!50 [sync] PR-48: Fix CVE-2015-1197

From: @openeuler-sync-bot 
Reviewed-by: @znzjugod 
Signed-off-by: @ziyangc

add-option-to-add-metadata-in-copy-out-mode.patch

@@ -45,7 +45,7 @@ index 31a15fa..03d9585 100644
  Treat the archive file as local, even if its name contains colons.
  @item -F [[@var{user}@@]@var{host}:]@var{archive-file}
 diff --git a/src/copyout.c b/src/copyout.c
-index 4b7336b..fdafb37 100644
+index 421d36d..4cd60a3 100644
 --- a/src/copyout.c
 +++ b/src/copyout.c
 @@ -22,6 +22,7 @@
@@ -151,7 +151,7 @@ index 4b7336b..fdafb37 100644
  /* Read a list of file names from the standard input
     and write a cpio collection on the standard output.
     The format of the header depends on the compatibility (-c) flag.  */
-@@ -603,6 +692,8 @@ process_copy_out ()
+@@ -604,6 +693,8 @@ process_copy_out (void)
    int in_file_des;		/* Source file descriptor.  */
    int out_file_des;		/* Output file descriptor.  */
    char *orig_file_name = NULL;
@@ -159,8 +159,8 @@ index 4b7336b..fdafb37 100644
 +  int ret, metadata_fd, metadata = 0, old_metadata, hard_link;
  
    /* Initialize the copy out.  */
-   ds_init (&input_name, 128);
-@@ -635,9 +726,37 @@ process_copy_out ()
+   file_hdr.c_magic = 070707;
+@@ -635,9 +726,37 @@ process_copy_out (void)
        prepare_append (out_file_des);
      }
  
@@ -199,8 +199,8 @@ index 4b7336b..fdafb37 100644
        /* Check for blank line.  */
        if (input_name.ds_string[0] == 0)
  	{
-@@ -667,8 +786,15 @@ process_copy_out ()
- 		    }
+@@ -662,8 +781,15 @@ process_copy_out (void)
+ 		    ds_append (&input_name, '/');
  		}
  	    }
 -	  
@@ -217,7 +217,7 @@ index 4b7336b..fdafb37 100644
  	  cpio_safer_name_suffix (input_name.ds_string, false,
  				  !no_abs_paths_flag, true);
  	  cpio_set_c_name (&file_hdr, input_name.ds_string);
-@@ -700,6 +826,7 @@ process_copy_out ()
+@@ -695,6 +821,7 @@ process_copy_out (void)
  		  else
  		    {
  		      add_link_defer (&file_hdr);
@@ -225,7 +225,7 @@ index 4b7336b..fdafb37 100644
  		      break;
  		    }
  		}
-@@ -836,6 +963,8 @@ process_copy_out ()
+@@ -831,6 +958,8 @@ process_copy_out (void)
  	    fprintf (stderr, "%s\n", orig_file_name);
  	  if (dot_flag)
  	    fputc ('.', stderr);
@@ -234,10 +234,10 @@ index 4b7336b..fdafb37 100644
  	}
      }
  
-@@ -875,6 +1004,11 @@ process_copy_out ()
- 			 (unsigned long) blocks), (unsigned long) blocks);
+@@ -871,6 +1000,11 @@ process_copy_out (void)
      }
    cpio_file_stat_free (&file_hdr);
+   ds_free (&input_name);
 +
 +  if (metadata_type != TYPE_NONE) {
 +    close(metadata_fd);
@@ -247,10 +247,10 @@ index 4b7336b..fdafb37 100644
  
  
 diff --git a/src/dstring.c b/src/dstring.c
-index e9c063f..1021d21 100644
+index 0f597cc..07e827f 100644
 --- a/src/dstring.c
 +++ b/src/dstring.c
-@@ -58,8 +58,8 @@ ds_resize (dynamic_string *string, int size)
+@@ -74,8 +74,8 @@ ds_reset (dynamic_string *s, size_t len)
     Return NULL if end of file is detected.  Otherwise,
     Return a pointer to the null-terminated string in S.  */
  
@@ -259,33 +259,29 @@ index e9c063f..1021d21 100644
 +static char *
 +ds_fgetstr_common (FILE *f, char *input_string, dynamic_string *s, char eos)
  {
-   int insize;			/* Amount needed for line.  */
-   int strsize;			/* Amount allocated for S.  */
-@@ -70,7 +70,10 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
-   strsize = s->ds_length;
+   int next_ch;
+ 
+@@ -83,10 +83,18 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
+   s->ds_idx = 0;
  
