rpms/tar
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Backport fix of --no-overwrite-dir

Browse Source 
Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463

Resolves: RHEL-105968
This commit is contained in:
Pavel Cahyna 2025-08-01 17:09:07 +02:00
parent 8cea6e74f7
commit 7bc395d861
3 changed files with 277 additions and 91 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

182
tar-1.34-CVE-2025-45582.patch
View File

@ -1,6 +1,6 @@
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/aclocal.m4 tar-1.34-rhel-9.8-clean/aclocal.m4
--- tar-1.34-rhel-9.7/aclocal.m4 2025-12-12 13:03:34.135100650 +0100
+++ tar-1.34-rhel-9.8-clean/aclocal.m4 2025-12-19 16:27:11.022371960 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/aclocal.m4 tar-1.34-rhel-9.8-clean/aclocal.m4
--- a/aclocal.m4 2026-01-12 16:27:23.929483803 +0100
+++ b/aclocal.m4 2026-01-12 16:33:05.924014963 +0100
@@ -1292,6 +1292,7 @@
m4_include([m4/open-slash.m4])
m4_include([m4/open.m4])
@ -9,9 +9,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
m4_include([m4/opendir.m4])
m4_include([m4/parse-datetime.m4])
m4_include([m4/pathmax.m4])
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/doc/tar.texi tar-1.34-rhel-9.8-clean/doc/tar.texi
--- tar-1.34-rhel-9.7/doc/tar.texi 2025-12-11 15:55:21.932996281 +0100
+++ tar-1.34-rhel-9.8-clean/doc/tar.texi 2025-12-11 15:39:02.395862349 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/doc/tar.texi tar-1.34-rhel-9.8-clean/doc/tar.texi
--- a/doc/tar.texi 2026-01-12 16:26:50.532434565 +0100
+++ b/doc/tar.texi 2026-01-12 16:32:28.470876836 +0100
@@ -12809,26 +12809,31 @@
When @command{tar} extracts from an archive, by default it writes into
files relative to the working directory. If the archive was generated
@ -78,9 +78,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
@item
Do not let untrusted users access files extracted from untrusted
archives without checking first for problems such as setuid programs.
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/fcntl.in.h tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h
--- tar-1.34-rhel-9.7/gnu/fcntl.in.h 2025-12-12 13:03:03.674252702 +0100
+++ tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h 2025-12-12 13:03:04.802284103 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/fcntl.in.h tar-1.34-rhel-9.8-clean/gnu/fcntl.in.h
--- a/gnu/fcntl.in.h 2026-01-12 16:27:10.573064736 +0100
+++ b/gnu/fcntl.in.h 2026-01-12 16:32:51.735584155 +0100
@@ -233,6 +233,46 @@
# endif
#endif
@ -144,9 +144,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
#endif /* _@GUARD_PREFIX@_FCNTL_H */
#endif /* _@GUARD_PREFIX@_FCNTL_H */
#endif
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/Makefile.am tar-1.34-rhel-9.8-clean/gnu/Makefile.am
--- tar-1.34-rhel-9.7/gnu/Makefile.am 2025-12-12 13:03:20.614724279 +0100
+++ tar-1.34-rhel-9.8-clean/gnu/Makefile.am 2025-12-12 13:03:21.738755570 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/Makefile.am tar-1.34-rhel-9.8-clean/gnu/Makefile.am
--- a/gnu/Makefile.am 2026-01-12 16:27:18.417310942 +0100
+++ b/gnu/Makefile.am 2026-01-12 16:33:00.127839022 +0100
@@ -68,6 +68,7 @@
# gitlog-to-changelog \
# hash \
@ -192,9 +192,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
## begin gnulib module opendir
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/openat2.c tar-1.34-rhel-9.8-clean/gnu/openat2.c
--- tar-1.34-rhel-9.7/gnu/openat2.c 1970-01-01 01:00:00.000000000 +0100
+++ tar-1.34-rhel-9.8-clean/gnu/openat2.c 2025-12-12 13:03:05.526304258 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/openat2.c tar-1.34-rhel-9.8-clean/gnu/openat2.c
--- a/gnu/openat2.c 1970-01-01 01:00:00.000000000 +0100
+++ b/gnu/openat2.c 2026-01-12 16:32:51.431574919 +0100
@@ -0,0 +1,601 @@
+/* Open a file, with more flags than openat
+ Copyright 2025 Free Software Foundation, Inc.
