0004644: tar memory errors when called w/ incorrect arguments

Cristian Cadar cristic at stanford.edu
Tue Aug 19 01:53:23 UTC 2008


http://bugs.busybox.net/view.php?id=4644

Test cases:

$./tar tf_ /
tar: can't open �N�NOOO/O5OFOMO^OgOxO�O�O�O': No such file or
directory

$ ./tar tfx /
tar: can't open ' ��x ��x �x �x �x /�x 5�x F�x M�x
^�x g�x x�x ��x ��x ��x ': No such file or directory

This should be rejected by tar, as in GNU tar:
$ tar tf_ /
tar: invalid option -- _
Try `tar --help' or `tar --usage' for more information.

tar tfx /
tar: You may not specify more than one `-Acdtrux' option
Try `tar --help' or `tar --usage' for more information.


The problem is that when getopt32 is called at tar.c:835, tar_filename 
is set incorrectly, and later invalid memory is read from tar_filename,
as on line tar.c:931 (if (LONE_DASH(tar_filename)) ...)

Thanks,
Cristian





More information about the busybox mailing list