(&a->archive, EINVAL,
1756 		    "Special header has invalid size: %lld",
1757 		    (long long)size);
1758 		return (ARCHIVE_FATAL);
1759 	}
1760 	if (size == 0) {
1761 		archive_set_error(&a->archive, EINVAL,
1762 		    "Invalid empty pax global extended header");
1763 		return (ARCHIVE_FATAL);
1764 	}
1765 	to_consume = ((size + 511) & ~511);
1766 	*unconsumed += to_consume;
1767 	return (ARCHIVE_OK);
1768 }
1769 
1770 /*
1771  * Parse a file header for a Posix "ustar" archive entry.  This also
1772  * handles "pax" or "extended ustar" entries.
1773  *
1774  * In order to correctly handle pax attributes (which precede this),
1775  * we have to skip parsing any field for which the entry already has
1776  * contents.
1777  */
1778 static int
header_ustar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h)1779 header_ustar(struct archive_read *a, struct tar *tar,
1780     struct archive_entry *entry, const void *h)
1781 {
1782 	const struct archive_entry_header_ustar	*header;
1783 	int err = ARCHIVE_OK, r;
1784 
1785 	header = (const struct archive_entry_header_ustar *)h;
1786 
1787 	/*
1788 	 * The name field is fixed-width and may not be NUL-terminated.
1789 	 * Use a temporary string only when prefix/name joining is required.
1790 	 */
1791 	const char *existing_pathname = archive_entry_pathname(entry);
1792 	const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
1793 	if ((existing_pathname == NULL || existing_pathname[0] == '\0')
1794 	    && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == '\0')) {
1795 		struct archive_string as;
1796 		const char *pathname;
1797 		size_t pathname_length;
1798 
1799 		archive_string_init(&as);
1800 		if (header->prefix[0]) {
1801 			archive_strncpy(&as, header->prefix, sizeof(header->prefix));
1802 			if (as.s[archive_strlen(&as) - 1] != '/')
1803 				archive_strappend_char(&as, '/');
1804 			archive_strncat(&as, header->name, sizeof(header->name));
1805 			pathname = as.s;
1806 			pathname_length = archive_strlen(&as);
1807 		} else {
1808 			pathname = header->name;
1809 			pathname_length = sizeof(header->name);
1810 		}
1811 		r = archive_entry_copy_pathname_l(entry, pathname,
1812 		    pathname_length, tar->sconv);
1813 		archive_string_free(&as);
1814 		if (r != 0) {
1815 			err = set_conversion_failed_error(a, tar->sconv, "Pathname");
1816 			if (err == ARCHIVE_FATAL)
1817 				return (err);
1818 		}
1819 	}
1820 
1821 	/* Handle rest of common fields. */
1822 	r = header_common(a, tar, entry, h);
1823 	if (r == ARCHIVE_FATAL)
1824 		return (r);
1825 	if (r < err)
1826 		err = r;
1827 
1828 	/* Handle POSIX ustar fields. */
1829 	const char *existing_uname = archive_entry_uname(entry);
1830 	if (existing_uname == NULL || existing_uname[0] == '\0') {
1831 		if (archive_entry_copy_uname_l(entry,
1832 		    header->uname, sizeof(header->uname), tar->sconv) != 0) {
1833 			err = set_conversion_failed_error(a, tar->sconv, "Uname");
1834 			if (err == ARCHIVE_FATAL)
1835 				return (err);
1836 		}
1837 	}
1838 
1839 	const char *existing_gname = archive_entry_gname(entry);
1840 	if (existing_gname == NULL || existing_gname[0] == '\0') {
1841 		if (archive_entry_copy_gname_l(entry,
1842 		    header->gname, sizeof(header->gname), tar->sconv) != 0) {
1843 			err = set_conversion_failed_error(a, tar->sconv, "Gname");
1844 			if (err == ARCHIVE_FATAL)
1845 				return (err);
1846 		}
1847 	}
1848 
1849 	/* Parse out device numbers only for char and block specials. */
1850 	if (header->typeflag[0] == '3' || header->typeflag[0] == '4') {
1851 		if (!archive_entry_rdev_is_set(entry)) {
1852 			archive_entry_set_rdevmajor(entry, (dev_t)
1853 			    tar_atol(header->rdevmajor, sizeof(header->rdevmajor)));
1854 			archive_entry_set_rdevminor(entry, (dev_t)
1855 			    tar_atol(header->rdevminor, sizeof(header->rdevminor)));
1856 		}
1857 	} else {
1858 		archive_entry_set_rdev(entry, 0);
1859 	}
1860 
1861 	tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
1862 
1863 	return (err);
1864 }
1865 
1866 static int
header_pax_extension(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)1867 header_pax_extension(struct archive_read *a, struct tar *tar,
1868     struct archive_entry *entry, const void *h, int64_t *unconsumed)
1869 {
1870 	/* Sanity checks: The largest `x` body I've ever heard of was
1871 	 * a little over 4MB.  So I doubt there has ever been a
1872 	 * well-formed archive with an `x` body over 1GiB.  Similarly,
1873 	 * it seems plausible that no single attribute has ever been
1874 	 * larger than 100MB.  So if we see a larger value here, it's
1875 	 * almost certainly a sign of a corrupted/malicious archive. */
1876 
1877 	/* Maximum sane size for extension body: 1 GiB */
1878 	/* This cannot be raised to larger than 8GiB without
1879 	 * exceeding the maximum size for a standard ustar
1880 	 * entry. */
1881 	const int64_t ext_size_limit = 1024 * 1024 * (int64_t)1024;
1882 	/* Maximum size for a single line/attr: 100 million characters */
1883 	/* This cannot be raised to more than 2GiB without exceeding
1884 	 * a `size_t` on 32-bit platforms. */
1885 	const size_t max_parsed_line_length = 99999999ULL;
1886 	/* Largest attribute prolog:  size + name. */
1887 	const size_t max_size_name = 512;
1888 
1889 	/* Size and padding of the full extension body */
1890 	int64_t ext_size, ext_padding;
1891 	size_t line_length, value_length, name_length;
1892 	ssize_t to_read, did_read;
1893 	const struct archive_entry_header_ustar *header;
1894 	const char *p, *attr_start, *name_start;
1895 	struct archive_string_conv *sconv;
1896 	struct archive_string *pas = NULL;
1897 	struct archive_string attr_name;
1898 	int err = ARCHIVE_OK, r;
1899 
1900 	header = (const struct archive_entry_header_ustar *)h;
1901 	ext_size  = tar_atol(header->size, sizeof(header->size));
1902 	if (ext_size > entry_limit) {
1903 		return (ARCHIVE_FATAL);
1904 	}
1905 	if (ext_size < 0) {
1906 	  archive_set_error(&a->archive, EINVAL,
1907 			    "pax extension header has invalid size: %lld",
1908 			    (long long)ext_size);
1909 	  return (ARCHIVE_FATAL);
1910 	}
1911 	if (ext_size == 0) {
1912 		archive_set_error(&a->archive, EINVAL,
1913 		    "Invalid empty pax extended header");
1914 		return (ARCHIVE_FATAL);
1915 	}
1916 
1917 	ext_padding = 0x1ff & (-ext_size);
1918 	if (ext_size > ext_size_limit) {
1919 		/* Consume the pax extension body and return an error */
1920 		if (ext_size + ext_padding != __archive_read_consume(a, ext_size + ext_padding)) {
1921 			return (ARCHIVE_FATAL);
1922 		}
1923 		archive_set_error(&a->archive, EINVAL,
1924 		    "Ignoring oversized pax extensions: %lld > %lld",
1925 		    (long long)ext_size, (long long)ext_size_limit);
1926 		return (ARCHIVE_WARN);
1927 	}
1928 	if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
1929 		return (ARCHIVE_FATAL);
1930 	}
1931 
1932 	/* Parse the size/name of each pax attribute in the body */
1933 	archive_string_init(&attr_name);
1934 	while (ext_size > 0) {
1935 		/* Read enough bytes to parse the size/name of the next attribute */
1936 		to_read = max_size_name;
1937 		if (to_read > ext_size) {
1938 			to_read = ext_size;
1939 		}
1940 		p = __archive_read_ahead(a, to_read, &did_read);
1941 		if (p == NULL) { /* EOF */
1942 			archive_set_error(&a->archive, EINVAL,
1943 					  "Truncated tar archive"
1944 					  " detected while reading pax attribute name");
1945 			return (ARCHIVE_FATAL);
1946 		}
1947 		if (did_read > ext_size) {
1948 			did_read = ext_size;
1949 		}
1950 
1951 		/* Parse size of attribute */
1952 		line_length = 0;
1953 		attr_start = p;
1954 		while (1) {
1955 			if (p >= attr_start + did_read) {
1956 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1957 						  "Ignoring malformed pax attributes: overlarge attribute size field");
1958 				*unconsumed += ext_size + ext_padding;
1959 				return (ARCHIVE_WARN);
1960 			}
1961 			if (*p == ' ') {
1962 				p++;
1963 				break;
1964 			}
1965 			if (*p < '0' || *p > '9') {
1966 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1967 						  "Ignoring malformed pax attributes: malformed attribute size field");
