!53 remove redundant patch file

From: @fwo 
Reviewed-by: @dillon_chen 
Signed-off-by: @dillon_chen

backport-CVE-2021-20193.patch

@@ -1,129 +0,0 @@
-From d9d4435692150fa8ff68e1b1a473d187cc3fd777 Mon Sep 17 00:00:00 2001
-From: Sergey Poznyakoff <gray@gnu.org>
-Date: Sun, 17 Jan 2021 20:41:11 +0200
-Subject: Fix memory leak in read_header
-
-https://git.savannah.gnu.org/cgit/tar.git/commit/?id=d9d4435692150fa8ff68e1b1a473d187cc3fd777
-
-Bug reported in https://savannah.gnu.org/bugs/?59897
-
-* src/list.c (read_header): Don't return directly from the loop.
-Instead set the status and break.  Return the status.  Free
-next_long_name and next_long_link before returning.
----
- src/list.c | 40 ++++++++++++++++++++++++++++------------
- 1 file changed, 28 insertions(+), 12 deletions(-)
-
-diff --git a/src/list.c b/src/list.c
-index e40a5c8..d7ef441 100644
---- a/src/list.c
-+++ b/src/list.c
-@@ -408,26 +408,27 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	     enum read_header_mode mode)
- {
-   union block *header;
--  union block *header_copy;
-   char *bp;
-   union block *data_block;
-   size_t size, written;
--  union block *next_long_name = 0;
--  union block *next_long_link = 0;
-+  union block *next_long_name = NULL;
-+  union block *next_long_link = NULL;
-   size_t next_long_name_blocks = 0;
-   size_t next_long_link_blocks = 0;
--
-+  enum read_header status = HEADER_SUCCESS;
-+  
-   while (1)
-     {
--      enum read_header status;
--
-       header = find_next_block ();
-       *return_block = header;
-       if (!header)
--	return HEADER_END_OF_FILE;
-+	{
-+	  status = HEADER_END_OF_FILE;
-+	  break;
-+	}
- 
-       if ((status = tar_checksum (header, false)) != HEADER_SUCCESS)
--	return status;
-+	break;
- 
-       /* Good block.  Decode file size and return.  */
- 
-@@ -437,7 +438,10 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	{
- 	  info->stat.st_size = OFF_FROM_HEADER (header->header.size);
- 	  if (info->stat.st_size < 0)
--	    return HEADER_FAILURE;
-+	    {
-+	      status = HEADER_FAILURE;
-+	      break;
-+	    }
- 	}
- 
-       if (header->header.typeflag == GNUTYPE_LONGNAME
-@@ -447,10 +451,14 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	  || header->header.typeflag == SOLARIS_XHDTYPE)
- 	{
- 	  if (mode == read_header_x_raw)
--	    return HEADER_SUCCESS_EXTENDED;
-+	    {
-+	      status = HEADER_SUCCESS_EXTENDED;
-+	      break;
-+	    }
- 	  else if (header->header.typeflag == GNUTYPE_LONGNAME
- 		   || header->header.typeflag == GNUTYPE_LONGLINK)
- 	    {
-+	      union block *header_copy;
- 	      size_t name_size = info->stat.st_size;
- 	      size_t n = name_size % BLOCKSIZE;
- 	      size = name_size + BLOCKSIZE;
-@@ -517,7 +525,10 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	      xheader_decode_global (&xhdr);
- 	      xheader_destroy (&xhdr);
- 	      if (mode == read_header_x_global)
--		return HEADER_SUCCESS_EXTENDED;
-+		{
-+		  status = HEADER_SUCCESS_EXTENDED;
-+		  break;
-+		}
- 	    }
- 
- 	  /* Loop!  */
-@@ -536,6 +547,7 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	      name = next_long_name->buffer + BLOCKSIZE;
- 	      recent_long_name = next_long_name;
- 	      recent_long_name_blocks = next_long_name_blocks;
-+	      next_long_name = NULL;
- 	    }
- 	  else
- 	    {
-@@ -567,6 +579,7 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	      name = next_long_link->buffer + BLOCKSIZE;
- 	      recent_long_link = next_long_link;
- 	      recent_long_link_blocks = next_long_link_blocks;
-+	      next_long_link = NULL;
- 	    }
- 	  else
- 	    {
-@@ -578,9 +591,12 @@ read_header (union block **return_block, struct tar_stat_info *info,
- 	    }
- 	  assign_string (&info->link_name, name);
- 
--	  return HEADER_SUCCESS;
-+	  break;
- 	}
-     }
-+  free (next_long_name);
-+  free (next_long_link);
-+  return status;
- }
- 
- #define ISOCTAL(c) ((c)>='0'&&(c)<='7')
--- 
-cgit v1.2.1
-