@ -797,9 +797,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
+ }
+ return r;
+}
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/xalloc.h tar-1.34-rhel-9.8-clean/gnu/xalloc.h
--- tar-1.34-rhel-9.7/gnu/xalloc.h 2025-12-12 13:03:05.130293235 +0100
+++ tar-1.34-rhel-9.8-clean/gnu/xalloc.h 2025-12-12 13:03:06.318326306 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/xalloc.h tar-1.34-rhel-9.8-clean/gnu/xalloc.h
--- a/gnu/xalloc.h 2026-01-12 16:27:11.349089104 +0100
+++ b/gnu/xalloc.h 2026-01-12 16:32:52.487607000 +0100
@@ -21,6 +21,7 @@
#include <stddef.h>
#include <stdint.h>
@ -817,9 +817,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
void *xmemdup (void const *p, size_t s)
_GL_ATTRIBUTE_ALLOC_SIZE ((2));
char *xstrdup (char const *str)
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/gnu/xmalloc.c tar-1.34-rhel-9.8-clean/gnu/xmalloc.c
--- tar-1.34-rhel-9.7/gnu/xmalloc.c 2025-12-12 13:03:05.146293680 +0100
+++ tar-1.34-rhel-9.8-clean/gnu/xmalloc.c 2025-12-12 13:03:06.338326863 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/gnu/xmalloc.c tar-1.34-rhel-9.8-clean/gnu/xmalloc.c
--- a/gnu/xmalloc.c 2026-01-12 16:27:11.361089481 +0100
+++ b/gnu/xmalloc.c 2026-01-12 16:32:52.495607243 +0100
@@ -21,6 +21,9 @@
#include "xalloc.h"
@ -897,9 +897,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
/* Allocate N bytes of zeroed memory dynamically, with error checking.
There's no need for xnzalloc (N, S), since it would be equivalent
to xcalloc (N, S). */
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/fcntl_h.m4 tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4
--- tar-1.34-rhel-9.7/m4/fcntl_h.m4 2025-12-12 13:03:05.322298579 +0100
+++ tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4 2025-12-12 13:03:06.518331873 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/fcntl_h.m4 tar-1.34-rhel-9.8-clean/m4/fcntl_h.m4
--- a/m4/fcntl_h.m4 2026-01-12 16:27:11.465092747 +0100
+++ b/m4/fcntl_h.m4 2026-01-12 16:32:52.575609673 +0100
@@ -1,6 +1,6 @@
# serial 17
# Configure fcntl.h.
@ -932,9 +932,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
REPLACE_CREAT=0; AC_SUBST([REPLACE_CREAT])
REPLACE_FCNTL=0; AC_SUBST([REPLACE_FCNTL])
REPLACE_OPEN=0; AC_SUBST([REPLACE_OPEN])
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/gnulib-comp.m4 tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4
--- tar-1.34-rhel-9.7/m4/gnulib-comp.m4 2025-12-12 13:03:23.538805677 +0100
+++ tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4 2025-12-12 13:03:24.906843760 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/gnulib-comp.m4 tar-1.34-rhel-9.8-clean/m4/gnulib-comp.m4
--- a/m4/gnulib-comp.m4 2026-01-12 16:27:20.125364520 +0100
+++ b/m4/gnulib-comp.m4 2026-01-12 16:33:01.955894520 +0100
@@ -214,6 +214,7 @@
# Code from module openat-die:
# Code from module openat-h:
@ -972,9 +972,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
m4/opendir.m4
m4/parse-datetime.m4
m4/pathmax.m4
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/m4/openat2.m4 tar-1.34-rhel-9.8-clean/m4/openat2.m4
--- tar-1.34-rhel-9.7/m4/openat2.m4 1970-01-01 01:00:00.000000000 +0100
+++ tar-1.34-rhel-9.8-clean/m4/openat2.m4 2025-12-12 13:03:06.890342230 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/m4/openat2.m4 tar-1.34-rhel-9.8-clean/m4/openat2.m4
--- a/m4/openat2.m4 1970-01-01 01:00:00.000000000 +0100
+++ b/m4/openat2.m4 2026-01-12 16:32:51.439575162 +0100
@@ -0,0 +1,33 @@
+# openat2.m4
+# serial 1
@ -1009,9 +1009,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
+ #include <sys/vfs.h>
+ ]])])
+])
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/NEWS tar-1.34-rhel-9.8-clean/NEWS