1968 				*unconsumed += ext_size + ext_padding;
1969 				return (ARCHIVE_WARN);
1970 			}
1971 			line_length *= 10;
1972 			line_length += *p - '0';
1973 			if (line_length > max_parsed_line_length) {
1974 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1975 						  "Ignoring malformed pax attribute: size > %lld",
1976 						  (long long)max_parsed_line_length);
1977 				*unconsumed += ext_size + ext_padding;
1978 				return (ARCHIVE_WARN);
1979 			}
1980 			p++;
1981 		}
1982 
1983 		if ((int64_t)line_length > ext_size) {
1984 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1985 						  "Ignoring malformed pax attribute:  %lld > %lld",
1986 						  (long long)line_length, (long long)ext_size);
1987 				*unconsumed += ext_size + ext_padding;
1988 				return (ARCHIVE_WARN);
1989 		}
1990 
1991 		/* Parse name of attribute */
1992 		if (p >= attr_start + did_read
1993 		    || p >= attr_start + line_length
1994 		    || *p == '=') {
1995 			archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
1996 					  "Ignoring malformed pax attributes: empty name found");
1997 			*unconsumed += ext_size + ext_padding;
1998 			return (ARCHIVE_WARN);
1999 		}
2000 		name_start = p;
2001 		while (1) {
2002 			if (p >= attr_start + did_read || p >= attr_start + line_length) {
2003 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2004 						  "Ignoring malformed pax attributes: overlarge attribute name");
2005 				*unconsumed += ext_size + ext_padding;
2006 				return (ARCHIVE_WARN);
2007 			}
2008 			if (*p == '=') {
2009 				break;
2010 			}
2011 			p++;
2012 		}
2013 		name_length = p - name_start;
2014 		p++; // Skip '='
2015 
2016 		// Save the name before we consume it
2017 		archive_strncpy(&attr_name, name_start, name_length);
2018 
2019 		ext_size -= p - attr_start;
2020 		value_length = line_length - (p - attr_start);
2021 
2022 		/* Consume size, name, and `=` */
2023 		*unconsumed += p - attr_start;
2024 		if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2025 			archive_string_free(&attr_name);
2026 			return (ARCHIVE_FATAL);
2027 		}
2028 
2029 		if (value_length == 0) {
2030 			archive_set_error(&a->archive, EINVAL,
2031 					  "Malformed pax attributes");
2032 			*unconsumed += ext_size + ext_padding;
2033 			archive_string_free(&attr_name);
2034 			return (ARCHIVE_WARN);
2035 		}
2036 
2037 		/* pax_attribute will consume value_length - 1 */
2038 		r = pax_attribute(a, tar, entry, attr_name.s, archive_strlen(&attr_name), value_length - 1, unconsumed);
2039 		ext_size -= value_length - 1;
2040 
2041 		// Release the allocated attr_name (either here or before every return in this function)
2042 		archive_string_free(&attr_name);
2043 
2044 		if (r < ARCHIVE_WARN) {
2045 			*unconsumed += ext_size + ext_padding;
2046 			return (r);
2047 		}
2048 		err = err_combine(err, r);
2049 
2050 		/* Consume the `\n` that follows the pax attribute value. */
2051 		if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2052 			return (ARCHIVE_FATAL);
2053 		}
2054 		p = __archive_read_ahead(a, 1, &did_read);
2055 		if (p == NULL) {
2056 			archive_set_error(&a->archive, EINVAL,
2057 					  "Truncated tar archive"
2058 					  " detected while completing pax attribute");
2059 			return (ARCHIVE_FATAL);
2060 		}
2061 		if (p[0] != '\n') {
2062 			archive_set_error(&a->archive, EINVAL,
2063 					  "Malformed pax attributes");
2064 			*unconsumed += ext_size + ext_padding;
2065 			return (ARCHIVE_WARN);
2066 		}
2067 		ext_size -= 1;
2068 		*unconsumed += 1;
2069 		if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
2070 			return (ARCHIVE_FATAL);
2071 		}
2072 	}
2073 	*unconsumed += ext_size + ext_padding;
2074 
2075 	/*
2076 	 * Some PAX values -- pathname, linkpath, uname, gname --
2077 	 * can't be copied into the entry until we know the character
2078 	 * set to use:
2079 	 */
2080 	if (!tar->pax_hdrcharset_utf8)
2081 		/* PAX specified "BINARY", so use the default charset */
2082 		sconv = tar->opt_sconv;
2083 	else {
2084 		/* PAX default UTF-8 */
2085 		sconv = archive_string_conversion_from_charset(
2086 		    &(a->archive), "UTF-8", 1);
2087 		if (sconv == NULL)
2088 			return (ARCHIVE_FATAL);
2089 		if (tar->compat_2x)
2090 			archive_string_conversion_set_opt(sconv,
2091 			    SCONV_SET_OPT_UTF8_LIBARCHIVE2X);
2092 	}
2093 
2094 	/* Pathname */
2095 	pas = NULL;
2096 	if (archive_strlen(&(tar->entry_pathname_override)) > 0) {
2097 		/* Prefer GNU.sparse.name attribute if present */
2098 		/* GNU sparse files store a fake name under the standard
2099 		 * "pathname" key. */
2100 		pas = &(tar->entry_pathname_override);
2101 	} else if (archive_strlen(&(tar->entry_pathname)) > 0) {
2102 		/* Use standard "pathname" PAX extension */
2103 		pas = &(tar->entry_pathname);
2104 	}
2105 	if (pas != NULL) {
2106 		if (archive_entry_copy_pathname_l(entry, pas->s,
2107 		    archive_strlen(pas), sconv) != 0) {
2108 			err = set_conversion_failed_error(a, sconv, "Pathname");
2109 			if (err == ARCHIVE_FATAL)
2110 				return (err);
2111 			/* Use raw name without conversion */
2112 			archive_entry_copy_pathname(entry, pas->s);
2113 		}
2114 	}
2115 	/* Uname */
2116 	if (archive_strlen(&(tar->entry_uname)) > 0) {
2117 		if (archive_entry_copy_uname_l(entry, tar->entry_uname.s,
2118 		    archive_strlen(&(tar->entry_uname)), sconv) != 0) {
2119 			err = set_conversion_failed_error(a, sconv, "Uname");
2120 			if (err == ARCHIVE_FATAL)
2121 				return (err);
2122 			/* Use raw name without conversion */
2123 			archive_entry_copy_uname(entry, tar->entry_uname.s);
2124 		}
2125 	}
2126 	/* Gname */
2127 	if (archive_strlen(&(tar->entry_gname)) > 0) {
2128 		if (archive_entry_copy_gname_l(entry, tar->entry_gname.s,
2129 		    archive_strlen(&(tar->entry_gname)), sconv) != 0) {
2130 			err = set_conversion_failed_error(a, sconv, "Gname");
2131 			if (err == ARCHIVE_FATAL)
2132 				return (err);
2133 			/* Use raw name without conversion */
2134 			archive_entry_copy_gname(entry, tar->entry_gname.s);
2135 		}
2136 	}
2137 	/* Linkpath */
2138 	if (archive_strlen(&(tar->entry_linkpath)) > 0) {
2139 		if (archive_entry_copy_link_l(entry, tar->entry_linkpath.s,
2140 		    archive_strlen(&(tar->entry_linkpath)), sconv) != 0) {
2141 			err = set_conversion_failed_error(a, sconv, "Linkpath");
2142 			if (err == ARCHIVE_FATAL)
2143 				return (err);
2144 			/* Use raw name without conversion */
2145 			archive_entry_copy_link(entry, tar->entry_linkpath.s);
2146 		}
2147 	}
2148 
2149 	/* Extension may have given us a corrected `entry_bytes_remaining` for
2150 	 * the main entry; update the padding appropriately. */
2151 	tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
2152 	return (err);
2153 }
2154 
2155 static int
pax_attribute_LIBARCHIVE_xattr(struct archive_entry * entry,const char * name,size_t name_length,const char * value,size_t value_length)2156 pax_attribute_LIBARCHIVE_xattr(struct archive_entry *entry,
2157 	const char *name, size_t name_length, const char *value, size_t value_length)
2158 {
2159 	char *name_decoded;
2160 	void *value_decoded;
2161 	size_t value_len;
2162 
2163 	if (name_length < 1)
2164 		return 3;
2165 
2166 	/* URL-decode name */
2167 	name_decoded = url_decode(name, name_length);
2168 	if (name_decoded == NULL)
2169 		return 2;
2170 
2171 	/* Base-64 decode value */
2172 	value_decoded = base64_decode(value, value_length, &value_len);
2173 	if (value_decoded == NULL) {
2174 		free(name_decoded);
2175 		return 1;
2176 	}
2177 
2178 	archive_entry_xattr_add_entry(entry, name_decoded,
2179 		value_decoded, value_len);
2180 
2181 	free(name_decoded);
2182 	free(value_decoded);
2183 	return 0;
2184 }
2185 
2186 static int
pax_attribute_SCHILY_xattr(struct archive_entry * entry,const char * name,size_t name_length,const char * value,size_t value_length)2187 pax_attribute_SCHILY_xattr(struct archive_entry *entry,
2188 	const char *name, size_t name_length, const char *value, size_t value_length)
2189 {
2190 	if (name_length < 1 || name_length > 128) {
2191 		return 1;
2192 	}
2193 
2194 	char * null_terminated_name = malloc(name_length + 1);
2195 	if (null_terminated_name != NULL) {
