|
| 1 | +From 6636f89f5fe08a20de3b2d034712c781d3a67985 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Peter Kaestle <peter@piie.net> |
| 3 | +Date: Wed, 5 Mar 2025 15:01:14 +0100 |
| 4 | +Subject: [PATCH] tar/util.c: fix NULL pointer dereference issue on strftime |
| 5 | + |
| 6 | +Fix CVE-2025-25724 by detecting NULL return of localtime_r(&tim, &tmbuf), |
| 7 | +which could happen in case tim is incredible big. |
| 8 | + |
| 9 | +In case this error is triggered, put an "INVALID DATE" string into the |
| 10 | +outbuf. |
| 11 | + |
| 12 | +Error poc: https://github.com/Ekkosun/pocs/blob/main/bsdtarbug |
| 13 | + |
| 14 | +Upstream Reference : https://github.com/libarchive/libarchive/pull/2532/commits/6636f89f5fe08a20de3b2d034712c781d3a67985 |
| 15 | + |
| 16 | +Signed-off-by: Peter Kaestle <peter@piie.net> |
| 17 | +--- |
| 18 | + tar/util.c | 5 ++++- |
| 19 | + 1 file changed, 4 insertions(+), 1 deletion(-) |
| 20 | + |
| 21 | +diff --git a/tar/util.c b/tar/util.c |
| 22 | +index 3b099cb5f..f3cbdf0bb 100644 |
| 23 | +--- a/tar/util.c |
| 24 | ++++ b/tar/util.c |
| 25 | +@@ -749,7 +749,10 @@ list_item_verbose(struct bsdtar *bsdtar, FILE *out, struct archive_entry *entry) |
| 26 | + #else |
| 27 | + ltime = localtime(&tim); |
| 28 | + #endif |
| 29 | +- strftime(tmp, sizeof(tmp), fmt, ltime); |
| 30 | ++ if (ltime) |
| 31 | ++ strftime(tmp, sizeof(tmp), fmt, ltime); |
| 32 | ++ else |
| 33 | ++ sprintf(tmp, "-- -- ----"); |
| 34 | + fprintf(out, " %s ", tmp); |
| 35 | + safe_fprintf(out, "%s", archive_entry_pathname(entry)); |
| 36 | + |
0 commit comments