From efaed86d21f882cd0a616484bde76d252ced6631 Mon Sep 17 00:00:00 2001 From: Ariadne Conill Date: Tue, 5 Aug 2025 09:21:11 -0700 Subject: [PATCH] tar: fix TOCTOU symlink race condition Signed-off-by: Ariadne Conill --- archival/libarchive/data_extract_all.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/archival/libarchive/data_extract_all.c b/archival/libarchive/data_extract_all.c index 8a69711c1..88bf96392 100644 --- a/archival/libarchive/data_extract_all.c +++ b/archival/libarchive/data_extract_all.c @@ -143,9 +143,11 @@ void FAST_FUNC data_extract_all(archive_handle_t *archive_handle) case S_IFREG: { /* Regular file */ char *dst_nameN; - int flags = O_WRONLY | O_CREAT | O_EXCL; + int flags = O_WRONLY | O_CREAT | O_NOFOLLOW; if (archive_handle->ah_flags & ARCHIVE_O_TRUNC) - flags = O_WRONLY | O_CREAT | O_TRUNC; + flags |= O_TRUNC; + else + flags |= O_EXCL; dst_nameN = dst_name; #ifdef ARCHIVE_REPLACE_VIA_RENAME if (archive_handle->ah_flags & ARCHIVE_REPLACE_VIA_RENAME) -- 2.50.1