2196 		memcpy(null_terminated_name, name, name_length);
2197 		null_terminated_name[name_length] = '\0';
2198 		archive_entry_xattr_add_entry(entry, null_terminated_name, value, value_length);
2199 		free(null_terminated_name);
2200 	}
2201 
2202 	return 0;
2203 }
2204 
2205 static int
pax_attribute_RHT_security_selinux(struct archive_entry * entry,const char * value,size_t value_length)2206 pax_attribute_RHT_security_selinux(struct archive_entry *entry,
2207 	const char *value, size_t value_length)
2208 {
2209 	archive_entry_xattr_add_entry(entry, "security.selinux",
2210             value, value_length);
2211 
2212 	return 0;
2213 }
2214 
2215 static int
pax_attribute_SCHILY_acl(struct archive_read * a,struct tar * tar,struct archive_entry * entry,size_t value_length,int type)2216 pax_attribute_SCHILY_acl(struct archive_read *a, struct tar *tar,
2217 	struct archive_entry *entry, size_t value_length, int type)
2218 {
2219 	int r;
2220 	const char *p;
2221 	const char* errstr;
2222 
2223 	switch (type) {
2224 	case ARCHIVE_ENTRY_ACL_TYPE_ACCESS:
2225 		errstr = "SCHILY.acl.access";
2226 		break;
2227 	case ARCHIVE_ENTRY_ACL_TYPE_DEFAULT:
2228 		errstr = "SCHILY.acl.default";
2229 		break;
2230 	case ARCHIVE_ENTRY_ACL_TYPE_NFS4:
2231 		errstr = "SCHILY.acl.ace";
2232 		break;
2233 	default:
2234 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2235 		    "Unknown ACL type: %d", type);
2236 		return(ARCHIVE_FATAL);
2237 	}
2238 
2239 	if (tar->sconv_acl == NULL) {
2240 		tar->sconv_acl =
2241 		    archive_string_conversion_from_charset(
2242 			&(a->archive), "UTF-8", 1);
2243 		if (tar->sconv_acl == NULL)
2244 			return (ARCHIVE_FATAL);
2245 	}
2246 
2247 	if (value_length > acl_limit) {
2248 		__archive_read_consume(a, value_length);
2249 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2250 				  "Unreasonably large ACL: %llu > %llu",
2251 				  (unsigned long long)value_length,
2252 				  (unsigned long long)acl_limit);
2253 		return (ARCHIVE_WARN);
2254 	}
2255 
2256 	p = __archive_read_ahead(a, value_length, NULL);
2257 	if (p == NULL) {
2258 		archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2259 				  "Truncated tar archive "
2260 				  "detected while reading ACL data");
2261 		return (ARCHIVE_FATAL);
2262 	}
2263 
2264 	r = archive_acl_from_text_nl(archive_entry_acl(entry), p, value_length,
2265 	    type, tar->sconv_acl);
2266 	__archive_read_consume(a, value_length);
2267 	/* Workaround: Force perm_is_set() to be correct */
2268 	/* If this bit were stored in the ACL, this wouldn't be needed */
2269 	archive_entry_set_perm(entry, archive_entry_perm(entry));
2270 	if (r != ARCHIVE_OK) {
2271 		if (r == ARCHIVE_FATAL) {
2272 			archive_set_error(&a->archive, ENOMEM,
2273 			    "%s %s", "Can't allocate memory for",
2274 			    errstr);
2275 			return (r);
2276 		}
2277 		archive_set_error(&a->archive,
2278 		    ARCHIVE_ERRNO_MISC, "%s %s", "Parse error:", errstr);
2279 	}
2280 	return (r);
2281 }
2282 
2283 static int
pax_attribute_read_time(struct archive_read * a,size_t value_length,__LA_TIME_T * ps,long * pn,int64_t * unconsumed)2284 pax_attribute_read_time(struct archive_read *a, size_t value_length, __LA_TIME_T *ps, long *pn, int64_t *unconsumed) {
2285 	struct archive_string as;
2286 	int r;
2287 
2288 	if (value_length > 128) {
2289 		__archive_read_consume(a, value_length);
2290 		*ps = 0;
2291 		*pn = 0;
2292 		return (ARCHIVE_FATAL);
2293 	}
2294 
2295 	archive_string_init(&as);
2296 	r = read_bytes_to_string(a, &as, value_length, unconsumed);
2297 	if (r < ARCHIVE_OK) {
2298 		archive_string_free(&as);
2299 		*ps = 0;
2300 		*pn = 0;
2301 		return (r);
2302 	}
2303 
2304 	int64_t sec = 0;
2305 	pax_time(as.s, archive_strlen(&as), &sec, pn);
2306 	archive_string_free(&as);
2307 
2308 	if (sec == INT64_MIN) {
2309 		*ps = 0;
2310 		*pn = 0;
2311 		return (ARCHIVE_WARN);
2312 	} else {
2313 		*ps = (__LA_TIME_T)sec;
2314 	}
2315 	return (ARCHIVE_OK);
2316 }
2317 
2318 static int
pax_attribute_read_number(struct archive_read * a,size_t value_length,int64_t * result)2319 pax_attribute_read_number(struct archive_read *a, size_t value_length, int64_t *result) {
2320 	struct archive_string as;
2321 	int64_t unconsumed = 0;
2322 	int r;
2323 
2324 	if (value_length > 64) {
2325 		__archive_read_consume(a, value_length);
2326 		*result = 0;
2327 		return (ARCHIVE_FATAL);
2328 	}
2329 
2330 	archive_string_init(&as);
2331 	r = read_bytes_to_string(a, &as, value_length, &unconsumed);
2332 	if (tar_flush_unconsumed(a, &unconsumed) != ARCHIVE_OK) {
2333 		*result = 0;
2334 		return (ARCHIVE_FATAL);
2335 	}
2336 	if (r < ARCHIVE_OK) {
2337 		archive_string_free(&as);
2338 		*result = 0;
2339 		return (r);
2340 	}
2341 
2342 	*result = tar_atol10(as.s, archive_strlen(&as));
2343 	archive_string_free(&as);
2344 	if (*result < 0 || *result == INT64_MAX) {
2345 		*result = INT64_MAX;
2346 		return (ARCHIVE_WARN);
2347 	}
2348 	return (ARCHIVE_OK);
2349 }
2350 
2351 /*
2352  * Parse a single key=value attribute.
2353  *
2354  * POSIX reserves all-lowercase keywords.  Vendor-specific extensions
2355  * should always have keywords of the form "VENDOR.attribute" In
2356  * particular, it's quite feasible to support many different vendor
2357  * extensions here.  I'm using "LIBARCHIVE" for extensions unique to
2358  * this library.
2359  *
2360  * TODO: Investigate other vendor-specific extensions and see if
2361  * any of them look useful.
2362  */
2363 static int
pax_attribute(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const char * key,size_t key_length,size_t value_length,int64_t * unconsumed)2364 pax_attribute(struct archive_read *a, struct tar *tar, struct archive_entry *entry,
2365 	      const char *key, size_t key_length, size_t value_length, int64_t *unconsumed)
2366 {
2367 	int64_t t;
2368 	long n;
2369 	const char *p;
2370 	int err = ARCHIVE_OK;
2371 
2372 	switch (key[0]) {
2373 	case 'G':
2374 		/* GNU.* extensions */
2375 		if (key_length > 4 && memcmp(key, "GNU.", 4) == 0) {
2376 			key += 4;
2377 			key_length -= 4;
2378 
2379 			/* GNU.sparse marks the existence of GNU sparse information */
2380 			if (key_length == 6 && memcmp(key, "sparse", 6) == 0) {
2381 				tar->sparse_gnu_attributes_seen = 1;
2382 			}
2383 
2384 			/* GNU.sparse.* extensions */
2385 			else if (key_length > 7 && memcmp(key, "sparse.", 7) == 0) {
2386 				tar->sparse_gnu_attributes_seen = 1;
2387 				key += 7;
2388 				key_length -= 7;
2389 
2390 				/* GNU "0.0" sparse pax format. */
2391 				if (key_length == 9 && memcmp(key, "numblocks", 9) == 0) {
2392 					/* GNU.sparse.numblocks */
2393 					tar->sparse_offset = -1;
2394 					tar->sparse_numbytes = -1;
2395 					tar->sparse_gnu_major = 0;
2396 					tar->sparse_gnu_minor = 0;
2397 				}
2398 				else if (key_length == 6 && memcmp(key, "offset", 6) == 0) {
2399 					/* GNU.sparse.offset */
2400 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2401 						tar->sparse_offset = t;
2402 						if (tar->sparse_numbytes != -1) {
2403 							if (gnu_add_sparse_entry(a, tar,
2404 									 tar->sparse_offset, tar->sparse_numbytes)
2405 							    != ARCHIVE_OK)
2406 								return (ARCHIVE_FATAL);
2407 							tar->sparse_offset = -1;
2408 							tar->sparse_numbytes = -1;
2409 						}
2410 					}
2411 					return (err);
2412 				}
2413 				else if (key_length == 8 && memcmp(key, "numbytes", 8) == 0) {
2414 					/* GNU.sparse.numbytes */
2415 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2416 						tar->sparse_numbytes = t;
2417 						if (tar->sparse_offset != -1) {
2418 							if (gnu_add_sparse_entry(a, tar,
2419 									 tar->sparse_offset, tar->sparse_numbytes)
2420 							    != ARCHIVE_OK)
2421 								return (ARCHIVE_FATAL);
2422 							tar->sparse_offset = -1;
2423 							tar->sparse_numbytes = -1;
2424 						}
2425 					}
2426 					return (err);
2427 				}
2428 				else if (key_length == 4 && memcmp(key, "size", 4) == 0) {
2429 					/* GNU.sparse.size */
2430 					/* This is either the size of stored entry OR the size of data on disk,
2431 					 * depending on which GNU sparse format version is in use.
