Commit f7143c17 authored by Timo Teräs's avatar Timo Teräs

io_archive: add bounds limit for uname and gname tar header fields

Modify apk_resolve_[ug]id to take the user/groupname as a blob, so
proper length checking is done and honored.

==31584== Conditional jump or move depends on uninitialised value(s)
==31584==    at 0x5C8CA5: strlen (strlen.c:17)
==31584==    by 0x432575: APK_BLOB_STR (apk_blob.h:79)
==31584==    by 0x4350EB: apk_resolve_uid (io.c:1112)
==31584==    by 0x43696C: apk_tar_parse (io_archive.c:152)
==31584==    by 0x4271BC: apk_pkg_read (package.c:929)
==31584==    by 0x402D75: add_main (app_add.c:163)
==31584==    by 0x40D5FF: main (apk-static.c:516)

Fixes a potential crash (DoS) on a crafted TAR file. CVE-2021-30139.
Reported-by: Sören Tempel's avatarSören Tempel <soeren+git@soeren-tempel.net>
Reviewed-by: Ariadne Conill's avatarAriadne Conill <ariadne@dereferenced.org>
parent 4bcd7921
Pipeline #78666 passed with stage
in 1 minute and 42 seconds