tar 1.13.21 dumps core, allocation error found.

[Jan D.]

Hello.

Running:

% gcc --version
3.0.1
% uname -sr
Linux 2.4.9
% /lib/libc.so.6
GNU C Library stable release version 2.2.4, by Roland McGrath et al.
...
% LANG=C tar --version
tar (GNU tar) 1.13.21
...

Extracting koffice-1.1.tar (available from the KDE site) gives a
repeatable core dump at the same place in the archive, if the
extracted directory is removed before each extraction attempt.

In extract.c there is a allocation done for a filename and then the
filename is strcpy:ed.  But space for terminating '\0' is not taken
into account, leading to memory corruption.

Here is a patch:

Index: src/extract.c
--- src/extract.c.orig  Wed Aug 29 21:48:57 2001
+++ src/extract.c       Wed Aug 29 22:07:35 2001
@@ -281,7 +281,7 @@
 {
   size_t file_name_len = strlen (file_name);
   struct delayed_set_stat *data =
-    xmalloc (offsetof (struct delayed_set_stat, file_name) + file_name_len);
+    xmalloc (offsetof (struct delayed_set_stat, file_name) + file_name_len +1);
   data->file_name_len = file_name_len;
   strcpy (data->file_name, file_name);
   data->invert_permissions = invert_permissions;

        Jan D.