2432 					 * Since pax attributes can be in any order, we may not actually
2433 					 * know at this point how to interpret this. */
2434 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2435 						tar->GNU_sparse_size = t;
2436 						tar->size_fields |= TAR_SIZE_GNU_SPARSE_SIZE;
2437 					}
2438 					return (err);
2439 				}
2440 
2441 				/* GNU "0.1" sparse pax format. */
2442 				else if (key_length == 3 && memcmp(key, "map", 3) == 0) {
2443 					/* GNU.sparse.map */
2444 					tar->sparse_gnu_major = 0;
2445 					tar->sparse_gnu_minor = 1;
2446 					if (value_length > sparse_map_limit) {
2447 						archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2448 								  "Unreasonably large sparse map: %llu > %llu",
2449 								  (unsigned long long)value_length,
2450 								  (unsigned long long)sparse_map_limit);
2451 						err = ARCHIVE_FAILED;
2452 					} else {
2453 						p = __archive_read_ahead(a, value_length, NULL);
2454 						if (p == NULL) {
2455 							archive_set_error(&a->archive, EINVAL,
2456 									  "Truncated archive"
2457 									  " detected while reading GNU sparse data");
2458 							return (ARCHIVE_FATAL);
2459 						}
2460 						if (gnu_sparse_01_parse(a, tar, p, value_length) != ARCHIVE_OK) {
2461 							err = ARCHIVE_WARN;
2462 						}
2463 					}
2464 					__archive_read_consume(a, value_length);
2465 					return (err);
2466 				}
2467 
2468 				/* GNU "1.0" sparse pax format */
2469 				else if (key_length == 5 && memcmp(key, "major", 5) == 0) {
2470 					/* GNU.sparse.major */
2471 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK
2472 					    && t >= 0
2473 					    && t <= 10) {
2474 						tar->sparse_gnu_major = (int)t;
2475 					}
2476 					return (err);
2477 				}
2478 				else if (key_length == 5 && memcmp(key, "minor", 5) == 0) {
2479 					/* GNU.sparse.minor */
2480 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK
2481 					    && t >= 0
2482 					    && t <= 10) {
2483 						tar->sparse_gnu_minor = (int)t;
2484 					}
2485 					return (err);
2486 				}
2487 				else if (key_length == 4 && memcmp(key, "name", 4) == 0) {
2488 					/* GNU.sparse.name */
2489 					/*
2490 					 * The real filename; when storing sparse
2491 					 * files, GNU tar puts a synthesized name into
2492 					 * the regular 'path' attribute in an attempt
2493 					 * to limit confusion. ;-)
2494 					 */
2495 					if (value_length > pathname_limit) {
2496 						*unconsumed += value_length;
2497 						err = ARCHIVE_WARN;
2498 					} else {
2499 						err = read_bytes_to_string(a, &(tar->entry_pathname_override),
2500 									   value_length, unconsumed);
2501 					}
2502 					return (err);
2503 				}
2504 				else if (key_length == 8 && memcmp(key, "realsize", 8) == 0) {
2505 					/* GNU.sparse.realsize = size of file on disk */
2506 					if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2507 						tar->GNU_sparse_realsize = t;
2508 						tar->size_fields |= TAR_SIZE_GNU_SPARSE_REALSIZE;
2509 					}
2510 					return (err);
2511 				}
2512 			}
2513 		}
2514 		break;
2515 	case 'L':
2516 		/* LIBARCHIVE extensions */
2517 		if (key_length > 11 && memcmp(key, "LIBARCHIVE.", 11) == 0) {
2518 			key_length -= 11;
2519 			key += 11;
2520 
2521 			/* TODO: Handle arbitrary extended attributes... */
2522 			/*
2523 			  if (strcmp(key, "LIBARCHIVE.xxxxxxx") == 0)
2524 				  archive_entry_set_xxxxxx(entry, value);
2525 			*/
2526 			if (key_length == 12 && memcmp(key, "creationtime", 12) == 0) {
2527 				/* LIBARCHIVE.creationtime */
2528 				__LA_TIME_T sec = 0;
2529 				if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2530 					archive_entry_set_birthtime(entry, sec, n);
2531 				} else {
2532 					archive_set_error(&a->archive,
2533 							  ARCHIVE_ERRNO_MISC,
2534 							  "Ignoring malformed pax creationtime");
2535 				}
2536 				return (err);
2537 			}
2538 			else if (key_length == 11 && memcmp(key, "symlinktype", 11) == 0) {
2539 				/* LIBARCHIVE.symlinktype */
2540 				if (value_length < 16) {
2541 					p = __archive_read_ahead(a, value_length, NULL);
2542 					if (p == NULL) {
2543 						archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2544 								  "Truncated tar archive "
2545 								  "detected while reading `symlinktype` attribute");
2546 						return (ARCHIVE_FATAL);
2547 					}
2548 					if (value_length == 4 && memcmp(p, "file", 4) == 0) {
2549 						archive_entry_set_symlink_type(entry,
2550 									       AE_SYMLINK_TYPE_FILE);
2551 					} else if (value_length == 3 && memcmp(p, "dir", 3) == 0) {
2552 							archive_entry_set_symlink_type(entry,
2553 										       AE_SYMLINK_TYPE_DIRECTORY);
2554 					} else {
2555 						archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2556 								  "Unrecognized symlink type");
2557 						err = ARCHIVE_WARN;
2558 					}
2559 				} else {
2560 					archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2561 							  "symlink type is very long"
2562 							  "(longest recognized value is 4 bytes, this is %llu)",
2563 							  (unsigned long long)value_length);
2564 					err = ARCHIVE_WARN;
2565 				}
2566 				__archive_read_consume(a, value_length);
2567 				return (err);
2568 			}
2569 			else if (key_length > 6 && memcmp(key, "xattr.", 6) == 0) {
2570 				key_length -= 6;
2571 				key += 6;
2572 				if (value_length > xattr_limit) {
2573 					err = ARCHIVE_WARN;
2574 				} else {
2575 					p = __archive_read_ahead(a, value_length, NULL);
2576 					if (p == NULL) {
2577 						archive_set_error(&a->archive, EINVAL,
2578 								  "Truncated archive"
2579 								  " detected while reading xattr information");
2580 						return (ARCHIVE_FATAL);
2581 					}
2582 					if (pax_attribute_LIBARCHIVE_xattr(entry, key, key_length, p, value_length)) {
2583 						/* TODO: Unable to parse xattr */
2584 						err = ARCHIVE_WARN;
2585 					}
2586 				}
2587 				__archive_read_consume(a, value_length);
2588 				return (err);
2589 			}
2590 		}
2591 		break;
2592 	case 'R':
2593 		/* GNU tar uses RHT.security header to store SELinux xattrs
2594 		 * SCHILY.xattr.security.selinux == RHT.security.selinux */
2595 		if (key_length == 20 && memcmp(key, "RHT.security.selinux", 20) == 0) {
2596 			if (value_length > xattr_limit) {
2597 				archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2598 						  "Ignoring unreasonably large security.selinux attribute:"
2599 						  " %llu > %llu",
2600 						  (unsigned long long)value_length,
2601 						  (unsigned long long)xattr_limit);
2602 				/* TODO: Should this be FAILED instead? */
2603 				err = ARCHIVE_WARN;
2604 			} else {
2605 				p = __archive_read_ahead(a, value_length, NULL);
2606 				if (p == NULL) {
2607 					archive_set_error(&a->archive, EINVAL,
2608 							  "Truncated archive"
2609 							  " detected while reading selinux data");
2610 					return (ARCHIVE_FATAL);
2611 				}
2612 				if (pax_attribute_RHT_security_selinux(entry, p, value_length)) {
2613 					/* TODO: Unable to parse xattr */
2614 					err = ARCHIVE_WARN;
2615 				}
2616 			}
2617 			__archive_read_consume(a, value_length);
2618 			return (err);
2619 		}
2620 		break;
2621 	case 'S':
2622 		/* SCHILY.* extensions used by "star" archiver */
2623 		if (key_length > 7 && memcmp(key, "SCHILY.", 7) == 0) {
2624 			key_length -= 7;
2625 			key += 7;
2626 
2627 			if (key_length == 10 && memcmp(key, "acl.access", 10) == 0) {
2628 				err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2629 						      ARCHIVE_ENTRY_ACL_TYPE_ACCESS);
2630 				// TODO: Mark mode as set
2631 				return (err);
2632 			}
2633 			else if (key_length == 11 && memcmp(key, "acl.default", 11) == 0) {
2634 				err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2635 						      ARCHIVE_ENTRY_ACL_TYPE_DEFAULT);
2636 				return (err);
2637 			}
2638 			else if (key_length == 7 && memcmp(key, "acl.ace", 7) == 0) {
2639 				err = pax_attribute_SCHILY_acl(a, tar, entry, value_length,
2640 						      ARCHIVE_ENTRY_ACL_TYPE_NFS4);
2641 				// TODO: Mark mode as set
2642 				return (err);
2643 			}
2644 			else if (key_length == 8 && memcmp(key, "devmajor", 8) == 0) {
2645 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2646 					archive_entry_set_rdevmajor(entry, (dev_t)t);
2647 				}
2648 				return (err);
2649 			}
2650 			else if (key_length == 8 && memcmp(key, "devminor", 8) == 0) {
2651 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2652 					archive_entry_set_rdevminor(entry, (dev_t)t);
2653 				}
2654 				return (err);
2655 			}
2656 			else if (key_length == 6 && memcmp(key, "fflags", 6) == 0) {
2657 				if (value_length < fflags_limit) {
2658 					p = __archive_read_ahead(a, value_length, NULL);
2659 					if (p == NULL) {
2660 						/* Truncated archive */
2661 						archive_set_error(&a->archive, EINVAL,
2662 								  "Truncated archive"
2663 								  " detected while reading SCHILY.fflags");
2664 						return (ARCHIVE_FATAL);
2665 					}
2666 					archive_entry_copy_fflags_text_len(entry, p, value_length);
2667 					err = ARCHIVE_OK;
2668 				} else {
2669 					/* Overlong fflags field */
2670 					err = ARCHIVE_WARN;
2671 				}
2672 				__archive_read_consume(a, value_length);
2673 				return (err);
2674 			}
2675 			else if (key_length == 3 && memcmp(key, "dev", 3) == 0) {
2676 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2677 					archive_entry_set_dev(entry, (dev_t)t);
2678 				}
2679 				return (err);
2680 			}
2681 			else if (key_length == 3 && memcmp(key, "ino", 3) == 0) {
2682 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2683 					archive_entry_set_ino(entry, t);
2684 				}
2685 				return (err);
2686 			}
2687 			else if (key_length == 5 && memcmp(key, "nlink", 5) == 0) {
2688 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2689 					archive_entry_set_nlink(entry, (unsigned int)t);
2690 				}
2691 				return (err);
2692 			}
2693 			else if (key_length == 8 && memcmp(key, "realsize", 8) == 0) {
2694 				if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2695 					tar->SCHILY_sparse_realsize = t;
2696 					tar->size_fields |= TAR_SIZE_SCHILY_SPARSE_REALSIZE;
2697 				}
2698 				return (err);
2699 			}
2700 			/* TODO: Is there a SCHILY.sparse.size similar to GNU.sparse.size ? */
2701 			else if (key_length > 6 && memcmp(key, "xattr.", 6) == 0) {
2702 				key_length -= 6;
2703 				key += 6;
2704 				if (value_length < xattr_limit) {
