Commit message: tar: fix crash on broken tar file.
CVE: CVE-2016-9888
CWE: CWE-476
Vulnerability description: An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file.

Project: libgsf

GSF_CLASS (GsfInfileTar, gsf_infile_tar,
	   gsf_infile_tar_class_init, gsf_infile_tar_init,
	   GSF_INFILE_TYPE)

/**
 * gsf_infile_tar_new:
 * @source: A base #GsfInput
 * @err: A #GError, optionally %NULL
 *
 * Opens the root directory of a Tar file.
 * <note>This adds a reference to @source.</note>
 *
 * Returns: the new tar file handler
 **/
GsfInfile *
gsf_infile_tar_new (GsfInput *source, GError **err)
{
	GsfInfileTar *tar;

	g_return_val_if_fail (GSF_IS_INPUT (source), NULL);

	tar = g_object_new (GSF_INFILE_TAR_TYPE,
			    "source", source,
			    NULL);

	if (tar->err) {
		if (err)
			*err = g_error_copy (tar->err);
		g_object_unref (tar);
		return NULL;
	}

	return GSF_INFILE (tar);
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_child_by_index (GsfInfile *infile, int target, GError **err)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (infile);
	const TarChild *c;

	if (err)
		*err = NULL;

	if (target < 0 || (unsigned)target >= tar->children->len)
		return NULL;

	c = &g_array_index (tar->children, TarChild, target);
	if (c->dir)
		return g_object_ref (c->dir);
	else {
		GsfInput *input = gsf_input_proxy_new_section (tar->source,
							       c->offset,
							       c->length);
		gsf_input_set_modtime (input, c->modtime);
		gsf_input_set_name (input, c->name);
		return input;
	}
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_child_by_name (GsfInfile *infile, char const *name, GError **err)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (infile);
	unsigned ui;

	for (ui = 0; ui < tar->children->len; ui++) {
		const TarChild *c = &g_array_index (tar->children,
						    TarChild,
						    ui);
		if (strcmp (name, c->name) == 0)
			return gsf_infile_tar_child_by_index (infile, ui, err);
	}

	return NULL;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_class_init (GObjectClass *gobject_class)
{
	GsfInputClass  *input_class  = GSF_INPUT_CLASS (gobject_class);
	GsfInfileClass *infile_class = GSF_INFILE_CLASS (gobject_class);

	gobject_class->constructor      = gsf_infile_tar_constructor;
	gobject_class->finalize		= gsf_infile_tar_finalize;
	gobject_class->dispose		= gsf_infile_tar_dispose;
	gobject_class->get_property     = gsf_infile_tar_get_property;
	gobject_class->set_property     = gsf_infile_tar_set_property;

	input_class->Dup		= gsf_infile_tar_dup;
	input_class->Read		= gsf_infile_tar_read;
	input_class->Seek		= gsf_infile_tar_seek;
	infile_class->num_children	= gsf_infile_tar_num_children;
	infile_class->name_by_index	= gsf_infile_tar_name_by_index;
	infile_class->child_by_index	= gsf_infile_tar_child_by_index;
	infile_class->child_by_name	= gsf_infile_tar_child_by_name;

	parent_class = g_type_class_peek_parent (gobject_class);

	g_object_class_install_property
		(gobject_class,
		 PROP_SOURCE,
		 g_param_spec_object ("source",
				      _("Source"),
				      _("The archive being interpreted"),
				      GSF_INPUT_TYPE,
				      GSF_PARAM_STATIC |
				      G_PARAM_READWRITE |
				      G_PARAM_CONSTRUCT_ONLY));
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_dispose (GObject *obj)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (obj);
	unsigned ui;

	gsf_infile_tar_set_source (tar, NULL);
	g_clear_error (&tar->err);

	for (ui = 0; ui < tar->children->len; ui++) {
		TarChild *c = &g_array_index (tar->children, TarChild, ui);
		g_free (c->name);
		if (c->modtime)
			g_date_time_unref (c->modtime);
		if (c->dir)
			g_object_unref (c->dir);
	}
	g_array_set_size (tar->children, 0);

	parent_class->dispose (obj);
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_dup (GsfInput *src_input, GError **err)
{
	GsfInfileTar *res, *src;
	unsigned ui;

	src = GSF_INFILE_TAR (src_input);
	if (src->err) {
		if (err)
			*err = g_error_copy (src->err);
		return NULL;
	}

	res = (GsfInfileTar *)g_object_new (GSF_INFILE_TAR_TYPE, NULL);
	gsf_infile_tar_set_source (res, src->source);

	for (ui = 0; ui < src->children->len; ui++) {
		/* This copies the structure.  */
		TarChild c = g_array_index (src->children, TarChild, ui);
		c.name = g_strdup (c.name);
		if (c.modtime) g_date_time_ref (c.modtime);
		if (c.dir) g_object_ref (c.dir);
		g_array_append_val (res->children, c);
	}

	return NULL;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_finalize (GObject *obj)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (obj);
	g_array_free (tar->children, TRUE);
	parent_class->finalize (obj);
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_name_by_index (GsfInfile *infile, int target)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (infile);

	if (target < 0 || (unsigned)target >= tar->children->len)
		return NULL;

	return g_array_index (tar->children, TarChild, target).name;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_num_children (GsfInfile *infile)
{
	GsfInfileTar *tar = GSF_INFILE_TAR (infile);

	return tar->children->len;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_read (GsfInput *input, size_t num_bytes, guint8 *buffer)
{
	(void)input;
	(void)num_bytes;
	(void)buffer;
	return NULL;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_seek (GsfInput *input, gsf_off_t offset, GSeekType whence)
{
	(void)input;
	(void)offset;
	(void)whence;
	return FALSE;
}

