From: Jakub Jelinek <jakub@redhat.com>
Date: Thu, 10 Jun 2010 11:32:48 +0000
Subject: [PATCH] jartool.c (extract_jar)

Fix up checks for traversal to parent directories, disallow absolute
paths, make the code slightly more efficient.

Author: Dan Rosenberg <dan.j.rosenberg@gmail.com>

--- a/jartool.c	2010/06/10 08:46:10	1.61
+++ b/jartool.c	2010/06/10 11:32:48	1.62
@@ -1731,7 +1731,17 @@
       struct stat sbuf;
       int depth = 0;
 
-      tmp_buff = malloc(sizeof(char) * strlen((const char *)filename));
+      if(*filename == '/'){
+	fprintf(stderr, "Absolute path names are not allowed.\n");
+	exit(EXIT_FAILURE);
+      }
+
+      tmp_buff = malloc(strlen((const char *)filename));
+
+      if(tmp_buff == NULL) {
+	fprintf(stderr, "Out of memory.\n");
+	exit(EXIT_FAILURE);
+      }
 
       for(;;){
         const ub1 *idx = (const unsigned char *)strchr((const char *)start, '/');
@@ -1766,6 +1779,7 @@
 #ifdef DEBUG    
           printf("Directory exists\n");
 #endif
+	  tmp_buff[idx - filename] = '/';
           continue;
         }else {
           fprintf(stderr, "Hmmm.. %s exists but isn't a directory!\n",
@@ -1782,10 +1796,11 @@
         if(verbose && handle)
           printf("%10s: %s/\n", "created", tmp_buff);
 
+	tmp_buff[idx - filename] = '/';
       }
 
       /* only a directory */
-      if(strlen((const char *)start) == 0)
+      if(*start == '\0')
         dir = TRUE;
 
 #ifdef DEBUG    
@@ -1793,7 +1808,7 @@
 #endif
 
       /* If the entry was just a directory, don't write to file, etc */
-      if(strlen((const char *)start) == 0)
+      if(*start == '\0')
         f_fd = -1;
 
       free(tmp_buff);
@@ -1877,7 +1892,8 @@
       exit(EXIT_FAILURE);
     }
 
-    close(f_fd);
+    if (f_fd != -1)
+      close(f_fd);
 
     if(verbose && dir == FALSE && handle)
       printf("%10s: %s\n",