--- tar-1.34-rhel-9.7/NEWS 2025-12-11 15:55:21.924996045 +0100
+++ tar-1.34-rhel-9.8-clean/NEWS 2025-12-11 15:39:02.391862228 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/NEWS tar-1.34-rhel-9.8-clean/NEWS
--- a/NEWS 2026-01-12 16:26:50.528434439 +0100
+++ b/NEWS 2026-01-12 16:32:28.466876714 +0100
@@ -1,6 +1,17 @@
-GNU tar NEWS - User visible changes. 2021-02-13
+GNU tar NEWS - User visible changes. 2025-12-05
@ -1031,9 +1031,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
version 1.34 - Sergey Poznyakoff, 2021-02-13
* Fix extraction over pipe (savannah bug #60002)
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/common.h tar-1.34-rhel-9.8-clean/src/common.h
--- tar-1.34-rhel-9.7/src/common.h 2025-12-11 15:55:21.936996399 +0100
+++ tar-1.34-rhel-9.8-clean/src/common.h 2025-12-11 15:39:02.399862469 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/common.h tar-1.34-rhel-9.8-clean/src/common.h
--- a/src/common.h 2026-01-12 16:26:50.612437084 +0100
+++ b/src/common.h 2026-01-12 16:32:28.674883043 +0100
@@ -58,6 +58,7 @@
#include <backupfile.h>
#include <exclude.h>
@ -1078,9 +1078,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
int chdir_count (void);
void close_diag (char const *name);
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/compare.c tar-1.34-rhel-9.8-clean/src/compare.c
--- tar-1.34-rhel-9.7/src/compare.c 2025-12-11 15:55:21.936996399 +0100
+++ tar-1.34-rhel-9.8-clean/src/compare.c 2025-12-11 15:39:02.399862469 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/compare.c tar-1.34-rhel-9.8-clean/src/compare.c
--- a/src/compare.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/compare.c 2026-01-12 16:32:28.674883043 +0100
@@ -219,7 +219,9 @@
}
else
@ -1133,9 +1133,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (fd < 0)
{
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/create.c tar-1.34-rhel-9.8-clean/src/create.c
--- tar-1.34-rhel-9.7/src/create.c 2025-12-11 15:55:21.936996399 +0100
+++ tar-1.34-rhel-9.8-clean/src/create.c 2025-12-11 15:39:02.399862469 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/create.c tar-1.34-rhel-9.8-clean/src/create.c
--- a/src/create.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/create.c 2026-01-12 16:32:28.674883043 +0100
@@ -1386,8 +1386,10 @@
{
if (! st.orig_file_name)
@ -1332,9 +1332,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
}
else if (S_ISSOCK (st->stat.st_mode))
{
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/exclist.c tar-1.34-rhel-9.8-clean/src/exclist.c
--- tar-1.34-rhel-9.7/src/exclist.c 2025-12-11 15:55:21.936996399 +0100
+++ tar-1.34-rhel-9.8-clean/src/exclist.c 2025-12-11 15:39:02.399862469 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/exclist.c tar-1.34-rhel-9.8-clean/src/exclist.c
--- a/src/exclist.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/exclist.c 2026-01-12 16:32:28.674883043 +0100
@@ -77,7 +77,7 @@
return;
for (file = excfile_head; file; file = file->next)
@ -1358,9 +1358,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if ((result = excluded_file_name (ep->excluded, rname)))
break;
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/extract.c tar-1.34-rhel-9.8-clean/src/extract.c
--- tar-1.34-rhel-9.7/src/extract.c 2025-12-11 15:55:21.936996399 +0100
+++ tar-1.34-rhel-9.8-clean/src/extract.c 2025-12-19 16:24:30.833719042 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/extract.c tar-1.34-rhel-9.8-clean/src/extract.c
--- a/src/extract.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/extract.c 2026-01-12 16:32:28.678883165 +0100
@@ -202,7 +202,8 @@
