Control: tags -1 + patch Hi,
Attached is a debdiff for a 1.35+dfsg-7.1 NMU fixing CVE-2026-5704
(tar -t / tar -x desynchronisation, "hidden file injection"). I have not
uploaded anything; please use as much or as little of it as you like.
Upstream's fix, b8d8a61b ("Fix more -t/-x discrepancies"), is part of a
rework built on post-1.35 changes (its message says it fixes a bug from
b009124f, which is not in 1.35), so it does not apply to 1.35. However
1.35 itself is affected, as the original report says: for symlink,
character/block device and FIFO members with a nonzero size field,
"tar -t" skips the data blocks but "tar -x" parses them as further
headers.
The attached patch is a minimal backport of the same approach to 1.35:
- extract_archive(): after the extractors that never read member data
(SYMTYPE, LNKTYPE, CHRTYPE, BLKTYPE, FIFOTYPE), call skip_member(),
whether extraction succeeded or failed;
- skim_member(): mark the member as skipped, as upstream does, so a
second skip_member() call is harmless;
- read_header(): clear that mark for each new header, as upstream does.
This part matters: without it "tar --delete" loops forever (delete04
hung in my first attempt), because the delete code does not reset
current_stat_info between members.
Regular files and directories keep their 1.35 handling, and LNKTYPE keeps
its 1.35 size-zero treatment (consistent between -t and -x already).
Upstream's regression test extrac32 ("skip file injection") is added to
the 1.35 test suite as extrac26, minus its stray "cp archive.tar /tmp".
Testing (sid chroot, amd64, test suite run as a non-root user):
- test suite: 217 successful, 28 skipped (xattr, big-file and similar
environment-dependent tests), including the new "skip file injection"
test.
- a reproducer that builds an archive with a symlink, FIFO, char device
or hard link member whose size field covers a hidden second member:
1.35+dfsg-7: symlink, FIFO and char device: the hidden file is
created by -x but not listed by -t
1.35+dfsg-7.1: -t and -x agree in all four cases
- regression checks: a normal archive (regular, symlink, hard link, FIFO,
300 kB file) lists and extracts as before, --delete works, and listing
an archive made by 1.35+dfsg-7 gives identical output.
- lintian: source tags identical to 1.35+dfsg-7.
"tar -d" (compare) has a similar pattern for symlinks and special files;
upstream's commit does not change it, so neither does this patch.
Regards,
automationcanadian
tar_1.35+dfsg-7.1.debdiff.gz
Description: application/gzip
