Fix CVE-2022-48303

Resolves: CVE-2022-48303

tar-1.34-CVE-2022-48303.patch

@@ -0,0 +1,30 @@
+From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 11 Feb 2023 11:57:39 +0200
+Subject: [PATCH] Fix boundary checking in base-256 decoder
+
+* src/list.c (from_header): Base-256 encoding is at least 2 bytes
+long.
+---
+ src/list.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc425..86bcfdd1 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
+ 	  where++;
+ 	}
+     }
+-  else if (*where == '\200' /* positive base-256 */
+-	   || *where == '\377' /* negative base-256 */)
++  else if (where <= lim - 2
++	   && (*where == '\200' /* positive base-256 */
++	       || *where == '\377' /* negative base-256 */))
+     {
+       /* Parse base-256 output.  A nonnegative number N is
+ 	 represented as (256**DIGS)/2 + N; a negative number -N is
+-- 
+2.38.1
+

tar.spec

@@ -5,7 +5,7 @@ Summary: GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.34
-Release: 5%{?dist}
+Release: 6%{?dist}
 License: GPLv3+
 URL: https://www.gnu.org/software/tar/
 
@@ -21,6 +21,7 @@ Patch9:  tar-1.28-document-exclude-mistakes.patch
 Patch10: tar-1.33-fix-capabilities-test.patch
 Patch11: tar-1.30-padding-zeros.patch
 Patch12: tar-1.30-disk-read-error.patch
+Patch13: tar-1.34-CVE-2022-48303.patch
 
 BuildRequires: make
 BuildRequires:  gcc
@@ -115,6 +116,10 @@ make check || (
 
 
 %changelog
+* Thu Feb 09 2023 Matej Mužila <mmuzila@redhat.com> - 2:1.34-6
+- Fix CVE-2022-48303
+- Resolves: CVE-2022-48303
+
 * Fri Jul 01 2022 Lukas Javorsky <ljavorsk@redhat.com> - 2:1.34-5
 - Release bump