backport-CVE-2022-48303.patch

@@ -0,0 +1,31 @@
+From 1d530107a24d71e798727d7f0afa0833473d1074 Mon Sep 17 00:00:00 2001
+From: Matej Mužila <mmuzila@gmail.com>
+Date: Wed, 11 Jan 2023 08:55:58 +0100
+Subject: [PATCH] Fix savannah bug #62387
+
+* src/list.c (from_header): Check for the end of field after leading byte
+  (0x80 or 0xff) of base-256 encoded header value
+---
+ src/list.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/list.c b/src/list.c
+index 9fafc425..bf41b581 100644
+--- a/src/list.c
++++ b/src/list.c
+@@ -899,6 +899,12 @@ from_header (char const *where0, size_t digs, char const *type,
+ 			   << (CHAR_BIT * sizeof (uintmax_t)
+ 			       - LG_256 - (LG_256 - 2)));
+       value = (*where++ & ((1 << (LG_256 - 2)) - 1)) - signbit;
++      if (where == lim)
++        {
++          if (type && !silent)
++            ERROR ((0, 0, _("Archive base-256 value is invalid")));
++          return -1;
++        }
+       for (;;)
+ 	{
+ 	  value = (value << LG_256) + (unsigned char) *where++;
+-- 
+2.38.1
+

backport-CVE-2023-39804.patch

@@ -0,0 +1,59 @@
+From a339f05cd269013fa133d2f148d73f6f7d4247e4 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 28 Aug 2021 16:02:12 +0300
+Subject: Fix handling of extended header prefixes
+
+* src/xheader.c (locate_handler): Recognize prefix keywords only
+when followed by a dot.
+(xattr_decoder): Use xmalloc/xstrdup instead of alloc
+---
+ src/xheader.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+diff --git a/src/xheader.c b/src/xheader.c
+index 4f8b2b2..3cd694d 100644
+--- a/src/xheader.c
++++ b/src/xheader.c
+@@ -637,11 +637,11 @@ static struct xhdr_tab const *
+ locate_handler (char const *keyword)
+ {
+   struct xhdr_tab const *p;
+-
+   for (p = xhdr_tab; p->keyword; p++)
+     if (p->prefix)
+       {
+-        if (strncmp (p->keyword, keyword, strlen(p->keyword)) == 0)
++	size_t kwlen = strlen (p->keyword);
++        if (keyword[kwlen] == '.' && strncmp (p->keyword, keyword, kwlen) == 0)
+           return p;
+       }
+     else
+@@ -1716,19 +1716,20 @@ xattr_decoder (struct tar_stat_info *st,
+                char const *keyword, char const *arg, size_t size)
+ {
+   char *xstr, *xkey;
+-
++  
+   /* copy keyword */
+-  size_t klen_raw = strlen (keyword);
+-  xkey = alloca (klen_raw + 1);
+-  memcpy (xkey, keyword, klen_raw + 1) /* including null-terminating */;
++  xkey = xstrdup (keyword);
+ 
+   /* copy value */
+-  xstr = alloca (size + 1);
++  xstr = xmalloc (size + 1);
+   memcpy (xstr, arg, size + 1); /* separator included, for GNU tar '\n' */;
+ 
+   xattr_decode_keyword (xkey);
+ 
+-  xheader_xattr_add (st, xkey + strlen("SCHILY.xattr."), xstr, size);
++  xheader_xattr_add (st, xkey + strlen ("SCHILY.xattr."), xstr, size);
++
++  free (xkey);
++  free (xstr);
+ }
+ 
+ static void
+-- 
+cgit v1.1

