Directory traversal in `ar`

Alexander Cherepanov cherepan at mccme.ru
Sat Dec 27 23:46:15 UTC 2014


Hi!

There is a directory traversal in `ar`:

# printf '!<arch>\n%-48s%-10s`\n//file/\n%-48s%-10s`\n' // 8 /1 0 > test.a
# ar -xv test.a
x - /file

Patch attached.

-- 
Alexander Cherepanov
-------------- next part --------------
A non-text attachment was scrubbed...
Name: fix-dir-traversal-in-ar.patch
Type: text/x-patch
Size: 410 bytes
Desc: not available
URL: <https://lists.fedorahosted.org/pipermail/elfutils-devel/attachments/20141228/819d38ee/attachment.bin>


More information about the elfutils-devel mailing list