From mboxrd@z Thu Jan  1 00:00:00 1970
Content-Type: multipart/mixed; boundary="===============7811056458543318428=="
MIME-Version: 1.0
From: Alexander Cherepanov <cherepan@mccme.ru>
To: elfutils-devel@lists.fedorahosted.org
Subject: Directory traversal in `ar`
Date: Sun, 28 Dec 2014 02:46:15 +0300
Message-ID: <549F44C7.50506@mccme.ru>

--===============7811056458543318428==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable

Hi!

There is a directory traversal in `ar`:

# printf '!<arch>\n%-48s%-10s`\n//file/\n%-48s%-10s`\n' // 8 /1 0 > test.a
# ar -xv test.a
x - /file

Patch attached.

-- =

Alexander Cherepanov

--===============7811056458543318428==
Content-Type: text/x-patch
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="fix-dir-traversal-in-ar.patch"

ZGlmZiAtLWdpdCBhL2xpYmVsZi9lbGZfYmVnaW4uYyBiL2xpYmVsZi9lbGZfYmVnaW4uYwppbmRl
eCA5NDdiMGVkLi5hZTFlNzEyIDEwMDY0NAotLS0gYS9saWJlbGYvZWxmX2JlZ2luLmMKKysrIGIv
bGliZWxmL2VsZl9iZWdpbi5jCkBAIC03NDksMTAgKzc0OSw3IEBAIHJlYWRfbG9uZ19uYW1lcyAo
RWxmICplbGYpCiAJICAgIH0KIAogCSAgLyogTlVMLXRlcm1pbmF0ZSB0aGUgc3RyaW5nLiAgKi8K
LQkgICpydW5wID0gJ1wwJzsKLQotCSAgLyogU2tpcCB0aGUgTlVMIGJ5dGUgYW5kIHRoZSBcMDEy
LiAgKi8KLQkgIHJ1bnAgKz0gMjsKKwkgICpydW5wKysgPSAnXDAnOwogCiAJICAvKiBBIHNhbml0
eSBjaGVjay4gIFNvbWVib2R5IG1pZ2h0IGhhdmUgZ2VuZXJhdGVkIGludmFsaWQKIAkgICAgIGFy
Y2hpdmUuICAqLwo=

--===============7811056458543318428==--