[git commit] tar: only strip unsafe components from hardlinks, not symlinks

Denys Vlasenko vda.linux at googlemail.com
Sat Feb 28 04:59:18 UTC 2026


commit: https://git.busybox.net/busybox/commit/?id=599f5dd8fac390c18b79cba4c14c334957605dae
branch: https://git.busybox.net/busybox/log/?h=master

commit 3fb6b31c7 introduced a check for unsafe components in
tar archive hardlinks, but it was being applied to symlinks too
which broke "Symlinks and hardlinks coexist" tar test.

Signed-off-by: Radoslav Kolev <radoslav.kolev at suse.com>
Signed-off-by: Denys Vlasenko <vda.linux at googlemail.com>
---
 archival/libarchive/get_header_tar.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/archival/libarchive/get_header_tar.c b/archival/libarchive/get_header_tar.c
index 1c40ecedb..606d8067f 100644
--- a/archival/libarchive/get_header_tar.c
+++ b/archival/libarchive/get_header_tar.c
@@ -455,7 +455,7 @@ char FAST_FUNC get_header_tar(archive_handle_t *archive_handle)
 
 	/* Everything up to and including last ".." component is stripped */
 	strip_unsafe_prefix(file_header->name);
-	if (file_header->link_target) {
+	if (file_header->link_target && !S_ISLNK(file_header->mode)) {
 		/* GNU tar 1.34 examples:
 		 * tar: Removing leading '/' from hard link targets
 		 * tar: Removing leading '../' from hard link targets


More information about the busybox-cvs mailing list