tar: fix infinite loops in sparse file handling

Resolves: 1082608
Version: 1.27.1-3

tar-1.27.1-sparse-inf-loops.patch

@@ -0,0 +1,111 @@
+diff --git a/THANKS b/THANKS
+index a734fb6..2da6100 100644
+--- a/THANKS
++++ b/THANKS
+@@ -173,6 +173,7 @@ Fabio d'Alessi		cars@civ.bio.unipd.it
+ Frank Heckenbach	frank@g-n-u.de
+ Frank Koenen		koenfr@lidp.com
+ Franz-Werner Gergen	gergen@edvulx.mpi-stuttgart.mpg.de
++François Ouellet	fouell@gmail.com
+ François Pinard		pinard@iro.umontreal.ca
+ Fritz Elfert		fritz@fsun.triltsch.de
+ George Chyu		gschyu@ccgate.dp.beckman.com
+diff --git a/src/sparse.c b/src/sparse.c
+index f0268f4..250e845 100644
+--- a/src/sparse.c
++++ b/src/sparse.c
+@@ -301,6 +301,7 @@ sparse_dump_region (struct tar_sparse_file *file, size_t i)
+ {
+   union block *blk;
+   off_t bytes_left = file->stat_info->sparse_map[i].numbytes;
++  const char *file_name = file->stat_info->orig_file_name;
+ 
+   if (!lseek_or_error (file, file->stat_info->sparse_map[i].offset))
+     return false;
+@@ -314,13 +315,23 @@ sparse_dump_region (struct tar_sparse_file *file, size_t i)
+       bytes_read = safe_read (file->fd, blk->buffer, bufsize);
+       if (bytes_read == SAFE_READ_ERROR)
+ 	{
+-          read_diag_details (file->stat_info->orig_file_name,
++          read_diag_details (file_name,
+ 	                     (file->stat_info->sparse_map[i].offset
+ 			      + file->stat_info->sparse_map[i].numbytes
+ 			      - bytes_left),
+ 			     bufsize);
+ 	  return false;
+ 	}
++      if (bytes_read == 0)
++        {
++          char buf[UINTMAX_STRSIZE_BOUND];
++          FATAL_ERROR ((0, 0,
++                        ngettext ("%s: File shrank by %s byte",
++                                  "%s: File shrank by %s bytes",
++                                  bytes_left),
++                        quotearg_colon (file_name),
++                        offtostr (bytes_left, buf)));
++        }
+ 
+       memset (blk->buffer + bytes_read, 0, BLOCKSIZE - bytes_read);
+       bytes_left -= bytes_read;
+@@ -475,33 +486,37 @@ sparse_skip_file (struct tar_stat_info *st)
+ static bool
+ check_sparse_region (struct tar_sparse_file *file, off_t beg, off_t end)
+ {
+-  if (!lseek_or_error (file, beg))
++  off_t offset = beg;
++
++  if (!lseek_or_error (file, offset))
+     return false;
+ 
+-  while (beg < end)
++  while (offset < end)
+     {
+       size_t bytes_read;
+-      size_t rdsize = BLOCKSIZE < end - beg ? BLOCKSIZE : end - beg;
++      size_t rdsize = BLOCKSIZE < end - offset ? BLOCKSIZE : end - offset;
+       char diff_buffer[BLOCKSIZE];
+ 
+       bytes_read = safe_read (file->fd, diff_buffer, rdsize);
+       if (bytes_read == SAFE_READ_ERROR)
+ 	{
+           read_diag_details (file->stat_info->orig_file_name,
+-	                     beg,
+-			     rdsize);
+-	  return false;
+-	}
+-      if (!zero_block_p (diff_buffer, bytes_read))
+-	{
+-	  char begbuf[INT_BUFSIZE_BOUND (off_t)];
+- 	  report_difference (file->stat_info,
+-			     _("File fragment at %s is not a hole"),
+-			     offtostr (beg, begbuf));
++	                     offset, rdsize);
+ 	  return false;
+ 	}
+ 
+-      beg += bytes_read;
++      if (bytes_read == 0
++          || !zero_block_p (diff_buffer, bytes_read))
++        {
++          char begbuf[INT_BUFSIZE_BOUND (off_t)];
++          const char *msg = bytes_read ? _("File fragment at %s is not a hole")
++                                       : _("Hole starting at %s is truncated");
++
++          report_difference (file->stat_info, msg, offtostr (beg, begbuf));
++          return false;
++        }
++
++      offset += bytes_read;
+     }
+   return true;
+ }
+@@ -542,7 +557,8 @@ check_data_region (struct tar_sparse_file *file, size_t i)
+       file->dumped_size += bytes_read;
+       size_left -= bytes_read;
+       mv_size_left (file->stat_info->archive_file_size - file->dumped_size);
+-      if (memcmp (blk->buffer, diff_buffer, rdsize))
++      if (bytes_read == 0
++          || memcmp (blk->buffer, diff_buffer, bytes_read))
+ 	{
+ 	  report_difference (file->stat_info, _("Contents differ"));
+ 	  return false;

tar.spec

@@ -75,6 +75,12 @@ Patch9: tar-1.27.1-document-exclude-mistakes.patch
 # ~> #1082603
 Patch10: tar-1.27.1-default-acls.patch
 
+# Fix for infinite loops during sparse file handling
+# ~> dostream
+#    http://www.mail-archive.com/bug-tar@gnu.org/msg04432.html
+# ~> #1082608
+Patch11: tar-1.27.1-sparse-inf-loops.patch
+
 # run "make check" by default
 %bcond_without check
 
@@ -118,6 +124,7 @@ the rmt package on the remote box.
 %patch8 -p1 -b .xattrs-if-xattrs-include
 %patch9 -p1 -b .document-exclude-mistakes
 %patch10 -p1 -b .default-acls
+%patch11 -p1 -b .inf-loops-in-sparse
 
 autoreconf -v
 
@@ -179,6 +186,7 @@ fi
 * Mon Mar 31 2014 Pavel Raiskup <praiskup@redhat.com> - 1.27.1-3
 - document --exclude mistakes (#903666)
 - fix default ACLs propagation (#1082603)
+- infinite loop(s) in sparse-file handling (#1082608)
 
 * Fri Nov 29 2013 Pavel Raiskup <praiskup@redhat.com> - 1.27.1-2
 - sync manual page contents with help2man output