Merge pull request #3302 from datauwu/program-read-fix-uaf

program: fix dangling pointer after close
(cherry picked from commit 10ea0e7499)

libarchive/archive_read_support_filter_program.c

@@ -87,7 +87,7 @@ archive_read_support_filter_program(struct archive *a, const char *cmd)
  * bid twice in the same pipeline.
  */
 struct program_bidder {
-	char *description;
+	struct archive_string description;
 	char *cmd;
 	void *signature;
 	size_t signature_len;
@@ -145,6 +145,8 @@ archive_read_support_filter_program_signature(struct archive *_a,
 	state->cmd = strdup(cmd);
 	if (state->cmd == NULL)
 		goto memerr;
+	archive_strcpy(&state->description, "Program: ");
+	archive_strcat(&state->description, cmd);
 
 	if (signature != NULL && signature_len > 0) {
 		state->signature_len = signature_len;
@@ -180,6 +182,7 @@ free_state(struct program_bidder *state)
 {
 
 	if (state) {
+		archive_string_free(&state->description);
 		free(state->cmd);
 		free(state->signature);
 		free(state);
@@ -442,9 +445,12 @@ static int
 program_bidder_init(struct archive_read_filter *f)
 {
 	struct program_bidder   *bidder_state;
+	int r;
 
 	bidder_state = (struct program_bidder *)f->bidder->data;
-	return (__archive_read_program(f, bidder_state->cmd));
+	r = __archive_read_program(f, bidder_state->cmd);
+	f->name = bidder_state->description.s;
+	return (r);
 }
 
 static ssize_t

libarchive/test/test_read_filter_program.c

@@ -77,6 +77,8 @@ DEFINE_TEST(test_read_filter_program)
 	    archive_read_next_header(a, &ae));
 	assertEqualInt(archive_filter_code(a, 0), ARCHIVE_FILTER_PROGRAM);
 	assertEqualInt(archive_format(a), ARCHIVE_FORMAT_TAR_USTAR);
+	assertEqualString("Program: gzip -d", archive_filter_name(a, 0));
 	assertEqualIntA(a, ARCHIVE_OK, archive_read_close(a));
+	assertEqualString("Program: gzip -d", archive_filter_name(a, 0));
 	assertEqualInt(ARCHIVE_OK, archive_read_free(a));
 }