libtar: patch CVEs

cve-check.bbclass reported unpatched vulnerabilities in libtar
[1,2,3,4,5]. The NIST assigned base score for the worst vulnerability
is 9.1 / critical.

The patches were taken from the libtar [6] master branch after the
latest tag v1.2.20 (the changes in libtar master mostly originate from
Fedora and their patches), and from the Fedora 41 libtar source package
[7] and the Debian libtar package 1.2.20-8 [8] where the patches were
not available in the libtar repository itself.

The Fedora patch series was taken in its entirety in order to minimize
differences to Fedora's source tree instead of cherry-picking only CVE
fixes. Minimizing the differences should avoid issues with potential
inter-dependencies between the patches, and hopefully provide better
confidence as even the newest patches have been in use in Fedora for
nearly 2 years (since December 2022; Fedora rpms/libtar.git commit
e25b692fc7ceaa387dafb865b472510754f51bd2). The series includes even the
Fedora patch libtar-1.2.20-no-static-buffer.patch, which contains
changes *) that match the libtar commit
ec613af2e9371d7a3e1f7c7a6822164a4255b4d1 ("decode: avoid using a static
buffer in th_get_pathname()") whose commit message says

    Note this can break programs that expect sizeof(TAR) to be fixed.

The patches applied cleanly except for the Fedora srpm patch
libtar-1.2.11-bz729009.patch, which is identical with the pre-existing
meta-oe patch 0002-Do-not-strip-libtar.patch and is thus omitted.

The meta-openembedded recipe does not include any of the patches in
Kirkstone [9] nor the current master [10].

libtar does not have newer releases, and the libtar master doesn't
contain all of the changes included in the patches. Fedora's
libtar.1.2.11-*.patch are not included in the libtar v1.2.20 release
either but only in the master branch after the tag v1.2.20. The version
number in the filename is supposedly due to the patches being created
originally against v1.2.11 but have been upstreamed or at least
committed to the master only after v1.2.20.

The commit metadata could not be practically completed in most of the
cases due to missing commit messages in the original commits and
patches. The informal note about the author ("Authored by") was added to
the patch commit messages where the commit message was missing the
original author(s)' Signed-off-by.

*) The patch also contains the changes split to the libtar commits
    495d0c0eabc5648186e7d58ad54b508d14af38f4 ("Check for NULL before
    freeing th_pathname") and 20aa09bd7775094a2beb0f136c2c7d9e9fd6c7e6
    ("Added stdlib.h for malloc() in lib/decode.c"))

[1] https://nvd.nist.gov/vuln/detail/CVE-2021-33643
[2] https://nvd.nist.gov/vuln/detail/CVE-2021-33644
[3] https://nvd.nist.gov/vuln/detail/CVE-2021-33645
[4] https://nvd.nist.gov/vuln/detail/CVE-2021-33646
[5] https://nvd.nist.gov/vuln/detail/CVE-2013-4420
[6] https://repo.or.cz/libtar.git
[7] https://src.fedoraproject.org/rpms/libtar/tree/f41
[8] https://sources.debian.org/patches/libtar/1.2.20-8/CVE-2013-4420.patch/
[9] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=kirkstone&id=9a24b7679810628b594cc5a9b52f77f53d37004f
[10] https://git.openembedded.org/meta-openembedded/tree/meta-oe/recipes-support/libtar/libtar_1.2.20.bb?h=master&id=9356340655b3a4f87f98be88f2d167bb2514a54c

Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>

1 files changed, 89 insertions, 0 deletions

diff --git a/meta-oe/recipes-support/libtar/files/0008-decode-avoid-using-a-static-buffer-in-th_get_pathnam.patch b/meta-oe/recipes-support/libtar/files/0008-decode-avoid-using-a-static-buffer-in-th_get_pathnam.patch
new file mode 100644
index 0000000000..beba45405e
--- /dev/null
+++ b/meta-oe/recipes-support/libtar/files/0008-decode-avoid-using-a-static-buffer-in-th_get_pathnam.patch
@@ -0,0 +1,89 @@
+From edbee9832475347183a841a8fd5be71f74e10392 Mon Sep 17 00:00:00 2001
+From: Kamil Dudka <kdudka@redhat.com>
+Date: Wed, 23 Oct 2013 15:04:22 +0200
+Subject: [PATCH] decode: avoid using a static buffer in th_get_pathname()
+
+A solution suggested by Chris Frey:
+https://lists.feep.net:8080/pipermail/libtar/2013-October/000377.html
+
+Note this can break programs that expect sizeof(TAR) to be fixed.
+
+Authored by Kamil Dudka <kdudka@redhat.com>.
+
+Upstream-Status: Backport [https://repo.or.cz/libtar.git/commit/ec613af2e9371d7a3e1f7c7a6822164a4255b4d1]
+
+Signed-off-by: Katariina Lounento <katariina.lounento@vaisala.com>
+---
+ lib/decode.c | 24 +++++++++++++++++-------
+ lib/handle.c |  1 +
+ lib/libtar.h |  3 +++
+ 3 files changed, 21 insertions(+), 7 deletions(-)
+
+diff --git a/lib/decode.c b/lib/decode.c
+index c16ea2d..edb2185 100644
+--- a/lib/decode.c
++++ b/lib/decode.c
+@@ -26,20 +26,30 @@
+ char *
+ th_get_pathname(TAR *t)
+ {
+-       static TLS_THREAD char filename[MAXPATHLEN];
+-
+        if (t->th_buf.gnu_longname)
+                return t->th_buf.gnu_longname;
+ 
+-       if (t->th_buf.prefix[0] != '\0')
++       /* allocate the th_pathname buffer if not already */
++       if (t->th_pathname == NULL)
++       {
++               t->th_pathname = malloc(MAXPATHLEN * sizeof(char));
++               if (t->th_pathname == NULL)
++                       /* out of memory */
++                       return NULL;
++       }
++
++       if (t->th_buf.prefix[0] == '\0')
++       {
++               snprintf(t->th_pathname, MAXPATHLEN, "%.100s", t->th_buf.name);
++       }
++       else
+        {
+-               snprintf(filename, sizeof(filename), "%.155s/%.100s",
++               snprintf(t->th_pathname, MAXPATHLEN, "%.155s/%.100s",
+                         t->th_buf.prefix, t->th_buf.name);
+-               return filename;
+        }
+ 
+-       snprintf(filename, sizeof(filename), "%.100s", t->th_buf.name);
+-       return filename;
++       /* will be deallocated in tar_close() */
++       return t->th_pathname;
+ }
+ 
+ 
+diff --git a/lib/handle.c b/lib/handle.c
+index 002d23c..a19c046 100644
+--- a/lib/handle.c
++++ b/lib/handle.c
+@@ -122,6 +122,7 @@ tar_close(TAR *t)
+                libtar_hash_free(t->h, ((t->oflags & O_ACCMODE) == O_RDONLY
+                                        ? free
+                                        : (libtar_freefunc_t)tar_dev_free));
++       free(t->th_pathname);
+        free(t);
+ 
+        return i;
+diff --git a/lib/libtar.h b/lib/libtar.h
+index 7fc4d03..08a8e0f 100644
+--- a/lib/libtar.h
++++ b/lib/libtar.h
+@@ -85,6 +85,9 @@ typedef struct
+        int options;
+        struct tar_header th_buf;
+        libtar_hash_t *h;
++
++       /* introduced in libtar 1.2.21 */
++       char *th_pathname;
+ }
+ TAR;
+