Thanks to Krzysztof Kotlenga <pocek@users.sf.net>:

 Frans Meulenbroeks wrote:

> Anyway, appending the 0 byte is no good as tar_entry->name[100] is
> already out of bounds.

http://tiny.cc/964UD looks good enough. It's interesting that we have
to trace bugs already fixed upstream years ago.

http://lists.linuxtogo.org/pipermail/openembedded-devel/2009-March/008510.html

git-svn-id: http://opkg.googlecode.com/svn/trunk@203 e8e0d7a0-c8d9-11dd-a880-a1081c7ac358

diff --git a/libbb/unarchive.c b/libbb/unarchive.c
index 24877e75452785aa426efc91a4f1ca26de987dd2..84a3b6a694fe0b73efc2b281908f5854bd943820 100644 (file)
--- a/libbb/unarchive.c
+++ b/libbb/unarchive.c
@@ -600,15 +600,15 @@ file_header_t *get_header_tar(FILE *tar_stream)
                 linkname = NULL;
         } else
 #endif
-        if (tar.formated.prefix[0] == 0) {
-                tar_entry->name = strdup(tar.formated.name);
-        } else {                                              
-                tar_entry->name = concat_path_file(tar.formated.prefix, tar.formated.name);
-        }
+        {
+                tar_entry->name = xstrndup(tar.formated.name, 100);
 
-       if (strlen(tar_entry->name) > 100) {
-               tar_entry->name[100] = 0;
-       }
+                if (tar.formated.prefix[0]) {
+                        char *temp = tar_entry->name;
+                        tar_entry->name = concat_path_file(tar.formated.prefix, temp);
+                        free(temp);
+                }
+        }
 
        // tar_entry->name = xstrdup(tar.formated.name);