tar-Add-sw64-architecture.patch

@@ -0,0 +1,60 @@
+From 7e8239c9e6dd50431f221d72716b20c0411eab0e Mon Sep 17 00:00:00 2001
+From: Wu Zixuan <wuzx1226@qq.com>
+Date: Thu, 24 Nov 2022 14:59:00 +0800
+Subject: [PATCH] Add sw64 architecture
+
+Add sw64 architecture in file m4/host-cpu-c-abi.m4 to support sw64 architecture.
+
+Signed-off-by: wzx <wuzx1226@qq.com>
+---
+ m4/host-cpu-c-abi.m4 | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/m4/host-cpu-c-abi.m4 b/m4/host-cpu-c-abi.m4
+index 7dc830e..b4c0830 100644
+--- a/m4/host-cpu-c-abi.m4
++++ b/m4/host-cpu-c-abi.m4
+@@ -90,6 +90,12 @@ changequote([,])dnl
+            [gl_cv_host_cpu_c_abi=i386])
+          ;;
+ 
++changequote(,)dnl
++       sw_64* )
++changequote([,])dnl
++         gl_cv_host_cpu_c_abi=sw_64
++         ;;
++
+ changequote(,)dnl
+        alphaev[4-8] | alphaev56 | alphapca5[67] | alphaev6[78] )
+ changequote([,])dnl
+@@ -355,6 +361,9 @@ EOF
+ #ifndef __x86_64__
+ #undef __x86_64__
+ #endif
++#ifndef __sw_64__
++#undef __sw_64__
++#endif
+ #ifndef __alpha__
+ #undef __alpha__
+ #endif
+@@ -468,7 +477,7 @@ AC_DEFUN([gl_HOST_CPU_C_ABI_32BIT],
+        case "$gl_cv_host_cpu_c_abi" in
+          i386 | x86_64-x32 | arm | armhf | arm64-ilp32 | hppa | ia64-ilp32 | mips | mipsn32 | powerpc | riscv*-ilp32* | s390 | sparc)
+            gl_cv_host_cpu_c_abi_32bit=yes ;;
+-         x86_64 | alpha | arm64 | hppa64 | ia64 | mips64 | powerpc64 | powerpc64-elfv2 | riscv*-lp64* | s390x | sparc64 )
++         x86_64 | sw_64 | alpha | arm64 | hppa64 | ia64 | mips64 | powerpc64 | powerpc64-elfv2 | riscv*-lp64* | s390x | sparc64 )
+            gl_cv_host_cpu_c_abi_32bit=no ;;
+          *)
+            gl_cv_host_cpu_c_abi_32bit=unknown ;;
+@@ -498,7 +507,7 @@ AC_DEFUN([gl_HOST_CPU_C_ABI_32BIT],
+ 
+          # CPUs that only support a 64-bit ABI.
+ changequote(,)dnl
+-         alpha | alphaev[4-8] | alphaev56 | alphapca5[67] | alphaev6[78] \
++         sw_64* | alpha | alphaev[4-8] | alphaev56 | alphapca5[67] | alphaev6[78] \
+          | mmix )
+ changequote([,])dnl
+            gl_cv_host_cpu_c_abi_32bit=no
+-- 
+2.33.0
+

tar.spec

@@ -1,6 +1,6 @@
 Name:          tar
 Version:       1.34
-Release:       1
+Release:       5
 Epoch:         2
 Summary:       An organized and systematic method of controlling a large amount of data
 License:       GPLv3+
@@ -12,11 +12,15 @@ BuildRequires: autoconf automake texinfo gettext libacl-devel attr acl policycor
 BuildRequires: gcc
 Provides:      bundled(gnulib) /bin/tar /bin/gtar
 
+Patch6000:     backport-CVE-2022-48303.patch
+
 Patch0001:     tar-1.28-loneZeroWarning.patch
 Patch0002:     tar-1.28-vfatTruncate.patch
 Patch0003:     tar-1.29-wildcards.patch
 Patch0004:     tar-1.28-atime-rofs.patch
 Patch0005:     tar-1.28-document-exclude-mistakes.patch
+Patch0006:     tar-Add-sw64-architecture.patch
+Patch0007:     backport-CVE-2023-39804.patch
 
 %description
 GNU Tar provides the ability to create tar archives, as well as various other
@@ -75,16 +79,28 @@ make check
 %{_infodir}/tar.info*
 
 %changelog
-* Sat Nov 13 2021 shixuantong <shixuantong> - 1.34-1
+* Mon Dec 04 2023 liningjie <liningjie@xfusion.com> 2:1.34-5
+- fix CVE-2023-39840
+
+* Wed Feb 08 2023 wangjiang <wangjiang37@h-partners.com> 2:1.34-4
+- fix CVE-2022-48303
+
+* Fri Nov 11 2022 wuzx<wuzx1226@qq.com> - 2:1.34-3
+- Add sw64 architecture
+
+* Thu Oct 27 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2:1.34-2
+- Rebuild for next release
+
+* Sat Nov 13 2021 shixuantong <shixuantong> - 2:1.34-1
 - update version to 1.34
 
-* Thu Jun 10 2021 shixuantong <shixuantong> - 1.32-3
+* Thu Jun 10 2021 shixuantong <shixuantong> - 2:1.32-3
 - add gcc to BuildRequires
 
-* Wed Apr 14 2021 shixuantong <shixuantong> - 1.32-2 
+* Wed Apr 14 2021 shixuantong <shixuantong> - 2:1.32-2 
 - fix CVE-2021-20193
 
-* Mon Jul 27 2020 shixuantong <shixuantong> - 1.32-1
+* Mon Jul 27 2020 shixuantong <shixuantong> - 2:1.32-1
 - update to 1.32-1
 
 * Tue Feb 18 2020 openEuler Buildteam <buildteam@openeuler.org> - 2:1.30-11