    /* Read the input string.  */
--  next_ch = getc (f);
+-  while ((next_ch = getc (f)) != eos && next_ch != EOF)
 +  if (input_string)
 +    next_ch = *input_string++;
 +  else
 +    next_ch = getc (f);
-   while (next_ch != eos && next_ch != EOF)
++  while (next_ch != eos && next_ch != EOF)
      {
-       if (insize >= strsize - 1)
-@@ -79,7 +82,10 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
- 	  strsize = s->ds_length;
- 	}
-       s->ds_string[insize++] = next_ch;
--      next_ch = getc (f);
+       ds_resize (s, 0);
+       s->ds_string[s->ds_idx++] = next_ch;
 +      if (input_string)
-+	next_ch = *input_string++;
++        next_ch = *input_string++;
 +      else
-+	next_ch = getc (f);
++        next_ch = getc (f);       
      }
-   s->ds_string[insize++] = '\0';
- 
-@@ -90,6 +96,12 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
+   ds_resize (s, 0);
+   s->ds_string[s->ds_idx] = '\0';
+@@ -121,6 +129,12 @@ ds_concat (dynamic_string *s, char const *str)
  }
  
  char *
@@ -298,25 +294,31 @@ index e9c063f..1021d21 100644
  ds_fgets (FILE *f, dynamic_string *s)
  {
    return ds_fgetstr (f, s, '\n');
-@@ -100,3 +112,9 @@ ds_fgetname (FILE *f, dynamic_string *s)
- {
+@@ -132,6 +146,12 @@ ds_fgetname (FILE *f, dynamic_string *s)
    return ds_fgetstr (f, s, '\0');
  }
-+
+ 
 +char *
 +ds_sgetstr (char *input_string, dynamic_string *s, char eos)
 +{
 +  return ds_fgetstr_common (NULL, input_string, s, eos);
 +}
++
+ /* Return true if the dynamic string S ends with character C. */
+ int
+ ds_endswith (dynamic_string *s, int c)
 diff --git a/src/dstring.h b/src/dstring.h
-index b5135fe..f5f95ec 100644
+index f5b04ef..50c877d 100644
 --- a/src/dstring.h
 +++ b/src/dstring.h
-@@ -49,3 +49,4 @@ void ds_resize (dynamic_string *string, int size);
+@@ -41,6 +41,7 @@ void ds_reset (dynamic_string *s, size_t len);
  char *ds_fgetname (FILE *f, dynamic_string *s);
  char *ds_fgets (FILE *f, dynamic_string *s);
  char *ds_fgetstr (FILE *f, dynamic_string *s, char eos);
 +char *ds_sgetstr (char *input_string, dynamic_string *s, char eos);
+ void ds_append (dynamic_string *s, int c);
+ void ds_concat (dynamic_string *s, char const *str);
+ 
 diff --git a/src/extern.h b/src/extern.h
 index 11ac6bf..f295fcf 100644
 --- a/src/extern.h
@@ -340,10 +342,10 @@ index 11ac6bf..f295fcf 100644
  /* copyin.c */
  void warn_junk_bytes (long bytes_skipped);
 diff --git a/src/global.c b/src/global.c
-index fb3abe9..0c40be0 100644
+index acf92bc..d45e19b 100644
 --- a/src/global.c
 +++ b/src/global.c
-@@ -199,3 +199,5 @@ char *change_directory_option;
+@@ -196,3 +196,5 @@ char *change_directory_option;
  int renumber_inodes_option;
  int ignore_devno_option;
  