2705 					p = __archive_read_ahead(a, value_length, NULL);
2706 					if (p == NULL) {
2707 						archive_set_error(&a->archive, EINVAL,
2708 								  "Truncated archive"
2709 								  " detected while reading SCHILY.xattr");
2710 						return (ARCHIVE_FATAL);
2711 					}
2712 					if (pax_attribute_SCHILY_xattr(entry, key, key_length, p, value_length)) {
2713 						/* TODO: Unable to parse xattr */
2714 						err = ARCHIVE_WARN;
2715 					}
2716 				} else {
2717 					archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2718 							  "Unreasonably large xattr: %llu > %llu",
2719 							  (unsigned long long)value_length,
2720 							  (unsigned long long)xattr_limit);
2721 					err = ARCHIVE_WARN;
2722 				}
2723 				__archive_read_consume(a, value_length);
2724 				return (err);
2725 			}
2726 		}
2727 		/* SUN.* extensions from Solaris tar */
2728 		if (key_length > 4 && memcmp(key, "SUN.", 4) == 0) {
2729 			key_length -= 4;
2730 			key += 4;
2731 
2732 			if (key_length == 9 && memcmp(key, "holesdata", 9) == 0) {
2733 				/* SUN.holesdata */
2734 				if (value_length < sparse_map_limit) {
2735 					p = __archive_read_ahead(a, value_length, NULL);
2736 					if (p == NULL) {
2737 						archive_set_error(&a->archive, EINVAL,
2738 								  "Truncated archive"
2739 								  " detected while reading SUN.holesdata");
2740 						return (ARCHIVE_FATAL);
2741 					}
2742 					err = pax_attribute_SUN_holesdata(a, tar, entry, p, value_length);
2743 					if (err < ARCHIVE_OK) {
2744 						archive_set_error(&a->archive,
2745 								  ARCHIVE_ERRNO_MISC,
2746 								  "Parse error: SUN.holesdata");
2747 					}
2748 				} else {
2749 					archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC,
2750 							  "Unreasonably large sparse map: %llu > %llu",
2751 							  (unsigned long long)value_length,
2752 							  (unsigned long long)sparse_map_limit);
2753 					err = ARCHIVE_FAILED;
2754 				}
2755 				__archive_read_consume(a, value_length);
2756 				return (err);
2757 			}
2758 		}
2759 		break;
2760 	case 'a':
2761 		if (key_length == 5 && memcmp(key, "atime", 5) == 0) {
2762 			__LA_TIME_T sec = 0;
2763 			if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2764 				archive_entry_set_atime(entry, sec, n);
2765 			} else {
2766 				archive_set_error(&a->archive,
2767 				    ARCHIVE_ERRNO_MISC,
2768 				    "Ignoring malformed pax atime");
2769 			}
2770 			return (err);
2771 		}
2772 		break;
2773 	case 'c':
2774 		if (key_length == 5 && memcmp(key, "ctime", 5) == 0) {
2775 			__LA_TIME_T sec = 0;
2776 			if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2777 				archive_entry_set_ctime(entry, sec, n);
2778 			} else {
2779 				archive_set_error(&a->archive,
2780 				    ARCHIVE_ERRNO_MISC,
2781 				    "Ignoring malformed pax ctime");
2782 			}
2783 			return (err);
2784 		} else if (key_length == 7 && memcmp(key, "charset", 7) == 0) {
2785 			/* TODO: Publish charset information in entry. */
2786 		} else if (key_length == 7 && memcmp(key, "comment", 7) == 0) {
2787 			/* TODO: Publish comment in entry. */
2788 		}
2789 		break;
2790 	case 'g':
2791 		if (key_length == 3 && memcmp(key, "gid", 3) == 0) {
2792 			if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2793 				archive_entry_set_gid(entry, t);
2794 			}
2795 			return (err);
2796 		} else if (key_length == 5 && memcmp(key, "gname", 5) == 0) {
2797 			if (value_length > guname_limit) {
2798 				*unconsumed += value_length;
2799 				err = ARCHIVE_WARN;
2800 			} else {
2801 				err = read_bytes_to_string(a, &(tar->entry_gname), value_length, unconsumed);
2802 			}
2803 			return (err);
2804 		}
2805 		break;
2806 	case 'h':
2807 		if (key_length == 10 && memcmp(key, "hdrcharset", 10) == 0) {
2808 			if (value_length < 64) {
2809 				p = __archive_read_ahead(a, value_length, NULL);
2810 				if (p == NULL) {
2811 					archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2812 							  "Truncated tar archive "
2813 							  "detected while reading hdrcharset attribute");
2814 					return (ARCHIVE_FATAL);
2815 				}
2816 				if (value_length == 6
2817 				    && memcmp(p, "BINARY", 6) == 0) {
2818 					/* Binary  mode. */
2819 					tar->pax_hdrcharset_utf8 = 0;
2820 					err = ARCHIVE_OK;
2821 				} else if (value_length == 23
2822 					   && memcmp(p, "ISO-IR 10646 2000 UTF-8", 23) == 0) {
2823 					tar->pax_hdrcharset_utf8 = 1;
2824 					err = ARCHIVE_OK;
2825 				} else {
2826 					/* TODO: Unrecognized character set */
2827 					err  = ARCHIVE_WARN;
2828 				}
2829 			} else {
2830 				archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
2831 						  "hdrcharset attribute is unreasonably large (%llu bytes)",
2832 						  (unsigned long long)value_length);
2833 				err = ARCHIVE_WARN;
2834 			}
2835 			__archive_read_consume(a, value_length);
2836 			return (err);
2837 		}
2838 		break;
2839 	case 'l':
2840 		/* pax interchange doesn't distinguish hardlink vs. symlink. */
2841 		if (key_length == 8 && memcmp(key, "linkpath", 8) == 0) {
2842 			if (value_length > pathname_limit) {
2843 				*unconsumed += value_length;
2844 				err = ARCHIVE_WARN;
2845 			} else {
2846 				err = read_bytes_to_string(a, &tar->entry_linkpath, value_length, unconsumed);
2847 			}
2848 			return (err);
2849 		}
2850 		break;
2851 	case 'm':
2852 		if (key_length == 5 && memcmp(key, "mtime", 5) == 0) {
2853 			__LA_TIME_T sec;
2854 			if ((err = pax_attribute_read_time(a, value_length, &sec, &n, unconsumed)) == ARCHIVE_OK) {
2855 				archive_entry_set_mtime(entry, sec, n);
2856 			} else {
2857 				archive_set_error(&a->archive,
2858 				    ARCHIVE_ERRNO_MISC,
2859 				    "Ignoring malformed pax mtime");
2860 			}
2861 			return (err);
2862 		}
2863 		break;
2864 	case 'p':
2865 		if (key_length == 4 && memcmp(key, "path", 4) == 0) {
2866 			if (value_length > pathname_limit) {
2867 				*unconsumed += value_length;
2868 				err = ARCHIVE_WARN;
2869 			} else {
2870 				err = read_bytes_to_string(a, &(tar->entry_pathname), value_length, unconsumed);
2871 			}
2872 			return (err);
2873 		}
2874 		break;
2875 	case 'r':
2876 		/* POSIX has reserved 'realtime.*' */
2877 		break;
2878 	case 's':
2879 		/* POSIX has reserved 'security.*' */
2880 		/* Someday: if (strcmp(key, "security.acl") == 0) { ... } */
2881 		if (key_length == 4 && memcmp(key, "size", 4) == 0) {
2882 			/* "size" is the size of the data in the entry. */
2883 			if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2884 				tar->pax_size = t;
2885 				tar->size_fields |= TAR_SIZE_PAX_SIZE;
2886 			}
2887 			else if (t == INT64_MAX) {
2888 				/* Note: pax_attr_read_number returns INT64_MAX on overflow or < 0 */
2889 				tar->entry_bytes_remaining = 0;
2890 				archive_set_error(&a->archive,
2891 				    ARCHIVE_ERRNO_MISC,
2892 				    "Tar size attribute overflow");
2893 				return (ARCHIVE_FATAL);
2894 			}
2895 			return (err);
2896 		}
2897 		break;
2898 	case 'u':
2899 		if (key_length == 3 && memcmp(key, "uid", 3) == 0) {
2900 			if ((err = pax_attribute_read_number(a, value_length, &t)) == ARCHIVE_OK) {
2901 				archive_entry_set_uid(entry, t);
2902 			}
2903 			return (err);
2904 		} else if (key_length == 5 && memcmp(key, "uname", 5) == 0) {
2905 			if (value_length > guname_limit) {
2906 				*unconsumed += value_length;
2907 				err = ARCHIVE_WARN;
2908 			} else {
2909 				err = read_bytes_to_string(a, &(tar->entry_uname), value_length, unconsumed);
2910 			}
2911 			return (err);
2912 		}
2913 		break;
2914 	}
2915 
2916 	/* Unrecognized key, just skip the entire value. */
2917 	__archive_read_consume(a, value_length);
2918 	return (err);
2919 }
2920 
2921 
2922 
2923 /*
2924  * Parse a decimal time value, which may include a fractional portion
2925  *
2926  * Sets ps to INT64_MIN on error, including syntax issues such as non-digits,
2927  * or a time value that's outside the range of time_t.
2928  */
2929 static void
pax_time(const char * p,size_t length,int64_t * ps,long * pn)2930 pax_time(const char *p, size_t length, int64_t *ps, long *pn)
2931 {
2932 	char digit;
2933 	int64_t	s;
2934 	unsigned long l;
2935 	int sign;
2936 
2937 	if (length <= 0) {
2938 		*ps = 0;
2939 		*pn = 0;
2940 		return;
2941 	}
2942 	s = 0;
2943 	sign = 1;
2944 	if (*p == '-') {
2945 		sign = -1;
2946 		p++;
2947 		length--;
2948 	}
2949 	while (length > 0 && *p >= '0' && *p <= '9') {
2950 		digit = *p - '0';
2951 		if (archive_ckd_mul_i64(&s, s, 10) ||
2952 		    archive_ckd_add_i64(&s, s, digit)) {
2953 			*ps = INT64_MIN;
2954 			*pn = 0;
2955 			return;
2956 		}
2957 		++p;
2958 		--length;
2959 	}
2960 
2961 	*ps = s * sign;
2962 
2963 #if ARCHIVE_VERSION_NUMBER < 4000000
2964 	/* Libarchive 4.0 will have __LA_TIME_T == int64_t, so
2965 	   this will be unnecessary. */
2966 	/* Test whether it overflows __LA_TIME_T */
2967 	__LA_TIME_T sec = (__LA_TIME_T)*ps;
2968 	if ((int64_t)sec != *ps) {
2969 		*ps = INT64_MIN;
2970 		*pn = 0;
2971 		return;
2972 	}
2973 #endif
2974 
2975 	/* Calculate nanoseconds. */
2976 	*pn = 0;
2977 
2978 	if (length <= 0) {
2979 		return;
2980 	}
2981 
2982 	/* Skip `.` */
2983 	if (*p != '.') {
2984 		*ps = INT64_MIN;
2985 		*pn = 0;
2986 		return;
2987 	}
2988 	++p;
2989 	--length;
2990 
2991 	l = 100000000UL;
2992 	do {
2993 		if (length <= 0) {
2994 			return;
2995 		}
2996 		if (*p >= '0' && *p <= '9') {
2997 			*pn += (*p - '0') * l;
2998 		} else {
2999 			*ps = INT64_MIN;
3000 			*pn = 0;
3001 			return;
3002 		}
3003 		++p;
3004 		--length;
3005 	} while (l /= 10);
3006 
3007 	/* Ignore resolution beyond nanoseconds,
3008 	   but verify it's all decimal digits. */
3009 	while (length > 0) {
3010 		if (*p < '0' || *p > '9') {
3011 			*ps = INT64_MIN;
3012 			*pn = 0;
3013 			return;
3014 		}
3015 		++p;
3016 		--length;
3017 	}
3018 }
3019 
3020 /*
3021  * Parse GNU tar header
3022  */
3023 static int
header_gnutar(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const void * h,int64_t * unconsumed)3024 header_gnutar(struct archive_read *a, struct tar *tar,
3025     struct archive_entry *entry, const void *h, int64_t *unconsumed)
3026 {
3027 	struct archive_entry_header_gnutar header_copy;
3028 	const struct archive_entry_header_gnutar *header;
3029 	int64_t t;
3030 	int err = ARCHIVE_OK;
3031 
3032 	/*
3033 	 * GNU header is like POSIX ustar, except 'prefix' is
3034 	 * replaced with some other fields. This also means the
3035 	 * filename is stored as in old-style archives.
