tar: segfault on copy fiiles from archive

[mc-butler]

Important

This issue was migrated from Trac:

Origin	https://midnight-commander.org/ticket/4561
Reporter	andrew_b (@aborodin)

Original bug report: https://bugzilla.altlinux.org/50857

The simplest archive that bug is reproduced with is attached.

How to reproduce:

1. Enter to the test.tar.
2. Copy the top test directory with F5.

Note

Original attachments:

• test.tar (raw) by andrew_b (@aborodin) on Jul 12, 2024 at 17:18 UTC
• longdir-test.tar.l.zip (raw) by zaytsev (@zyv) on Jul 18, 2024 at 5:55 UTC

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 12, 2024 at 17:18 UTC

• Attachment test.tar (raw) added

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 12, 2024 at 17:36 UTC (comment 1)

• Status changed from new to accepted
• Branch state changed from no branch to on review
• Owner set to andrew_b
• Milestone changed from Future Releases to 4.8.32

Branch: 4561_tar_segfault
[a9a1451fd488ab9ffb50f2d55f42f80dd7e70a8b]

The cause of segfault is endless recursive call of do_compute_dir_size() because of incorrect handling of very long file/directory name. As a result the structure of opened tar archive may contain a directory with an empty name.

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 13, 2024 at 5:30 UTC (comment 2)

• Summary changed from tar: segault on copy fiiles from archive to tar: segfault on copy fiiles from archive

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 13, 2024 at 5:32 UTC (comment 3)

TODO before merge: fix commit message: s/segault/segfault

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 15, 2024 at 18:37 UTC (comment 4)

• Branch state changed from on review to approved
• Votes set to andrew_b

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 15, 2024 at 18:43 UTC (comment 5)

• Branch state changed from approved to merged
• Resolution set to fixed
• Status changed from accepted to testing
• Votes changed from andrew_b to committed-master

Merged to master: [9f4e88f].

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 15, 2024 at 18:48 UTC (comment 6)

• Status changed from testing to closed

Typos was not fixed :-((

[mc-butler]

Changed by andrew_b (@aborodin) on Jul 15, 2024 at 18:48 UTC (comment 7)

• Priority changed from trivial to major

[mc-butler]

Changed by cieply (worker@….pl) on Jul 16, 2024 at 20:23 UTC (comment 8)

Can confirm it doesn't crash any more. There is a caveat though. Path length is 253 bytes and file name 248 bytes which is below 255 max file length for ext3/4 and 4096 max path but it still says:

Cannot create target directory "/tmp/test/~xxxxxxxxxxxxxx" 
                    File name too long (36)                     

It's not too long actually.

Archive listing

---

Also, for sake of simplicity, the tar file used as example should be compressed. It wouldn't change the outcome but would decrease attachment 40 times.

[mc-butler]

Changed by zaytsev (@zyv) on Jul 18, 2024 at 5:55 UTC

• Attachment longdir-test.tar.l.zip (raw) added