if (result == 0 || implemented (errno))
return result;
@ -1517,7 +1517,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (status == 0)
{
current_mode = mode & ~ current_umask;
@@ -1160,14 +1181,17 @@
@@ -1135,14 +1156,17 @@
}
}
@ -1537,7 +1537,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
&& S_ISLNK (st.st_mode))
{
errno = ELOOP;
@@ -1175,7 +1199,7 @@
@@ -1150,7 +1174,7 @@
}
}
@ -1546,7 +1546,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (0 <= fd)
{
if (overwriting_old_files)
@@ -1342,8 +1366,9 @@
@@ -1317,8 +1341,9 @@
if (!delayed_link_head)
return NULL;
@ -1558,7 +1558,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
{
if (errno != ENOENT)
stat_error (name);
@@ -1375,8 +1400,16 @@
@@ -1350,8 +1375,16 @@
int fd;
struct stat st;
@ -1576,7 +1576,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (errno == EEXIST && find_delayed_link_source (file_name))
{
/* The placeholder file has already been created. This means
@@ -1478,16 +1511,24 @@
@@ -1453,16 +1486,24 @@
do
{
@ -1606,7 +1606,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
for (; ds; ds = ds->next)
if (ds->change_dir == chdir_current
&& ds->dev == st1.st_dev
@@ -1504,15 +1545,15 @@
@@ -1479,15 +1520,15 @@
}
return 0;
}
@ -1630,7 +1630,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
errno = e;
}
while ((rc = maybe_recoverable (file_name, false, &interdir_made))
@@ -1539,7 +1580,10 @@
@@ -1514,7 +1555,10 @@
|| contains_dot_dot (current_stat_info.link_name)))
return create_placeholder_file (file_name, true, &interdir_made, NULL);
@ -1642,7 +1642,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
switch (maybe_recoverable (file_name, false, &interdir_made))
{
case RECOVER_OK:
@@ -1579,8 +1623,10 @@
@@ -1554,8 +1598,10 @@
mode_t mode = (current_stat_info.stat.st_mode & (MODE_RWX | S_IFBLK | S_IFCHR)
& ~ (0 < same_owner_option ? S_IRWXG | S_IRWXO : 0));
@ -1655,7 +1655,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
switch (maybe_recoverable (file_name, false, &interdir_made))
{
case RECOVER_OK:
@@ -1609,7 +1655,10 @@
@@ -1584,7 +1630,10 @@
mode_t mode = (current_stat_info.stat.st_mode & MODE_RWX
& ~ (0 < same_owner_option ? S_IRWXG | S_IRWXO : 0));
@ -1667,7 +1667,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
switch (maybe_recoverable (file_name, false, &interdir_made))
{
case RECOVER_OK:
@@ -1848,25 +1897,30 @@
@@ -1823,25 +1872,30 @@
/* Make sure the placeholder file is still there. If not,
don't create a link, as the placeholder was probably
removed by a later extraction. */
@ -1704,7 +1704,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
symlink_error (ds->target, source);
else
{
@@ -1929,9 +1983,14 @@
@@ -1904,9 +1958,14 @@
bool
rename_directory (char *src, char *dst)
{
@ -1722,7 +1722,7 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
{
int e = errno;
bool interdir_made;
@@ -1941,8 +2000,13 @@
@@ -1916,8 +1975,13 @@
case ENOENT:
if (make_directories (dst, &interdir_made) == 0)
{
@ -1738,9 +1738,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
e = errno;
}
break;
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/misc.c tar-1.34-rhel-9.8-clean/src/misc.c
--- tar-1.34-rhel-9.7/src/misc.c 2025-12-11 15:55:21.940996517 +0100
+++ tar-1.34-rhel-9.8-clean/src/misc.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/misc.c tar-1.34-rhel-9.8-clean/src/misc.c
--- a/src/misc.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/misc.c 2026-01-12 16:32:28.678883165 +0100
@@ -250,6 +250,30 @@
return name;
}
@ -2264,9 +2264,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (fd < 0)
{
if (!must_exist && errno == ENOENT)