backport-0001-CVE-2021-38185-Rewrite-dynamic-string-support.patch

@@ -0,0 +1,462 @@
+From dd96882877721703e19272fe25034560b794061b Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Sat, 7 Aug 2021 12:52:21 +0300
+Subject: [PATCH 11/13] Rewrite dynamic string support.
+
+* src/dstring.c (ds_init): Take a single argument.
+(ds_free): New function.
+(ds_resize): Take a single argument.  Use x2nrealloc to expand
+the storage.
+(ds_reset,ds_append,ds_concat,ds_endswith): New function.
+(ds_fgetstr): Rewrite.  In particular, this fixes integer overflow.
+* src/dstring.h (dynamic_string): Keep both the allocated length
+(ds_size) and index of the next free byte in the string (ds_idx).
+(ds_init,ds_resize): Change signature.
+(ds_len): New macro.
+(ds_free,ds_reset,ds_append,ds_concat,ds_endswith): New protos.
+* src/copyin.c: Use new ds_ functions.
+* src/copyout.c: Likewise.
+* src/copypass.c: Likewise.
+* src/util.c: Likewise.
+---
+ src/copyin.c   | 40 +++++++++++++-------------
+ src/copyout.c  | 16 ++++-------
+ src/copypass.c | 34 +++++++++++------------
+ src/dstring.c  | 88 ++++++++++++++++++++++++++++++++++++++++++----------------
+ src/dstring.h  | 31 ++++++++++-----------
+ src/util.c     |  6 ++--
+ 6 files changed, 123 insertions(+), 92 deletions(-)
+
+diff --git a/src/copyin.c b/src/copyin.c
+index bf3b0a8..c7f4b49 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -55,11 +55,12 @@ query_rename(struct cpio_file_stat* file_hdr, FILE *tty_in, FILE *tty_out,
+   char *str_res;		/* Result for string function.  */
+   static dynamic_string new_name;	/* New file name for rename option.  */
+   static int initialized_new_name = false;
++
+   if (!initialized_new_name)
+-  {
+-    ds_init (&new_name, 128);
+-    initialized_new_name = true;
+-  }
++    {
++      ds_init (&new_name);
++      initialized_new_name = true;
++    }
+ 
+   if (rename_flag)
+     {
+@@ -778,39 +779,41 @@ long_format (struct cpio_file_stat *file_hdr, char const *link_name)
+    already in `save_patterns' (from the command line) are preserved.  */
+ 
+ static void
+-read_pattern_file ()
++read_pattern_file (void)
+ {
+-  int max_new_patterns;
+-  char **new_save_patterns;
+-  int new_num_patterns;
++  char **new_save_patterns = NULL;
++  size_t max_new_patterns;
++  size_t new_num_patterns;
+   int i;
+-  dynamic_string pattern_name;
++  dynamic_string pattern_name = DYNAMIC_STRING_INITIALIZER;
+   FILE *pattern_fp;
+ 
+   if (num_patterns < 0)
+     num_patterns = 0;
+-  max_new_patterns = 1 + num_patterns;
+-  new_save_patterns = (char **) xmalloc (max_new_patterns * sizeof (char *));
+   new_num_patterns = num_patterns;
+-  ds_init (&pattern_name, 128);
++  max_new_patterns = num_patterns;
++  new_save_patterns = xcalloc (max_new_patterns, sizeof (new_save_patterns[0]));
+ 
+   pattern_fp = fopen (pattern_file_name, "r");
+   if (pattern_fp == NULL)
++  {
+     open_error (pattern_file_name);
++    ds_free (&pattern_name);
++  }
+   else
+   {
+     while (ds_fgetstr (pattern_fp, &pattern_name, '\n') != NULL)
+       {
+-        if (new_num_patterns >= max_new_patterns)
+-        {
+-          max_new_patterns += 1;
+-          new_save_patterns = (char **)
+-          xrealloc ((char *) new_save_patterns,
+-            max_new_patterns * sizeof (char *));
+-        }
++        if (new_num_patterns == max_new_patterns)
++          new_save_patterns = x2nrealloc (new_save_patterns,
++                                          &max_new_patterns,
++                                          sizeof (new_save_patterns[0]));
+         new_save_patterns[new_num_patterns] = xstrdup (pattern_name.ds_string);
+         ++new_num_patterns;
+       }
++
++    ds_free (&pattern_name);
++
+     if (ferror (pattern_fp) || fclose (pattern_fp) == EOF)
+       close_error (pattern_file_name);
+   }
+@@ -1198,7 +1201,7 @@ swab_array (char *ptr, int count)
+    in the file system.  */
+ 
+ void
+-process_copy_in ()
++process_copy_in (void)
+ {
+   char done = false;		/* True if trailer reached.  */
+   FILE *tty_in = NULL;		/* Interactive file for rename option.  */
+diff --git a/src/copyout.c b/src/copyout.c
+index 4b7336b..421d36d 100644
+--- a/src/copyout.c
++++ b/src/copyout.c
+@@ -594,9 +594,10 @@ assign_string (char **pvar, char *value)
+    The format of the header depends on the compatibility (-c) flag.  */
+ 
+ void
+-process_copy_out ()
++process_copy_out (void)
+ {
+-  dynamic_string input_name;	/* Name of file read from stdin.  */
++  dynamic_string input_name = DYNAMIC_STRING_INITIALIZER;
++                                /* Name of file read from stdin.  */
+   struct stat file_stat;	/* Stat record for file.  */
+   struct cpio_file_stat file_hdr = CPIO_FILE_STAT_INITIALIZER;
+                                 /* Output header information.  */
+@@ -605,7 +606,6 @@ process_copy_out ()
+   char *orig_file_name = NULL;
+ 
