Fix for CVE-2022-48303

Resolves: #2149724

tar-1.30-CVE-2022-48303.patch

@@ -0,0 +1,30 @@
+From 3da78400eafcccb97e2f2fd4b227ea40d794ede8 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 11 Feb 2023 11:57:39 +0200
+Subject: [PATCH] Fix boundary checking in base-256 decoder
+
+* src/list.c (from_header): Base-256 encoding is at least 2 bytes
+long.
+---
+ src/list.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc425..86bcfdd1 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -881,8 +881,9 @@ from_header (char const *where0, size_t digs, char const *type,
+ 	  where++;
+ 	}
+     }
+-  else if (*where == '\200' /* positive base-256 */
+-	   || *where == '\377' /* negative base-256 */)
++  else if (where <= lim - 2
++	   && (*where == '\200' /* positive base-256 */
++	       || *where == '\377' /* negative base-256 */))
+     {
+       /* Parse base-256 output.  A nonnegative number N is
+ 	 represented as (256**DIGS)/2 + N; a negative number -N is
+-- 
+2.38.1
+

tar.spec

@@ -10,7 +10,7 @@ Summary: GNU file archiving program
 Name: tar
 Epoch: 2
 Version: 1.34
-Release: 7%{?dist}
+Release: 8%{?dist}
 License: GPLv3+
 URL: https://www.gnu.org/software/tar/
 
@@ -25,6 +25,7 @@ Patch4:  tar-1.28-atime-rofs.patch
 Patch9:  tar-1.28-document-exclude-mistakes.patch
 Patch10: tar-1.33-fix-capabilities-test.patch
 Patch11: tar-configure-c99.patch
+Patch12: tar-1.30-CVE-2022-48303.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -123,6 +124,9 @@ make check || (
 
 
 %changelog
+* Wed Mar 01 2023 Lukas Javorsky <ljavorsk@redhat.com> - 2:1.34-8
+- Resolve CVE-2022-48303
+
 * Thu Feb 02 2023 Arjun Shankar <arjun@redhat.com> - 2:1.34-7
 - Port configure script to C99