Re: [Bug-tar] Another tarbomb RFC

[Connor Behan]

On 29/10/13 01:09 PM, Connor Behan wrote:
> Hello. Since the GNU tar 1.27 release, I have updated my patch for
> limiting the top-level names extracted to one:
> http://lists.gnu.org/archive/html/bug-tar/2013-10/msg00003.html
>
> Do you think there are any remaining problems with it? I have read it
> over again a few times and the only not-so-pleasing thing I have noticed
> is that first_top_level is never free'd. However, I think this is okay
> because it needs to be stored until the last file is extracted and
> execution ends after that anyway.
>
When another release comes out, I will have to rebase my patch and send
it again. I don't mind doing this but can you please take a look? There
are other patches I want to write eventually but it is discouraging that
responses are few and far between.

signature.asc
Description: OpenPGP digital signature