+   /* Initialize the copy out.  */
+-  ds_init (&input_name, 128);
+   file_hdr.c_magic = 070707;
+ 
+   /* Check whether the output file might be a tape.  */
+@@ -657,14 +657,9 @@ process_copy_out ()
+ 	    {
+ 	      if (file_hdr.c_mode & CP_IFDIR)
+ 		{
+-		  int len = strlen (input_name.ds_string);
+ 		  /* Make sure the name ends with a slash */
+-		  if (input_name.ds_string[len-1] != '/')
+-		    {
+-		      ds_resize (&input_name, len + 2);
+-		      input_name.ds_string[len] = '/';
+-		      input_name.ds_string[len+1] = 0;
+-		    }
++		  if (!ds_endswith (&input_name, '/'))
++		    ds_append (&input_name, '/');
+ 		}
+ 	    }
+ 	  
+@@ -875,6 +870,7 @@ process_copy_out ()
+ 			 (unsigned long) blocks), (unsigned long) blocks);
+     }
+   cpio_file_stat_free (&file_hdr);
++  ds_free (&input_name);
+ }
+ 
+ 
+diff --git a/src/copypass.c b/src/copypass.c
+index dc13b5b..62f31c6 100644
+--- a/src/copypass.c
++++ b/src/copypass.c
+@@ -48,10 +48,12 @@ set_copypass_perms (int fd, const char *name, struct stat *st)
+    If `link_flag', link instead of copying.  */
+ 
+ void
+-process_copy_pass ()
++process_copy_pass (void)
+ {
+-  dynamic_string input_name;	/* Name of file from stdin.  */
+-  dynamic_string output_name;	/* Name of new file.  */
++  dynamic_string input_name = DYNAMIC_STRING_INITIALIZER;
++                                /* Name of file from stdin.  */
++  dynamic_string output_name = DYNAMIC_STRING_INITIALIZER;
++                                /* Name of new file.  */
+   size_t dirname_len;		/* Length of `directory_name'.  */
+   int res;			/* Result of functions.  */
+   char *slash;			/* For moving past slashes in input name.  */
+@@ -65,25 +67,18 @@ process_copy_pass ()
+ 				   created files  */
+ 
+   /* Initialize the copy pass.  */
+-  ds_init (&input_name, 128);
+   
+   dirname_len = strlen (directory_name);
+   if (change_directory_option && !ISSLASH (directory_name[0]))
+     {
+       char *pwd = xgetcwd ();
+-
+-      dirname_len += strlen (pwd) + 1;
+-      ds_init (&output_name, dirname_len + 2);
+-      strcpy (output_name.ds_string, pwd);
+-      strcat (output_name.ds_string, "/");
+-      strcat (output_name.ds_string, directory_name);
++      
++      ds_concat (&output_name, pwd);
++      ds_append (&output_name, '/');
+     }
+-  else
+-    {
+-      ds_init (&output_name, dirname_len + 2);
+-      strcpy (output_name.ds_string, directory_name);
+-    }
+-  output_name.ds_string[dirname_len] = '/';
++  ds_concat (&output_name, directory_name);
++  ds_append (&output_name, '/');
++  dirname_len = ds_len (&output_name);
+   output_is_seekable = true;
+ 
+   change_dir ();
+@@ -116,8 +111,8 @@ process_copy_pass ()
+       /* Make the name of the new file.  */
+       for (slash = input_name.ds_string; *slash == '/'; ++slash)
+ 	;
+-      ds_resize (&output_name, dirname_len + strlen (slash) + 2);
+-      strcpy (output_name.ds_string + dirname_len + 1, slash);
++      ds_reset (&output_name, dirname_len);
++      ds_concat (&output_name, slash);
+ 
+       existing_dir = false;
+       if (lstat (output_name.ds_string, &out_file_stat) == 0)
+@@ -333,6 +328,9 @@ process_copy_pass ()
+ 			 (unsigned long) blocks),
+ 	       (unsigned long) blocks);
+     }
++
++  ds_free (&input_name);
++  ds_free (&output_name);
+ }
+ 
+ /* Try and create a hard link from FILE_NAME to another file 
+diff --git a/src/dstring.c b/src/dstring.c
+index e9c063f..358f356 100644
+--- a/src/dstring.c
++++ b/src/dstring.c
+@@ -20,8 +20,8 @@
+ #if defined(HAVE_CONFIG_H)
+ # include <config.h>
+ #endif
+-
+ #include <stdio.h>
++#include <stdlib.h>
+ #if defined(HAVE_STRING_H) || defined(STDC_HEADERS)
+ #include <string.h>
+ #else
+@@ -33,24 +33,41 @@
+ /* Initialiaze dynamic string STRING with space for SIZE characters.  */
+ 
+ void
+-ds_init (dynamic_string *string, int size)
++ds_init (dynamic_string *string)
++{
++  memset (string, 0, sizeof *string);
++}
++
++/* Free the dynamic string storage. */
++
++void
++ds_free (dynamic_string *string)
+ {
+-  string->ds_length = size;
+-  string->ds_string = (char *) xmalloc (size);
++  free (string->ds_string);
+ }
+ 
+-/* Expand dynamic string STRING, if necessary, to hold SIZE characters.  */
++/* Expand dynamic string STRING, if necessary.  */
+ 
+ void
+-ds_resize (dynamic_string *string, int size)
++ds_resize (dynamic_string *string)
+ {
+-  if (size > string->ds_length)
++  if (string->ds_idx == string->ds_size)
+     {
+-      string->ds_length = size;
+-      string->ds_string = (char *) xrealloc ((char *) string->ds_string, size);
++      string->ds_string = x2nrealloc (string->ds_string, &string->ds_size,
++				      1);
+     }
+ }
+ 
++/* Reset the index of the dynamic string S to LEN. */
++
++void
++ds_reset (dynamic_string *s, size_t len)
++{
++  while (len > s->ds_size)
++    ds_resize (s);
++  s->ds_idx = len;
++}
++