3036 	 */
3037 
3038 	/*
3039 	 * Sparse extension reads can reuse the callback buffer containing h,
3040 	 * so preserve the main header until common fields are parsed.
3041 	 */
3042 	memcpy(&header_copy, h, sizeof(header_copy));
3043 	header = &header_copy;
3044 
3045 	/* Copy filename over (to ensure null termination). */
3046 	const char *existing_pathname = archive_entry_pathname(entry);
3047 	const wchar_t *existing_wcs_pathname = archive_entry_pathname_w(entry);
3048 	if ((existing_pathname == NULL || existing_pathname[0] == '\0')
3049 	    && (existing_wcs_pathname == NULL || existing_wcs_pathname[0] == L'\0')) {
3050 		if (archive_entry_copy_pathname_l(entry,
3051 		    header->name, sizeof(header->name), tar->sconv) != 0) {
3052 			err = set_conversion_failed_error(a, tar->sconv, "Pathname");
3053 			if (err == ARCHIVE_FATAL)
3054 				return (err);
3055 		}
3056 	}
3057 
3058 	/* Fields common to ustar and GNU */
3059 	/* XXX Can the following be factored out since it's common
3060 	 * to ustar and gnu tar?  Is it okay to move it down into
3061 	 * header_common, perhaps?  */
3062 	const char *existing_uname = archive_entry_uname(entry);
3063 	if (existing_uname == NULL || existing_uname[0] == '\0') {
3064 		if (archive_entry_copy_uname_l(entry,
3065 		    header->uname, sizeof(header->uname), tar->sconv) != 0) {
3066 			err = set_conversion_failed_error(a, tar->sconv, "Uname");
3067 			if (err == ARCHIVE_FATAL)
3068 				return (err);
3069 		}
3070 	}
3071 
3072 	const char *existing_gname = archive_entry_gname(entry);
3073 	if (existing_gname == NULL || existing_gname[0] == '\0') {
3074 		if (archive_entry_copy_gname_l(entry,
3075 		    header->gname, sizeof(header->gname), tar->sconv) != 0) {
3076 			err = set_conversion_failed_error(a, tar->sconv, "Gname");
3077 			if (err == ARCHIVE_FATAL)
3078 				return (err);
3079 		}
3080 	}
3081 
3082 	/* Parse out device numbers only for char and block specials */
3083 	if (header->typeflag[0] == '3' || header->typeflag[0] == '4') {
3084 		if (!archive_entry_rdev_is_set(entry)) {
3085 			archive_entry_set_rdevmajor(entry, (dev_t)
3086 			    tar_atol(header->rdevmajor, sizeof(header->rdevmajor)));
3087 			archive_entry_set_rdevminor(entry, (dev_t)
3088 			    tar_atol(header->rdevminor, sizeof(header->rdevminor)));
3089 		}
3090 	} else {
3091 		archive_entry_set_rdev(entry, 0);
3092 	}
3093 
3094 	/* Grab GNU-specific fields. */
3095 	if (!archive_entry_atime_is_set(entry)) {
3096 		t = tar_atol(header->atime, sizeof(header->atime));
3097 		if (t > 0)
3098 			archive_entry_set_atime(entry, t, 0);
3099 	}
3100 	if (!archive_entry_ctime_is_set(entry)) {
3101 		t = tar_atol(header->ctime, sizeof(header->ctime));
3102 		if (t > 0)
3103 			archive_entry_set_ctime(entry, t, 0);
3104 	}
3105 
3106 	if (header->realsize[0] != 0) {
3107 		/* Treat as a synonym for the pax GNU.sparse.realsize attr */
3108 		tar->GNU_sparse_realsize
3109 		    = tar_atol(header->realsize, sizeof(header->realsize));
3110 		tar->size_fields |= TAR_SIZE_GNU_SPARSE_REALSIZE;
3111 	}
3112 
3113 	if (header->sparse[0].offset[0] != 0) {
3114 		if (gnu_sparse_old_read(a, tar, header, unconsumed)
3115 		    != ARCHIVE_OK)
3116 			return (ARCHIVE_FATAL);
3117 	} else {
3118 		if (header->isextended[0] != 0) {
3119 			/* XXX WTF? XXX */
3120 		}
3121 	}
3122 
3123 	/* Grab fields common to all tar variants. */
3124 	err = header_common(a, tar, entry, header);
3125 	if (err == ARCHIVE_FATAL)
3126 		return (err);
3127 
3128 	tar->entry_padding = 0x1ff & (-tar->entry_bytes_remaining);
3129 
3130 	return (err);
3131 }
3132 
3133 static int
gnu_add_sparse_entry(struct archive_read * a,struct tar * tar,int64_t offset,int64_t remaining)3134 gnu_add_sparse_entry(struct archive_read *a, struct tar *tar,
3135     int64_t offset, int64_t remaining)
3136 {
3137 	struct sparse_block *p;
3138 
3139 	p = calloc(1, sizeof(*p));
3140 	if (p == NULL) {
3141 		archive_set_error(&a->archive, ENOMEM, "Out of memory");
3142 		return (ARCHIVE_FATAL);
3143 	}
3144 	if (tar->sparse_last != NULL)
3145 		tar->sparse_last->next = p;
3146 	else
3147 		tar->sparse_list = p;
3148 	tar->sparse_last = p;
3149 	if (remaining < 0 || offset < 0 || offset > INT64_MAX - remaining) {
3150 		archive_set_error(&a->archive, ARCHIVE_ERRNO_MISC, "Malformed sparse map data");
3151 		return (ARCHIVE_FATAL);
3152 	}
3153 	p->offset = offset;
3154 	p->remaining = remaining;
3155 	return (ARCHIVE_OK);
3156 }
3157 
3158 static void
gnu_clear_sparse_list(struct tar * tar)3159 gnu_clear_sparse_list(struct tar *tar)
3160 {
3161 	struct sparse_block *p;
3162 
3163 	while (tar->sparse_list != NULL) {
3164 		p = tar->sparse_list;
3165 		tar->sparse_list = p->next;
3166 		free(p);
3167 	}
3168 	tar->sparse_last = NULL;
3169 }
3170 
3171 /*
3172  * GNU tar old-format sparse data.
3173  *
3174  * GNU old-format sparse data is stored in a fixed-field
3175  * format.  Offset/size values are 11-byte octal fields (same
3176  * format as 'size' field in ustart header).  These are
3177  * stored in the header, allocating subsequent header blocks
3178  * as needed.  Extending the header in this way is a pretty
3179  * severe POSIX violation; this design has earned GNU tar a
3180  * lot of criticism.
3181  */
3182 
3183 static int
gnu_sparse_old_read(struct archive_read * a,struct tar * tar,const struct archive_entry_header_gnutar * header,int64_t * unconsumed)3184 gnu_sparse_old_read(struct archive_read *a, struct tar *tar,
3185     const struct archive_entry_header_gnutar *header, int64_t *unconsumed)
3186 {
3187 	const void *data;
3188 	struct extended {
3189 		struct gnu_sparse sparse[21];
3190 		char	isextended[1];
3191 		char	padding[7];
3192 	};
3193 	const struct extended *ext;
3194 
3195 	if (gnu_sparse_old_parse(a, tar, header->sparse, 4) != ARCHIVE_OK)
3196 		return (ARCHIVE_FATAL);
3197 	if (header->isextended[0] == 0)
3198 		return (ARCHIVE_OK);
3199 
3200 	do {
3201 		if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3202 			return (ARCHIVE_FATAL);
3203 		}
3204 		data = __archive_read_ahead(a, 512, NULL);
3205 		if (data == NULL) {
3206 			archive_set_error(&a->archive, ARCHIVE_ERRNO_FILE_FORMAT,
3207 			    "Truncated tar archive "
3208 			    "detected while reading sparse file data");
3209 			return (ARCHIVE_FATAL);
3210 		}
3211 		*unconsumed = 512;
3212 		ext = (const struct extended *)data;
3213 		if (gnu_sparse_old_parse(a, tar, ext->sparse, 21) != ARCHIVE_OK)
3214 			return (ARCHIVE_FATAL);
3215 	} while (ext->isextended[0] != 0);
3216 	if (tar->sparse_list != NULL)
3217 		tar->entry_offset = tar->sparse_list->offset;
3218 	return (ARCHIVE_OK);
3219 }
3220 
3221 static int
gnu_sparse_old_parse(struct archive_read * a,struct tar * tar,const struct gnu_sparse * sparse,int length)3222 gnu_sparse_old_parse(struct archive_read *a, struct tar *tar,
3223     const struct gnu_sparse *sparse, int length)
3224 {
3225 	while (length > 0 && sparse->offset[0] != 0) {
3226 		if (gnu_add_sparse_entry(a, tar,
3227 		    tar_atol(sparse->offset, sizeof(sparse->offset)),
3228 		    tar_atol(sparse->numbytes, sizeof(sparse->numbytes)))
3229 		    != ARCHIVE_OK)
3230 			return (ARCHIVE_FATAL);
3231 		sparse++;
3232 		length--;
3233 	}
3234 	return (ARCHIVE_OK);
3235 }
3236 
3237 /*
3238  * GNU tar sparse format 0.0
3239  *
3240  * Beginning with GNU tar 1.15, sparse files are stored using
3241  * information in the pax extended header.  The GNU tar maintainers
3242  * have gone through a number of variations in the process of working
3243  * out this scheme; fortunately, they're all numbered.
3244  *
3245  * Sparse format 0.0 uses attribute GNU.sparse.numblocks to store the
3246  * number of blocks, and GNU.sparse.offset/GNU.sparse.numbytes to
3247  * store offset/size for each block.  The repeated instances of these
3248  * latter fields violate the pax specification (which frowns on
3249  * duplicate keys), so this format was quickly replaced.
