1
0
mirror of https://git.FreeBSD.org/src.git synced 2024-11-21 07:15:49 +00:00

pax: Terminate loop for empty directory names

Pax can sometimes loop forever. For example:

$ mkdir -p /tmp/src/foo/bar
$ rm -rf /tmp/dst ; mkdir -p /tmp/dst
$ cd /tmp/src
$ echo 'foo/bar/' | /bin/pax -r -w -d -pe "/tmp/dst"
<looping infinitely>

Here, pax(1) infinitely deletes and re-creates /tmp/dst/foo/bar/.

The problem is that chk_path() (bin/pax/file_subs.c), called from
node_creat() also creates the leaf directory when a trailing '/' appears
in the directory name to create. When the execution goes back from
chk_path() to node_creat(), the function still cannot create the leaf
directory (it has been created by chk_path()), so it unlinks it and
calls node_creat() again. The function re-creates it, and so on...

In node_creat() detect trailing slashes and not create a leaf directory,
but only intermediate ones.

PR: 277060
Reviewed by: imp
This commit is contained in:
Ganael Laplanche 2024-06-21 10:39:09 -06:00 committed by Warner Losh
parent 5a969a3459
commit 681fd2bed8

View File

@ -555,7 +555,12 @@ chk_path( char *name, uid_t st_uid, gid_t st_gid)
* work forward from the first / and check each part of the path
*/
spt = strchr(spt, '/');
if (spt == NULL)
/*
* skip creating a leaf dir (with an ending '/') as we only want
* to create parents here
*/
if ((spt == NULL) || (*(spt + 1) == '\0'))
break;
*spt = '\0';