import tar-1.30-9.el8

SOURCES/tar-1.30-CVE-2022-48303.patch

@@ -0,0 +1,30 @@
+From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 11 Feb 2023 11:57:39 +0200
+Subject: [PATCH] Fix boundary checking in base-256 decoder
+
+* src/list.c (from_header): Base-256 encoding is at least 2 bytes
+long.
+---
+ src/list.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc425..86bcfdd1 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
+ 	  where++;
+ 	}
+     }
+-  else if (*where == '\200' /* positive base-256 */
+-	   || *where == '\377' /* negative base-256 */)
++  else if (where <= lim - 2
++	   && (*where == '\200' /* positive base-256 */
++	       || *where == '\377' /* negative base-256 */))
+     {
+       /* Parse base-256 output.  A nonnegative number N is
+ 	 represented as (256**DIGS)/2 + N; a negative number -N is
+-- 
+2.38.1
+

SPECS/tar.spec

@@ -6,7 +6,7 @@ Summary: A GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.30
-Release: 8%{?dist}
+Release: 9%{?dist}
 License: GPLv3+
 Group: Applications/Archiving
 URL: http://www.gnu.org/software/tar/
@@ -30,6 +30,7 @@ Patch16: tar-1.30-disk-read-error.patch
 Patch17: tar-1.30-Fix-the-no-overwrite-dir-option
 # Remove the capabilities test, due to fails (BZ#2066320 and BZ#1926332)
 Patch18: tar-1.30-remove-capabs-test.patch
+Patch19: tar-1.30-CVE-2022-48303.patch
 
 # run "make check" by default
 %bcond_without check
@@ -136,6 +137,10 @@ fi
 %{_infodir}/tar.info*
 
 %changelog
+* Thu Feb 09 2023 Matej Mužila <mmuzila@redhat.com> - 1.30-9
+- Fix CVE-2022-48303
+- Resolves: CVE-2022-48303
+
 * Mon Dec 05 2022 Lukas Javorsky <ljavorsk@redhat.com> - 1.30-8
 - Remove the capabs_raw01 test from testsuite (#2066320)