3250  */
3251 
3252 /*
3253  * GNU tar sparse format 0.1
3254  *
3255  * This version replaced the offset/numbytes attributes with
3256  * a single "map" attribute that stored a list of integers.  This
3257  * format had two problems: First, the "map" attribute could be very
3258  * long, which caused problems for some implementations.  More
3259  * importantly, the sparse data was lost when extracted by archivers
3260  * that didn't recognize this extension.
3261  */
3262 static int
gnu_sparse_01_parse(struct archive_read * a,struct tar * tar,const char * p,size_t length)3263 gnu_sparse_01_parse(struct archive_read *a, struct tar *tar, const char *p, size_t length)
3264 {
3265 	const char *e;
3266 	int64_t offset = -1, size = -1;
3267 
3268 	for (;;) {
3269 		e = p;
3270 		while (length > 0 && *e != ',') {
3271 			if (*e < '0' || *e > '9')
3272 				return (ARCHIVE_WARN);
3273 			e++;
3274 			length--;
3275 		}
3276 		if (offset < 0) {
3277 			offset = tar_atol10(p, e - p);
3278 			if (offset < 0)
3279 				return (ARCHIVE_WARN);
3280 		} else {
3281 			size = tar_atol10(p, e - p);
3282 			if (size < 0)
3283 				return (ARCHIVE_WARN);
3284 			if (gnu_add_sparse_entry(a, tar, offset, size)
3285 			    != ARCHIVE_OK)
3286 				return (ARCHIVE_FATAL);
3287 			offset = -1;
3288 		}
3289 		if (length == 0)
3290 			return (ARCHIVE_OK);
3291 		p = e + 1;
3292 		length--;
3293 	}
3294 }
3295 
3296 /*
3297  * GNU tar sparse format 1.0
3298  *
3299  * The idea: The offset/size data is stored as a series of base-10
3300  * ASCII numbers prepended to the file data, so that dearchivers that
3301  * don't support this format will extract the block map along with the
3302  * data and a separate post-process can restore the sparseness.
3303  *
3304  * Unfortunately, GNU tar 1.16 had a bug that added unnecessary
3305  * padding to the body of the file when using this format.  GNU tar
3306  * 1.17 corrected this bug without bumping the version number, so
3307  * it's not possible to support both variants.  This code supports
3308  * the later variant at the expense of not supporting the former.
3309  *
3310  * This variant also introduced the GNU.sparse.major/GNU.sparse.minor attributes.
3311  */
3312 
3313 /*
3314  * Read the next line from the input, and parse it as a decimal
3315  * integer followed by '\n'.  Returns positive integer value or
3316  * negative on error.
3317  */
3318 static int64_t
gnu_sparse_10_atol(struct archive_read * a,struct tar * tar,int64_t * remaining,int64_t * unconsumed)3319 gnu_sparse_10_atol(struct archive_read *a, struct tar *tar,
3320     int64_t *remaining, int64_t *unconsumed)
3321 {
3322 	int64_t l;
3323 	const char *p;
3324 	ssize_t bytes_read;
3325 	int base, digit;
3326 
3327 	base = 10;
3328 
3329 	/*
3330 	 * Skip any lines starting with '#'; GNU tar specs
3331 	 * don't require this, but they should.
3332 	 */
3333 	do {
3334 		bytes_read = readline(a, tar, &p,
3335 			(ssize_t)tar_min(*remaining, 100), unconsumed);
3336 		if (bytes_read <= 0)
3337 			return (ARCHIVE_FATAL);
3338 		*remaining -= bytes_read;
3339 	} while (p[0] == '#');
3340 
3341 	l = 0;
3342 	while (bytes_read > 0) {
3343 		if (*p == '\n')
3344 			return (l);
3345 		if (*p < '0' || *p >= '0' + base)
3346 			return (ARCHIVE_WARN);
3347 		digit = *p - '0';
3348 		if (archive_ckd_mul_i64(&l, l, base) ||
3349 		    archive_ckd_add_i64(&l, l, digit)) {
3350 			l = INT64_MAX; /* Truncate on overflow. */
3351 		}
3352 		p++;
3353 		bytes_read--;
3354 	}
3355 	/* TODO: Error message. */
3356 	return (ARCHIVE_WARN);
3357 }
3358 
3359 /*
3360  * Returns length (in bytes) of the sparse data description
3361  * that was read.
3362  */
3363 static int64_t
gnu_sparse_10_read(struct archive_read * a,struct tar * tar,int64_t * unconsumed)3364 gnu_sparse_10_read(struct archive_read *a, struct tar *tar, int64_t *unconsumed)
3365 {
3366 	int64_t bytes_read, entries, offset, size, to_skip, remaining;
3367 
3368 	/* Clear out the existing sparse list. */
3369 	gnu_clear_sparse_list(tar);
3370 
3371 	remaining = tar->entry_bytes_remaining;
3372 
3373 	/* Parse entries. */
3374 	entries = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3375 	if (entries < 0)
3376 		return (ARCHIVE_FATAL);
3377 	/* Parse the individual entries. */
3378 	while (entries-- > 0) {
3379 		/* Parse offset/size */
3380 		offset = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3381 		if (offset < 0)
3382 			return (ARCHIVE_FATAL);
3383 		size = gnu_sparse_10_atol(a, tar, &remaining, unconsumed);
3384 		if (size < 0)
3385 			return (ARCHIVE_FATAL);
3386 		/* Add a new sparse entry. */
3387 		if (gnu_add_sparse_entry(a, tar, offset, size) != ARCHIVE_OK)
3388 			return (ARCHIVE_FATAL);
3389 	}
3390 	/* Skip rest of block... */
3391 	if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3392 		return (ARCHIVE_FATAL);
3393 	}
3394 	bytes_read = tar->entry_bytes_remaining - remaining;
3395 	to_skip = 0x1ff & -bytes_read;
3396 	/* Fail if tar->entry_bytes_remaing would get negative */
3397 	if (to_skip > remaining)
3398 		return (ARCHIVE_FATAL);
3399 	if (to_skip != __archive_read_consume(a, to_skip))
3400 		return (ARCHIVE_FATAL);
3401 	return (bytes_read + to_skip);
3402 }
3403 
3404 /*
3405  * Solaris pax extension for a sparse file. This is recorded with the
3406  * data and hole pairs. The way recording sparse information by Solaris'
3407  * pax simply indicates where data and sparse are, so the stored contents
3408  * consist of both data and hole.
3409  */
3410 static int
pax_attribute_SUN_holesdata(struct archive_read * a,struct tar * tar,struct archive_entry * entry,const char * p,size_t length)3411 pax_attribute_SUN_holesdata(struct archive_read *a, struct tar *tar,
3412 	struct archive_entry *entry, const char *p, size_t length)
3413 {
3414 	const char *e;
3415 	int64_t start, end;
3416 	int hole = 1;
3417 
3418 	(void)entry; /* UNUSED */
3419 
3420 	end = 0;
3421 	if (length <= 0)
3422 		return (ARCHIVE_WARN);
3423 	if (*p == ' ') {
3424 		p++;
3425 		length--;
3426 	} else {
3427 		return (ARCHIVE_WARN);
3428 	}
3429 	for (;;) {
3430 		e = p;
3431 		while (length > 0 && *e != ' ') {
3432 			if (*e < '0' || *e > '9')
3433 				return (ARCHIVE_WARN);
3434 			e++;
3435 			length--;
3436 		}
3437 		start = end;
3438 		end = tar_atol10(p, e - p);
3439 		if (end < 0)
3440 			return (ARCHIVE_WARN);
3441 		if (start < end) {
3442 			if (gnu_add_sparse_entry(a, tar, start,
3443 			    end - start) != ARCHIVE_OK)
3444 				return (ARCHIVE_FATAL);
3445 			tar->sparse_last->hole = hole;
3446 		}
3447 		if (length == 0)
3448 			return (ARCHIVE_OK);
3449 		if (*e == '\n')
3450 			return (ARCHIVE_WARN);
3451 		p = e + 1;
3452 		length--;
3453 		hole = hole == 0;
3454 	}
3455 }
3456 
3457 /*-
3458  * Convert text->integer.
3459  *
3460  * Traditional tar formats (including POSIX) specify base-8 for
3461  * all of the standard numeric fields.  This is a significant limitation
3462  * in practice:
3463  *   = file size is limited to 8GB
3464  *   = rdevmajor and rdevminor are limited to 21 bits
3465  *   = uid/gid are limited to 21 bits
3466  *
3467  * There are two workarounds for this:
3468  *   = pax extended headers, which use variable-length string fields
3469  *   = GNU tar and STAR both allow either base-8 or base-256 in
3470  *      most fields.  The high bit is set to indicate base-256.
3471  *
3472  * On read, this implementation supports both extensions.
3473  */
3474 static int64_t
tar_atol(const char * p,size_t char_cnt)3475 tar_atol(const char *p, size_t char_cnt)
3476 {
3477 	/*
3478 	 * Technically, GNU tar considers a field to be in base-256
3479 	 * only if the first byte is 0xff or 0x80.
3480 	 */
3481 	if (*p & 0x80)
3482 		return (tar_atol256(p, char_cnt));
3483 	return (tar_atol8(p, char_cnt));
3484 }
3485 
3486 /*
3487  * Note that this implementation does not (and should not!) obey
3488  * locale settings; you cannot simply substitute strtol here, since
3489  * it does obey locale.
3490  */
3491 static int64_t
tar_atol_base_n(const char * p,size_t char_cnt,int base)3492 tar_atol_base_n(const char *p, size_t char_cnt, int base)
3493 {
3494 	int64_t	l;
3495 	int digit, sign;
3496 
3497 	/* the pointer will not be dereferenced if char_cnt is zero
3498 	 * due to the way the && operator is evaluated.