+ /* Dynamic string S gets a string terminated by the EOS character
+    (which is removed) from file F.  S will increase
+    in size during the function if the string from F is longer than
+@@ -61,34 +78,50 @@ ds_resize (dynamic_string *string, int size)
+ char *
+ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
+ {
+-  int insize;			/* Amount needed for line.  */
+-  int strsize;			/* Amount allocated for S.  */
+   int next_ch;
+ 
+   /* Initialize.  */
+-  insize = 0;
+-  strsize = s->ds_length;
++  s->ds_idx = 0;
+ 
+   /* Read the input string.  */
+-  next_ch = getc (f);
+-  while (next_ch != eos && next_ch != EOF)
++  while ((next_ch = getc (f)) != eos && next_ch != EOF)
+     {
+-      if (insize >= strsize - 1)
+-	{
+-	  ds_resize (s, strsize * 2 + 2);
+-	  strsize = s->ds_length;
+-	}
+-      s->ds_string[insize++] = next_ch;
+-      next_ch = getc (f);
++      ds_resize (s);
++      s->ds_string[s->ds_idx++] = next_ch;
+     }
+-  s->ds_string[insize++] = '\0';
++  ds_resize (s);
++  s->ds_string[s->ds_idx] = '\0';
+ 
+-  if (insize == 1 && next_ch == EOF)
++  if (s->ds_idx == 0 && next_ch == EOF)
+     return NULL;
+   else
+     return s->ds_string;
+ }
+ 
++void
++ds_append (dynamic_string *s, int c)
++{
++  ds_resize (s);
++  s->ds_string[s->ds_idx] = c;
++  if (c)
++    {
++      s->ds_idx++;
++      ds_resize (s);
++      s->ds_string[s->ds_idx] = 0;
++    }      
++}
++
++void
++ds_concat (dynamic_string *s, char const *str)
++{
++  size_t len = strlen (str);
++  while (len + 1 > s->ds_size)
++    ds_resize (s);
++  memcpy (s->ds_string + s->ds_idx, str, len);
++  s->ds_idx += len;
++  s->ds_string[s->ds_idx] = 0;
++}
++
+ char *
+ ds_fgets (FILE *f, dynamic_string *s)
+ {
+@@ -100,3 +133,10 @@ ds_fgetname (FILE *f, dynamic_string *s)
+ {
+   return ds_fgetstr (f, s, '\0');
+ }
++
++/* Return true if the dynamic string S ends with character C. */
++int
++ds_endswith (dynamic_string *s, int c)
++{
++  return (s->ds_idx > 0 && s->ds_string[s->ds_idx - 1] == c);
++}
+diff --git a/src/dstring.h b/src/dstring.h
+index b5135fe..f5b04ef 100644
+--- a/src/dstring.h
++++ b/src/dstring.h
+@@ -17,10 +17,6 @@
+    Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301 USA.  */
+ 
+-#ifndef NULL
+-#define NULL 0
+-#endif
+-
+ /* A dynamic string consists of record that records the size of an
+    allocated string and the pointer to that string.  The actual string
+    is a normal zero byte terminated string that can be used with the
+@@ -30,22 +26,25 @@
+ 
+ typedef struct
+ {
+-  int ds_length;		/* Actual amount of storage allocated.  */
+-  char *ds_string;		/* String.  */
++  size_t ds_size;   /* Actual amount of storage allocated.  */
++  size_t ds_idx;    /* Index of the next free byte in the string. */
++  char *ds_string;  /* String storage. */
+ } dynamic_string;
+ 
++#define DYNAMIC_STRING_INITIALIZER { 0, 0, NULL }
+ 
+-/* Macros that look similar to the original string functions.
+-   WARNING:  These macros work only on pointers to dynamic string records.
+-   If used with a real record, an "&" must be used to get the pointer.  */
+-#define ds_strlen(s)		strlen ((s)->ds_string)
+-#define ds_strcmp(s1, s2)	strcmp ((s1)->ds_string, (s2)->ds_string)
+-#define ds_strncmp(s1, s2, n)	strncmp ((s1)->ds_string, (s2)->ds_string, n)
+-#define ds_index(s, c)		index ((s)->ds_string, c)
+-#define ds_rindex(s, c)		rindex ((s)->ds_string, c)
++void ds_init (dynamic_string *string);
++void ds_free (dynamic_string *string);
++void ds_reset (dynamic_string *s, size_t len);
+ 
+-void ds_init (dynamic_string *string, int size);
+-void ds_resize (dynamic_string *string, int size);
++/* All functions below guarantee that s->ds_string[s->ds_idx] == '\0' */
+ char *ds_fgetname (FILE *f, dynamic_string *s);
+ char *ds_fgets (FILE *f, dynamic_string *s);
+ char *ds_fgetstr (FILE *f, dynamic_string *s, char eos);
++void ds_append (dynamic_string *s, int c);
++void ds_concat (dynamic_string *s, char const *str);
++
++#define ds_len(s) ((s)->ds_idx)
++
++int ds_endswith (dynamic_string *s, int c);
++
+diff --git a/src/util.c b/src/util.c
+index 4421b20..6d6bbaa 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -846,11 +846,9 @@ get_next_reel (int tape_des)
+   FILE *tty_out;		/* File for interacting with user.  */
+   int old_tape_des;
+   char *next_archive_name;
+-  dynamic_string new_name;
++  dynamic_string new_name = DYNAMIC_STRING_INITIALIZER;
+   char *str_res;
+ 
+-  ds_init (&new_name, 128);
+-
+   /* Open files for interactive communication.  */
+   tty_in = fopen (TTY_NAME, "r");
+   if (tty_in == NULL)
+@@ -925,7 +923,7 @@ get_next_reel (int tape_des)
+     error (PAXEXIT_FAILURE, 0, _("internal error: tape descriptor changed from %d to %d"),
+ 	   old_tape_des, tape_des);
+ 
+-  free (new_name.ds_string);
++  ds_free (&new_name);
+   fclose (tty_in);
+   fclose (tty_out);
+ }
+-- 
+1.8.3.1
+

