[Bug-tar] possible out of bounds access on grandchild error

[Tobias Stoeckmann]

Hi,

the function run_decompress_program in system.c is prone to trigger
an out of bounds access in next_decompress_program due to uninitialized
value "i".

If tar is called with a specific decompressor, like "tar -xz", the
function first_decompress_program will return a fixed value.  In this
case it would be "gzip".  If the execution of gzip fails or gzip is
not found, next_decompress_program will be called.  Yet "i" has never
been initialized and an array out of bounds access happens in that
function.

Fix would be to always set the pstate in first_decompress_program,
which in turn would initialize "i" to 0 -- always.


Tobias

--- tar-1.28/src/buffer.c~      Wed Oct  1 21:52:45 2014
+++ tar-1.28/src/buffer.c       Wed Oct  1 21:53:05 2014
@@ -339,13 +339,14 @@
 {
   struct zip_program const *zp;
 
+  *pstate = 0;
+
   if (use_compress_program_option)
     return use_compress_program_option;
 
   if (archive_compression_type == ct_none)
     return NULL;
 
-  *pstate = 0;
   zp = find_zip_program (archive_compression_type, pstate);
   return zp ? zp->program : NULL;
 }