3499 	 */
3500 	while (char_cnt != 0 && (*p == ' ' || *p == '\t')) {
3501 		p++;
3502 		char_cnt--;
3503 	}
3504 
3505 	sign = 1;
3506 	if (char_cnt != 0 && *p == '-') {
3507 		sign = -1;
3508 		p++;
3509 		char_cnt--;
3510 	}
3511 
3512 	l = 0;
3513 	while (char_cnt != 0) {
3514 		digit = *p - '0';
3515 		if (digit < 0 || digit >= base)
3516 			break;
3517 		if (archive_ckd_mul_i64(&l, l, base) ||
3518 		    archive_ckd_add_i64(&l, l, sign * digit)) {
3519 			 /* Truncate on overflow. */
3520 			return sign < 0 ? INT64_MIN : INT64_MAX;
3521 		}
3522 		p++;
3523 		char_cnt--;
3524 	}
3525 	return l;
3526 }
3527 
3528 static int64_t
tar_atol8(const char * p,size_t char_cnt)3529 tar_atol8(const char *p, size_t char_cnt)
3530 {
3531 	return tar_atol_base_n(p, char_cnt, 8);
3532 }
3533 
3534 static int64_t
tar_atol10(const char * p,size_t char_cnt)3535 tar_atol10(const char *p, size_t char_cnt)
3536 {
3537 	return tar_atol_base_n(p, char_cnt, 10);
3538 }
3539 
3540 /*
3541  * Parse a base-256 integer.  This is just a variable-length
3542  * twos-complement signed binary value in big-endian order, except
3543  * that the high-order bit is ignored.  The values here can be up to
3544  * 12 bytes, so we need to be careful about overflowing 64-bit
3545  * (8-byte) integers.
3546  *
3547  * This code unashamedly assumes that the local machine uses 8-bit
3548  * bytes and twos-complement arithmetic.
3549  */
3550 static int64_t
tar_atol256(const char * _p,size_t char_cnt)3551 tar_atol256(const char *_p, size_t char_cnt)
3552 {
3553 	uint64_t l;
3554 	const unsigned char *p = (const unsigned char *)_p;
3555 	unsigned char c, neg;
3556 
3557 	/* Extend 7-bit 2s-comp to 8-bit 2s-comp, decide sign. */
3558 	c = *p;
3559 	if (c & 0x40) {
3560 		neg = 0xff;
3561 		c |= 0x80;
3562 		l = ~ARCHIVE_LITERAL_ULL(0);
3563 	} else {
3564 		neg = 0;
3565 		c &= 0x7f;
3566 		l = 0;
3567 	}
3568 
3569 	/* If more than 8 bytes, check that we can ignore
3570 	 * high-order bits without overflow. */
3571 	while (char_cnt > sizeof(int64_t)) {
3572 		--char_cnt;
3573 		if (c != neg)
3574 			return neg ? INT64_MIN : INT64_MAX;
3575 		c = *++p;
3576 	}
3577 
3578 	/* c is first byte that fits; if sign mismatch, return overflow */
3579 	if ((c ^ neg) & 0x80) {
3580 		return neg ? INT64_MIN : INT64_MAX;
3581 	}
3582 
3583 	/* Accumulate remaining bytes. */
3584 	while (--char_cnt > 0) {
3585 		l = (l << 8) | c;
3586 		c = *++p;
3587 	}
3588 	l = (l << 8) | c;
3589 	/* Return signed twos-complement value. */
3590 	return (int64_t)(l);
3591 }
3592 
3593 /*
3594  * Returns length of line (including trailing newline)
3595  * or negative on error.  'start' argument is updated to
3596  * point to first character of line.  This avoids copying
3597  * when possible.
3598  */
3599 static ssize_t
readline(struct archive_read * a,struct tar * tar,const char ** start,ssize_t limit,int64_t * unconsumed)3600 readline(struct archive_read *a, struct tar *tar, const char **start,
3601     ssize_t limit, int64_t *unconsumed)
3602 {
3603 	ssize_t bytes_read;
3604 	ssize_t total_size = 0;
3605 	const void *p, *t;
3606 	const char *s;
3607 
3608 	if (tar_flush_unconsumed(a, unconsumed) != ARCHIVE_OK) {
3609 		return (ARCHIVE_FATAL);
3610 	}
3611 
3612 	t = __archive_read_ahead(a, 1, &bytes_read);
3613 	if (bytes_read <= 0 || t == NULL)
3614 		return (ARCHIVE_FATAL);
3615 	s = t;  /* Start of line? */
3616 	p = memchr(t, '\n', bytes_read);
3617 	/* If we found '\n' in the read buffer, return pointer to that. */
3618 	if (p != NULL) {
3619 		bytes_read = 1 + ((const char *)p) - s;
3620 		if (bytes_read > limit) {
3621 			archive_set_error(&a->archive,
3622 			    ARCHIVE_ERRNO_FILE_FORMAT,
3623 			    "Line too long");
3624 			return (ARCHIVE_FATAL);
3625 		}
3626 		*unconsumed = bytes_read;
3627 		*start = s;
3628 		return (bytes_read);
3629 	}
3630 	*unconsumed = bytes_read;
3631 	/* Otherwise, we need to accumulate in a line buffer. */
3632 	for (;;) {
3633 		if (total_size + bytes_read > limit) {
3634 			archive_set_error(&a->archive,
3635 			    ARCHIVE_ERRNO_FILE_FORMAT,
3636 			    "Line too long");
3637 			return (ARCHIVE_FATAL);
3638 		}
3639 		if (archive_string_ensure(&tar->line, total_size + bytes_read) == NULL) {
3640 			archive_set_error(&a->archive, ENOMEM,
3641 			    "Can't allocate working buffer");
3642 			return (ARCHIVE_FATAL);
3643 		}
3644 		memcpy(tar->line.s + total_size, t, bytes_read);
3645 		tar_flush_unconsumed(a, unconsumed);
3646 		total_size += bytes_read;
3647 		/* If we found '\n', clean up and return. */
3648 		if (p != NULL) {
3649 			*start = tar->line.s;
3650 			return (total_size);
3651 		}
3652 		/* Read some more. */
3653 		t = __archive_read_ahead(a, 1, &bytes_read);
3654 		if (bytes_read <= 0 || t == NULL)
3655 			return (ARCHIVE_FATAL);
3656 		s = t;  /* Start of line? */
3657 		p = memchr(t, '\n', bytes_read);
3658 		/* If we found '\n', trim the read. */
3659 		if (p != NULL) {
3660 			bytes_read = 1 + ((const char *)p) - s;
3661 		}
3662 		*unconsumed = bytes_read;
3663 	}
3664 }
3665 
3666 /*
3667  * base64_decode - Base64 decode
3668  *
3669  * This accepts most variations of base-64 encoding, including:
3670  *    * with or without line breaks
3671  *    * with or without the final group padded with '=' or '_' characters
3672  * (The most economical Base-64 variant does not pad the last group and
3673  * omits line breaks; RFC1341 used for MIME requires both.)
3674  */
3675 static char *
base64_decode(const char * s,size_t len,size_t * out_len)3676 base64_decode(const char *s, size_t len, size_t *out_len)
3677 {
3678 	static const unsigned char decode_table[128] = {
3679 		255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3680 		255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3681 		255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 255,
3682 		255, 255, 255, 255, 255, 255, 255, 62, 255, 255, 255, 63,
3683 		52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, 255, 255,
3684 		255, 255, 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13,
3685 		14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255,
3686 		255, 255, 255, 255, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35,
3687 		36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50,
3688 		51, 255, 255, 255, 255, 255 };
3689 	char *out, *d;
3690 	const unsigned char *src = (const unsigned char *)s;
3691 
3692 	/* Allocate enough space to hold the entire output. */
3693 	/* Note that we may not use all of this... */
3694 	out = malloc(len - len / 4 + 1);
3695 	if (out == NULL) {
3696 		*out_len = 0;
3697 		return (NULL);
3698 	}
3699 	d = out;
3700 
3701 	while (len > 0) {
3702 		/* Collect the next group of (up to) four characters. */
3703 		int v = 0;
3704 		int group_size = 0;
3705 		while (group_size < 4 && len > 0) {
3706 			/* '=' or '_' padding indicates final group. */
3707 			if (*src == '=' || *src == '_') {
3708 				len = 0;
3709 				break;
3710 			}
3711 			/* Skip illegal characters (including line breaks) */
3712 			if (*src > 127 || *src < 32
3713 			    || decode_table[*src] == 0xff) {
3714 				len--;
3715 				src++;
3716 				continue;
3717 			}
3718 			v <<= 6;
3719 			v |= decode_table[*src++];
3720 			len --;
3721 			group_size++;
3722 		}
3723 		/* Align a short group properly. */
3724 		v <<= 6 * (4 - group_size);
3725 		/* Unpack the group we just collected. */
3726 		switch (group_size) {
3727 		case 4: d[2] = v & 0xff;
3728 			/* FALLTHROUGH */
3729 		case 3: d[1] = (v >> 8) & 0xff;
3730 			/* FALLTHROUGH */
3731 		case 2: d[0] = (v >> 16) & 0xff;
3732 			break;
3733 		case 1: /* this is invalid! */
3734 			break;
3735 		}
3736 		d += group_size * 3 / 4;
3737 	}
3738 
3739 	*out_len = d - out;
3740 	return (out);
3741 }
3742 
3743 static char *
url_decode(const char * in,size_t length)3744 url_decode(const char *in, size_t length)
3745 {
3746 	char *out, *d;
3747 	const char *s;
3748 
3749 	out = malloc(length + 1);
3750 	if (out == NULL)
3751 		return (NULL);
3752 	for (s = in, d = out; length > 0 && *s != '\0'; ) {
3753 		if (s[0] == '%' && length > 2) {
3754 			/* Try to convert % escape */
3755 			int digit1 = tohex(s[1]);
3756 			int digit2 = tohex(s[2]);
3757 			if (digit1 >= 0 && digit2 >= 0) {
3758 				/* Looks good, consume three chars */
3759 				s += 3;
3760 				length -= 3;
3761 				/* Convert output */
3762 				*d++ = ((digit1 << 4) | digit2);
3763 				continue;
3764 			}
3765 			/* Else fall through and treat '%' as normal char */
3766 		}
3767 		*d++ = *s++;
3768 		--length;
3769 	}
3770 	*d = '\0';
3771 	return (out);
3772 }
3773 
3774 static int
tohex(int c)3775 tohex(int c)
3776 {
3777 	if (c >= '0' && c <= '9')
3778 		return (c - '0');
3779 	else if (c >= 'A' && c <= 'F')
3780 		return (c - 'A' + 10);
3781 	else if (c >= 'a' && c <= 'f')
3782 		return (c - 'a' + 10);
3783 	else
3784 		return (-1);
3785 }
3786