backport-0002-CVE-2021-38185-Fix-previous-commit.patch

@@ -0,0 +1,36 @@
+From dfc801c44a93bed7b3951905b188823d6a0432c8 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Wed, 11 Aug 2021 18:10:38 +0300
+Subject: [PATCH 12/13] Fix previous commit
+
+* src/dstring.c (ds_reset,ds_concat): Don't call ds_resize in a
+loop.
+---
+ src/dstring.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/dstring.c b/src/dstring.c
+index 692d3e7..b7e0bb5 100644
+--- a/src/dstring.c
++++ b/src/dstring.c
+@@ -64,7 +64,7 @@ void
+ ds_reset (dynamic_string *s, size_t len)
+ {
+   while (len > s->ds_size)
+-    ds_resize (s);
++    s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1);
+   s->ds_idx = len;
+ }
+ 
+@@ -116,7 +116,7 @@ ds_concat (dynamic_string *s, char const *str)
+ {
+   size_t len = strlen (str);
+   while (len + 1 > s->ds_size)
+-    ds_resize (s);
++    s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1);
+   memcpy (s->ds_string + s->ds_idx, str, len);
+   s->ds_idx += len;
+   s->ds_string[s->ds_idx] = 0;
+-- 
+1.8.3.1
+

backport-0003-CVE-2021-38185-Fix-dynamic-string-reallocations.patch

@@ -0,0 +1,78 @@
+From 236684f6deb3178043fe72a8e2faca538fa2aae1 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Wed, 18 Aug 2021 09:41:39 +0300
+Subject: [PATCH 13/13] Fix dynamic string reallocations
+
+* src/dstring.c (ds_resize): Take additional argument: number of
+bytes to leave available after ds_idx.  All uses changed.
+---
+ src/dstring.c | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+diff --git a/src/dstring.c b/src/dstring.c
+index b7e0bb5..fd4e030 100644
+--- a/src/dstring.c
++++ b/src/dstring.c
+@@ -49,9 +49,9 @@ ds_free (dynamic_string *string)
+ /* Expand dynamic string STRING, if necessary.  */
+ 
+ void
+-ds_resize (dynamic_string *string)
++ds_resize (dynamic_string *string, size_t len)
+ {
+-  if (string->ds_idx == string->ds_size)
++  while (len + string->ds_idx >= string->ds_size)
+     {
+       string->ds_string = x2nrealloc (string->ds_string, &string->ds_size,
+ 				      1);
+@@ -63,8 +63,7 @@ ds_resize (dynamic_string *string)
+ void
+ ds_reset (dynamic_string *s, size_t len)
+ {
+-  while (len > s->ds_size)
+-    s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1);
++  ds_resize (s, len);
+   s->ds_idx = len;
+ }
+ 
+@@ -86,10 +85,10 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
+   /* Read the input string.  */
+   while ((next_ch = getc (f)) != eos && next_ch != EOF)
+     {
+-      ds_resize (s);
++      ds_resize (s, 0);
+       s->ds_string[s->ds_idx++] = next_ch;
+     }
+-  ds_resize (s);
++  ds_resize (s, 0);
+   s->ds_string[s->ds_idx] = '\0';
+ 
+   if (s->ds_idx == 0 && next_ch == EOF)
+@@ -101,12 +100,12 @@ ds_fgetstr (FILE *f, dynamic_string *s, char eos)
+ void
+ ds_append (dynamic_string *s, int c)
+ {
+-  ds_resize (s);
++  ds_resize (s, 0);
+   s->ds_string[s->ds_idx] = c;
+   if (c)
+     {
+       s->ds_idx++;
+-      ds_resize (s);
++      ds_resize (s, 0);
+       s->ds_string[s->ds_idx] = 0;
+     }      
+ }
+@@ -115,8 +114,7 @@ void
+ ds_concat (dynamic_string *s, char const *str)
+ {
+   size_t len = strlen (str);
+-  while (len + 1 > s->ds_size)
+-    s->ds_string = x2nrealloc (s->ds_string, &s->ds_size, 1);
++  ds_resize (s, len);
+   memcpy (s->ds_string + s->ds_idx, str, len);
+   s->ds_idx += len;
+   s->ds_string[s->ds_idx] = 0;
+-- 
+1.8.3.1
+