Project: libgsf
File: gsf-infile-tar.c

gsf_infile_tar_set_source (GsfInfileTar *tar, GsfInput *src)
{
	if (src)
		src = gsf_input_proxy_new (src);
	if (tar->source)
		g_object_unref (tar->source);
	tar->source = src;
}

Project: libgsf
File: gsf-infile-tar.c

tar_create_dir (GsfInfileTar *dir, const char *name)
{
	TarChild c;

	c.offset = 0;
	c.length = 0;
	c.name = g_strdup (name);
	c.modtime = NULL;
	c.dir = g_object_new (GSF_INFILE_TAR_TYPE, NULL);

	/*
	 * We set the source here, so gsf_infile_tar_constructor doesn't
	 * start reading the tarfile recursively.
	 */
	gsf_infile_tar_set_source (c.dir, dir->source);

	gsf_input_set_name (GSF_INPUT (c.dir), name);

	g_array_append_val (dir->children, c);

	return c.dir;
}

Project: libgsf
File: gsf-infile-tar.c

tar_init_info (GsfInfileTar *tar)
{
	TarHeader end;
	const TarHeader *header;
	gsf_off_t pos0 = gsf_input_tell (tar->source);
	char *pending_longname = NULL;

	memset (&end, 0, sizeof (end));

	while (tar->err == NULL &&
	       (header = (const TarHeader *)gsf_input_read (tar->source,
							    HEADER_SIZE,
							    NULL))) {
		char *name;
		gsf_off_t length;
		gsf_off_t offset;
		gint64 mtime;

		if (memcmp (header->filler, end.filler, sizeof (end.filler))) {
			tar->err = g_error_new (gsf_input_error_id (), 0,
						_("Invalid tar header"));
			break;
		}

		if (memcmp (header, &end, HEADER_SIZE) == 0)
			break;

		if (pending_longname) {
			name = pending_longname;
			pending_longname = NULL;
		} else
			name = g_strndup (header->name, sizeof (header->name));
		length = unpack_octal (tar, header->size, sizeof (header->size));
		offset = gsf_input_tell (tar->source);

		mtime = unpack_octal (tar, header->mtime, sizeof (header->mtime));

		switch (header->typeflag) {
		case '0': case 0: {
			/* Regular file. */
			GsfInfileTar *dir;
			const char *n = name, *s;
			TarChild c;

			/* This is deliberately slash-only.  */
			while ((s = strchr (n, '/')))
				n = s + 1;
			c.name = g_strdup (n);
			c.modtime = mtime > 0
				? g_date_time_new_from_unix_utc (mtime)
				: NULL;
			c.offset = offset;
			c.length = length;
			c.dir = NULL;
			dir = tar_directory_for_file (tar, name, FALSE);
			g_array_append_val (dir->children, c);
			break;
		}
		case '5': {
			/* Directory */
			(void)tar_directory_for_file (tar, name, TRUE);
			break;
		}
		case 'L': {
			const char *n;

			if (pending_longname ||
			    strcmp (name, MAGIC_LONGNAME) != 0) {
				tar->err = g_error_new (gsf_input_error_id (), 0,
							_("Invalid longname header"));
				break;
			}

			n = gsf_input_read (tar->source, length, NULL);
			if (!n) {
				tar->err = g_error_new (gsf_input_error_id (), 0,
							_("Failed to read longname"));
				break;
			}

			pending_longname = g_strndup (n, length);
			break;
		}
		default:
			/* Other -- ignore */
			break;
		}

		g_free (name);

		/* Round up to block size */
		length = (length + (BLOCK_SIZE - 1)) / BLOCK_SIZE * BLOCK_SIZE;

		if (!tar->err &&
		    gsf_input_seek (tar->source, offset + length, G_SEEK_SET)) {
			tar->err = g_error_new (gsf_input_error_id (), 0,
						_("Seek failed"));
			break;
		}
	}

	if (pending_longname) {
		if (!tar->err)
			tar->err = g_error_new (gsf_input_error_id (), 0,
						_("Truncated archive"));
		g_free (pending_longname);
	}

	if (tar->err)
		gsf_input_seek (tar->source, pos0, G_SEEK_SET);
}

Project: libgsf
File: gsf-infile-tar.c

unpack_octal (GsfInfileTar *tar, const char *s, size_t len)
{
	guint64 res = 0;

	/*
	 * Different specifications differ on what terminating characters
	 * are allowed.  It doesn't hurt for us to allow both space and
	 * NUL.
	 */
	if (len == 0 || (s[len - 1] != 0 && s[len - 1] != ' '))
		goto invalid;
	len--;

	while (len--) {
		unsigned char c = *s++;
		if (c < '0' || c > '7')
			goto invalid;
		res = (res << 3) | (c - '0');
	}

	return (gint64)res;

invalid:
	tar->err = g_error_new (gsf_input_error_id (), 0,
				_("Invalid tar header"));
	return 0;
}