git: 681fd2bed8ea - main - pax: Terminate loop for empty directory names

From: Warner Losh <imp_at_FreeBSD.org>
Date: Fri, 21 Jun 2024 16:43:25 UTC
The branch main has been updated by imp:

URL: https://cgit.FreeBSD.org/src/commit/?id=681fd2bed8eaba88693867ba928a1c03a5b152cc

commit 681fd2bed8eaba88693867ba928a1c03a5b152cc
Author:     Ganael Laplanche <ganael.laplanche@martymac.org>
AuthorDate: 2024-06-21 16:39:09 +0000
Commit:     Warner Losh <imp@FreeBSD.org>
CommitDate: 2024-06-21 16:39:09 +0000

    pax: Terminate loop for empty directory names
    
    Pax can sometimes loop forever. For example:
    
    $ mkdir -p /tmp/src/foo/bar
    $ rm -rf /tmp/dst ; mkdir -p /tmp/dst
    $ cd /tmp/src
    $ echo 'foo/bar/' | /bin/pax -r -w -d -pe "/tmp/dst"
    <looping infinitely>
    
    Here, pax(1) infinitely deletes and re-creates /tmp/dst/foo/bar/.
    
    The problem is that chk_path() (bin/pax/file_subs.c), called from
    node_creat() also creates the leaf directory when a trailing '/' appears
    in the directory name to create. When the execution goes back from
    chk_path() to node_creat(), the function still cannot create the leaf
    directory (it has been created by chk_path()), so it unlinks it and
    calls node_creat() again. The function re-creates it, and so on...
    
    In node_creat() detect trailing slashes and not create a leaf directory,
    but only intermediate ones.
    
    PR: 277060
    Reviewed by: imp
---
 bin/pax/file_subs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/bin/pax/file_subs.c b/bin/pax/file_subs.c
index 7214de337ec4..06602c12db2c 100644
--- a/bin/pax/file_subs.c
+++ b/bin/pax/file_subs.c
@@ -555,7 +555,12 @@ chk_path( char *name, uid_t st_uid, gid_t st_gid)
 		 * work forward from the first / and check each part of the path
 		 */
 		spt = strchr(spt, '/');
-		if (spt == NULL)
+
+		/*
+		 * skip creating a leaf dir (with an ending '/') as we only want
+		 * to create parents here
+		 */
+		if ((spt == NULL) || (*(spt + 1) == '\0'))
 			break;
 		*spt = '\0';