backport-CVE-2015-1197.patch

@@ -0,0 +1,259 @@
+From 376d663340a9dc91c91a5849e5713f07571c1628 Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Thu, 27 Apr 2023 15:14:23 +0300
+Subject: Fix 45b0ee2b407913c533f7ded8d6f8cbeec16ff6ca.
+
+The commit in question brought in more problems than solutions.  To
+properly fix the issue, use symlink placeholders, modelled after
+delayed symlinks in tar.
+
+* src/copyin.c (symlink_placeholder)
+(replace_symlink_placeholders): New functions.
+(copyin_link): Create symlink placeholder if --no-absolute-filenames
+was given.
+(process_copy_in): Replace placeholders after extraction.
+* tests/CVE-2015-1197.at: Update. Don't use /tmp.
+
+Reference:http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=376d663340a9dc91c91a5849e5713f07571c1628
+Conflict:NA
+
+---
+ src/copyin.c           | 173 ++++++++++++++++++++++++++++++++++++++++++-------
+ tests/CVE-2015-1197.at |   7 +-
+ 2 files changed, 153 insertions(+), 27 deletions(-)
+
+diff --git a/src/copyin.c b/src/copyin.c
+index 60cef9d..5ed2db6 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -30,6 +30,7 @@
+ #ifndef	FNM_PATHNAME
+ # include <fnmatch.h>
+ #endif
++#include <hash.h>
+ 
+ #ifndef HAVE_LCHOWN
+ # define lchown(f,u,g) 0
+@@ -620,6 +621,136 @@ copyin_device (struct cpio_file_stat* file_hdr)
+ 		    file_hdr->c_mtime);
+ }
+ 
++struct delayed_link
++  {
++    /* The device and inode number of the placeholder. */
++    dev_t dev;
++    ino_t ino;
++
++    /* The desired link metadata. */
++    mode_t mode;
++    uid_t uid;
++    gid_t gid;
++    time_t mtime;
++
++    /* Link source and target names. */
++    char *source;
++    char target[1];
++  };
++
++static Hash_table *delayed_link_table;
++
++static size_t
++dl_hash (void const *entry, size_t table_size)
++{
++  struct delayed_link const *dl = entry;
++  uintmax_t n = dl->dev;
++  int nshift = (sizeof (n) - sizeof (dl->dev)) * CHAR_BIT;
++  if (0 < nshift)
++    n <<= nshift;
++  n ^= dl->ino;
++  return n % table_size;
++}
++
++static bool
++dl_compare (void const *a, void const *b)
++{
++  struct delayed_link const *da = a, *db = b;
++  return (da->dev == db->dev) & (da->ino == db->ino);
++}
++
++static int
++symlink_placeholder (char *oldpath, char *newpath, struct cpio_file_stat *file_stat)
++{
++  int fd = open (newpath, O_WRONLY | O_CREAT | O_EXCL, 0);
++  struct stat st;
++  struct delayed_link *p;
++  size_t newlen = strlen (newpath);
++  
++  if (fd < 0)
++    {
++      open_error (newpath);
++      return -1;
++    }
++  
++  if (fstat (fd, &st) != 0)
++    {
++      stat_error (newpath);
++      close (fd);
++      return -1;
++    }
++
++  close (fd);
++
++  p = xmalloc (sizeof (*p) + strlen (oldpath) + newlen + 1);
++  p->dev = st.st_dev;
++  p->ino = st.st_ino;
++
++  p->mode = file_stat->c_mode;
++  p->uid = file_stat->c_uid;
++  p->gid = file_stat->c_gid;
++  p->mtime = file_stat->c_mtime;
++
++  strcpy (p->target, newpath);
++  p->source = p->target + newlen + 1;
++  strcpy (p->source, oldpath);
++
++  if (!((delayed_link_table
++	 || (delayed_link_table = hash_initialize (0, 0, dl_hash,
++						   dl_compare, free)))
++	&& hash_insert (delayed_link_table, p)))
++    xalloc_die ();
++
++  return 0;
++}
++
++static void
++replace_symlink_placeholders (void)
++{
++  struct delayed_link *dl;
++
++  if (!delayed_link_table)
++    return;
++  for (dl = hash_get_first (delayed_link_table);
++       dl;
++       dl = hash_get_next (delayed_link_table, dl))
++    {
++      struct stat st;
++      
++      /* Make sure the placeholder file is still there.  If not,
++	 don't create a link, as the placeholder was probably
++	 removed by a later extraction.  */