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/names.c tar-1.34-rhel-9.8-clean/src/names.c
--- tar-1.34-rhel-9.7/src/names.c 2025-12-11 15:55:21.940996517 +0100
+++ tar-1.34-rhel-9.8-clean/src/names.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/names.c tar-1.34-rhel-9.8-clean/src/names.c
--- a/src/names.c 2026-01-12 16:26:50.616437210 +0100
+++ b/src/names.c 2026-01-12 16:32:28.678883165 +0100
@@ -1786,8 +1786,9 @@
}
if (S_ISDIR (st.stat.st_mode))
@ -2279,9 +2279,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (dir_fd < 0)
open_diag (name->name);
else
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/tar.c tar-1.34-rhel-9.8-clean/src/tar.c
--- tar-1.34-rhel-9.7/src/tar.c 2025-12-11 15:55:21.940996517 +0100
+++ tar-1.34-rhel-9.8-clean/src/tar.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/tar.c tar-1.34-rhel-9.8-clean/src/tar.c
--- a/src/tar.c 2026-01-12 16:26:50.620437336 +0100
+++ b/src/tar.c 2026-01-12 16:32:28.678883165 +0100
@@ -2597,16 +2597,29 @@
if (recursive_unlink_option)
old_files_option = UNLINK_FIRST_OLD_FILES;
@ -2321,9 +2321,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
}
fstatat_flags = dereference_option ? 0 : AT_SYMLINK_NOFOLLOW;
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/unlink.c tar-1.34-rhel-9.8-clean/src/unlink.c
--- tar-1.34-rhel-9.7/src/unlink.c 2025-12-11 15:55:21.940996517 +0100
+++ tar-1.34-rhel-9.8-clean/src/unlink.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/unlink.c tar-1.34-rhel-9.8-clean/src/unlink.c
--- a/src/unlink.c 2026-01-12 16:26:50.620437336 +0100
+++ b/src/unlink.c 2026-01-12 16:32:28.678883165 +0100
@@ -117,7 +117,10 @@
else
fname = p->file_name;
@ -2366,9 +2366,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
dunlink_reclaim (p);
dunlink_count--;
p = next;
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/update.c tar-1.34-rhel-9.8-clean/src/update.c
--- tar-1.34-rhel-9.7/src/update.c 2025-12-11 15:55:21.940996517 +0100
+++ tar-1.34-rhel-9.8-clean/src/update.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/update.c tar-1.34-rhel-9.8-clean/src/update.c
--- a/src/update.c 2026-01-12 16:26:50.620437336 +0100
+++ b/src/update.c 2026-01-12 16:32:28.678883165 +0100
@@ -47,8 +47,9 @@
static void
append_file (char *file_name)
@ -2380,9 +2380,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
if (handle < 0)
{
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/src/xattrs.c tar-1.34-rhel-9.8-clean/src/xattrs.c
--- tar-1.34-rhel-9.7/src/xattrs.c 2025-12-11 15:55:21.944996635 +0100
+++ tar-1.34-rhel-9.8-clean/src/xattrs.c 2025-12-11 15:39:02.403862591 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/src/xattrs.c tar-1.34-rhel-9.8-clean/src/xattrs.c
--- a/src/xattrs.c 2026-01-12 16:26:50.620437336 +0100
+++ b/src/xattrs.c 2026-01-12 16:32:28.682883287 +0100
@@ -219,7 +219,8 @@
/* No "default" IEEE 1003.1e ACL set for directory. At this moment,
FILE_NAME may already have inherited default acls from parent
@ -2444,9 +2444,9 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
sysname = "lsetfileconat";
}
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/extrac31.at tar-1.34-rhel-9.8-clean/tests/extrac31.at
--- tar-1.34-rhel-9.7/tests/extrac31.at 1970-01-01 01:00:00.000000000 +0100
+++ tar-1.34-rhel-9.8-clean/tests/extrac31.at 2025-12-11 15:39:02.407862711 +0100
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/extrac31.at tar-1.34-rhel-9.8-clean/tests/extrac31.at
--- a/tests/extrac31.at 1970-01-01 01:00:00.000000000 +0100
+++ b/tests/extrac31.at 2026-01-12 16:32:28.682883287 +0100
@@ -0,0 +1,55 @@
+# Test suite for GNU tar. -*- Autotest -*-
+# Copyright 2025 Free Software Foundation, Inc.
