From cb07844454d8cc9fb21f53ace75975f91185a120 Mon Sep 17 00:00:00 2001 From: Sergey Poznyakoff Date: Mon, 14 Jan 2019 15:22:09 +0200 Subject: [PATCH] Fix possible NULL dereference (savannah bug #55369) * src/sparse.c (pax_decode_header): Check return from find_next_block. Upstream-Status: Backport CVE: CVE-2019-9923 Affects: tar < 1.32 Signed-off-by: Armin kuster --- src/sparse.c | 4 ++++ 1 file changed, 4 insertions(+) Index: tar-1.30/src/sparse.c =================================================================== --- tar-1.30.orig/src/sparse.c +++ tar-1.30/src/sparse.c @@ -1231,6 +1231,8 @@ pax_decode_header (struct tar_sparse_fil set_next_block_after (b); \ file->dumped_size += BLOCKSIZE; \ b = find_next_block (); \ + if (!b) \ + FATAL_ERROR ((0, 0, _("Unexpected EOF in archive"))); \ src = b->buffer; \ endp = b->buffer + BLOCKSIZE; \ } \ @@ -1243,6 +1245,8 @@ pax_decode_header (struct tar_sparse_fil set_next_block_after (current_header); file->dumped_size += BLOCKSIZE; blk = find_next_block (); + if (!blk) + FATAL_ERROR ((0, 0, _("Unexpected EOF in archive"))); p = blk->buffer; COPY_BUF (blk,nbuf,p); if (!decode_num (&u, nbuf, TYPE_MAXIMUM (size_t)))