@ -2503,24 +2503,24 @@ diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnuli
+tar: Exiting with failure status due to previous errors
+])
+AT_CLEANUP
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/Makefile.am tar-1.34-rhel-9.8-clean/tests/Makefile.am
--- tar-1.34-rhel-9.7/tests/Makefile.am 2025-12-11 15:55:21.944996635 +0100
+++ tar-1.34-rhel-9.8-clean/tests/Makefile.am 2025-12-11 15:39:02.403862591 +0100
@@ -123,6 +123,7 @@
extrac22.at\
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/Makefile.am tar-1.34-rhel-9.8-clean/tests/Makefile.am
--- a/tests/Makefile.am 2026-01-12 16:26:50.620437336 +0100
+++ b/tests/Makefile.am 2026-01-12 16:32:28.682883287 +0100
@@ -124,6 +124,7 @@
extrac23.at\
extrac24.at\
extrac30.at\
+ extrac31.at\
filerem01.at\
filerem02.at\
dirrem01.at\
diff -x '*~' -x autom4te.cache -x gnulib -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x '*.in' -x configure -x .gitmodules --unidirectional-new-file -ur tar-1.34-rhel-9.7/tests/testsuite.at tar-1.34-rhel-9.8-clean/tests/testsuite.at
--- tar-1.34-rhel-9.7/tests/testsuite.at 2025-12-11 15:55:21.952996871 +0100
+++ tar-1.34-rhel-9.8-clean/tests/testsuite.at 2025-12-11 15:39:02.411862832 +0100
@@ -345,6 +345,7 @@
m4_include([extrac22.at])
diff -x '*~' -x autom4te.cache -x gnulib -x paxutils -x build-aux -x gnulib.modules -x gnulib-cache.m4 -x .git -x .gitmodules -x '*.in' -x configure --unidirectional-new-file -ur tar-1.34-rhel-9.8-5c151e96-clean/tests/testsuite.at tar-1.34-rhel-9.8-clean/tests/testsuite.at
--- a/tests/testsuite.at 2026-01-12 16:26:50.620437336 +0100
+++ b/tests/testsuite.at 2026-01-12 16:32:28.682883287 +0100
@@ -346,6 +346,7 @@
m4_include([extrac23.at])
m4_include([extrac24.at])
m4_include([extrac30.at])
+m4_include([extrac31.at])
m4_include([backup01.at])

184
tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch Normal file
View File

@ -0,0 +1,184 @@
From 5c151e963652f695557766c8123755a95ad8ab12 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Sat, 26 Jul 2025 21:41:23 -0700
Subject: [PATCH] --no-overwrite-dir no overwrite even temporarily
Problem and fix reported by Pavel Cahyna in
https://lists.gnu.org/r/bug-tar/2025-01/msg00000.html
* src/extract.c (extract_dir): With --no-overwrite-dir,
skip the chmod if the directory already exists.
* tests/extrac23.at (--no-overwrite-dir on empty directory):
Move the part of the test that looks at a nonempty directory ...
* tests/extrac30.at: ... to this new file, because the test now
must be run as non-root. Adjust the test to match the new behavior.
* tests/Makefile.am (TESTSUITE_AT), tests/testsuite.at: Add it.
(cherry picked from commit b5ecab839bdbce1757f466895f3eca956b931e23)
---
src/extract.c | 25 ------------------------
tests/Makefile.am | 1 +
tests/extrac23.at | 16 +---------------
tests/extrac30.at | 47 ++++++++++++++++++++++++++++++++++++++++++++++
tests/testsuite.at | 1 +
5 files changed, 50 insertions(+), 40 deletions(-)
create mode 100644 tests/extrac30.at
diff --git a/src/extract.c b/src/extract.c
index 80009a54..8bab30a2 100644
--- a/src/extract.c
+++ b/src/extract.c
@@ -1070,31 +1070,6 @@ extract_dir (char *file_name, int typeflag)
repair_delayed_set_stat (file_name, &st);
return 0;
}
- else if (old_files_option == NO_OVERWRITE_DIR_OLD_FILES)
- {
- /* Temporarily change the directory mode to a safe
- value, to be able to create files in it, should
- the need be.
- */
- mode = safe_dir_mode (&st);
- status = fd_chmod(-1, file_name, mode,
- AT_SYMLINK_NOFOLLOW, DIRTYPE);
- if (status == 0)
- {
- /* Store the actual directory mode, to be restored
- later.
- */
- current_stat_info.stat = st;
- current_mode = mode & ~ current_umask;
- current_mode_mask = MODE_RWX;
- atflag = AT_SYMLINK_NOFOLLOW;
- break;
- }
- else
- {
- chmod_error_details (file_name, mode);
- }
- }
break;
}
}
diff --git a/tests/Makefile.am b/tests/Makefile.am
index f01ca270..b3c503dc 100644
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -123,6 +123,7 @@ TESTSUITE_AT = \
extrac22.at\
extrac23.at\
extrac24.at\
+ extrac30.at\
filerem01.at\
filerem02.at\
dirrem01.at\
diff --git a/tests/extrac23.at b/tests/extrac23.at
index 84f97446..2adc2276 100644
--- a/tests/extrac23.at
+++ b/tests/extrac23.at
@@ -15,15 +15,12 @@
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
-AT_SETUP([--no-overwrite-dir])
+AT_SETUP([--no-overwrite-dir on empty directory])
AT_KEYWORDS([extract extrac23 no-overwrite-dir])
# Description: Implementation of the --no-overwrite-dir option was flawed in
# tar versions up to 1.32.90. This option is intended to preserve metadata
# of existing directories. In fact it worked only for non-empty directories.
-# Moreover, if the actual directory was owned by the user tar runs as and the
-# S_IWUSR bit was not set in its actual permissions, tar failed to create files
-# in it.
#
# Reported by: Michael Kaufmann <mail@michael-kaufmann.ch>
# References: <20200207112934.Horde.anXzYhAj2CHiwUrw5CuT0G-@webmail.michael-kaufmann.ch>,
@@ -38,21 +35,10 @@ chmod 777 dir
tar -xf a.tar --no-overwrite-dir
genfile --stat=mode.777 dir
-# Test if temprorary permissions are set correctly to allow the owner
-# to write to the directory.
-genfile --file dir/file
-tar cf a.tar dir
-rm dir/file
-chmod 400 dir
-tar -xf a.tar --no-overwrite-dir
-genfile --stat=mode.777 dir
-chmod 700 dir
find dir
],
[0],
[777
-400
dir
-dir/file
])
AT_CLEANUP
diff --git a/tests/extrac30.at b/tests/extrac30.at
new file mode 100644
index 00000000..8c879c95
--- /dev/null
+++ b/tests/extrac30.at
@@ -0,0 +1,47 @@
+# Test suite for GNU tar. -*- Autotest -*-
+# Copyright 2020-2025 Free Software Foundation, Inc.
+#
+# This file is part of GNU tar.
+#
+# GNU tar is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 3 of the License, or
+# (at your option) any later version.
+#
+# GNU tar is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
+AT_SETUP([--no-overwrite-dir on unwritable directory])
+AT_KEYWORDS([extract extrac30 no-overwrite-dir])
+
+# Make sure that tar does not change permissions on directories if
+# --no-overwrite-dir tells it not to, not even temporarily.
+
+AT_TAR_CHECK([
+AT_UNPRIVILEGED_PREREQ
+
+# Test that the user cannot write to a unwritable directory
+# if --no-overwrite-dir is used.
+mkdir dir
+chmod 755 dir
+genfile --file dir/file
+tar cf a.tar dir
+rm dir/file
+chmod 555 dir
+tar -xf a.tar --no-overwrite-dir
+genfile --stat=mode.777 dir
+chmod 755 dir
+find dir
+],
+[0],
+[555
+dir
+],
+[tar: dir/file: Cannot open: Permission denied
+tar: Exiting with failure status due to previous errors
+])
+AT_CLEANUP
diff --git a/tests/testsuite.at b/tests/testsuite.at
index 775e765a..b11ee50e 100644
--- a/tests/testsuite.at
+++ b/tests/testsuite.at
@@ -345,6 +345,7 @@ m4_include([extrac21.at])
m4_include([extrac22.at])
m4_include([extrac23.at])
m4_include([extrac24.at])
+m4_include([extrac30.at])
m4_include([backup01.at])
--
2.39.5

2
tar.spec
View File

@ -23,6 +23,8 @@ Patch11: tar-1.30-padding-zeros.patch
Patch12: tar-1.30-disk-read-error.patch
Patch13: tar-1.34-CVE-2022-48303.patch
Patch14: tar-1.34-Warn-file-changed-as-we-read-it-less-often.patch
# Source: https://cgit.git.savannah.gnu.org/cgit/tar.git/diff/?id=4e742fc8674064a9fa00d4483d06aca48d5b0463
Patch22: tar-1.34-no-overwrite-dir-no-overwrite-even-temporarily.patch
#tar commits from upstream
# 56fb4a96ca43c247261b8c04dd65592f990f98ac
# 7c241126f14975c7f5df4268b434f276fc7f8842