++      if (lstat (dl->target, &st) == 0
++	  && st.st_dev == dl->dev
++	  && st.st_ino == dl->ino)
++	{
++	  if (unlink (dl->target))
++	    unlink_error (dl->target);
++	  else
++	    {
++	      int res = UMASKED_SYMLINK (dl->source, dl->target, dl->mode);
++	      if (res < 0 && create_dir_flag)
++		{
++		  create_all_directories (dl->target);
++		  res = UMASKED_SYMLINK (dl->source, dl->target, dl->mode);
++		}
++	      if (res < 0)
++		symlink_error (dl->source, dl->target);
++	      else if (!no_chown_flag)
++		{
++		  uid_t uid = set_owner_flag ? set_owner : dl->uid;
++		  gid_t gid = set_group_flag ? set_group : dl->gid;
++		  if (lchown (dl->target, uid, gid) < 0 && errno != EPERM)
++		    chown_error_details (dl->target, uid, gid);
++		}
++	    }
++	}
++    }
++  
++  hash_free (delayed_link_table);
++  delayed_link_table = NULL;
++}
++
+ static void
+ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+ {
+@@ -645,29 +776,26 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+       link_name = xstrdup (file_hdr->c_tar_linkname);
+     }
+ 
+-  cpio_safer_name_suffix (link_name, true, !no_abs_paths_flag, false);
+-  
+-  res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
+-			 file_hdr->c_mode);
+-  if (res < 0 && create_dir_flag)
+-    {
+-      create_all_directories (file_hdr->c_name);
+-      res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
+-    }
+-  if (res < 0)
+-    {
+-      error (0, errno, _("%s: Cannot symlink to %s"),
+-	     quotearg_colon (link_name), quote_n (1, file_hdr->c_name));
+-      free (link_name);
+-      return;
+-    }
+-  if (!no_chown_flag)
++  if (no_abs_paths_flag)
++    symlink_placeholder (link_name, file_hdr->c_name, file_hdr);
++  else
+     {
+-      uid_t uid = set_owner_flag ? set_owner : file_hdr->c_uid;
+-      gid_t gid = set_group_flag ? set_group : file_hdr->c_gid;
+-      if ((lchown (file_hdr->c_name, uid, gid) < 0)
+-  	  && errno != EPERM)
+-	chown_error_details (file_hdr->c_name, uid, gid);
++      res = UMASKED_SYMLINK (link_name, file_hdr->c_name,
++			     file_hdr->c_mode);
++      if (res < 0 && create_dir_flag)
++	{
++	  create_all_directories (file_hdr->c_name);
++	  res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
++	}
++      if (res < 0)
++	symlink_error (link_name, file_hdr->c_name);
++      else if (!no_chown_flag)
++	{
++	  uid_t uid = set_owner_flag ? set_owner : file_hdr->c_uid;
++	  gid_t gid = set_group_flag ? set_group : file_hdr->c_gid;
++	  if (lchown (file_hdr->c_name, uid, gid) < 0 && errno != EPERM)
++	    chown_error_details (file_hdr->c_name, uid, gid);
++	}
+     }
+   free (link_name);
+ }
+@@ -1425,6 +1553,7 @@ process_copy_in (void)
+   if (dot_flag)
+     fputc ('\n', stderr);
+ 
++  replace_symlink_placeholders ();
+   apply_delayed_set_stat ();
+ 
+   cpio_file_stat_free (&file_hdr);
+diff --git a/tests/CVE-2015-1197.at b/tests/CVE-2015-1197.at
+index 57ebe43..74591b1 100644
+--- a/tests/CVE-2015-1197.at
++++ b/tests/CVE-2015-1197.at
+@@ -24,18 +24,15 @@ AT_DATA([filelist],
+ [dir
+ dir/file
+ ])
+-ln -s /tmp dir
+-touch /tmp/file
+ cpio -o < filelist > test.cpio
+-rm dir /tmp/file
++rm -rf dir $tempdir
+ cpio --no-absolute-filenames -iv < test.cpio
+ ],
+ [2],
+ [],
+ [1 block
+-cpio: Removing leading `/' from hard link targets
+ dir
+-cpio: dir/file: Cannot open: No such file or directory
++cpio: dir/file: Cannot open: Not a directory
+ dir/file
+ 1 block
+ ])
+-- 
+cgit v1.1
+
+

backport-Do-not-set-exit-code-to-2-when-failing-to-create-sym.patch

@@ -0,0 +1,37 @@
+From 388fbb65a2d7244717aaeac2b316b51ee0474dd4 Mon Sep 17 00:00:00 2001
+From: Ziyang Chen <chenziyang4@huawei.com>
+Date: Mon, 10 Jul 2023 20:19:27 +0800
+Subject: [PATCH] Do not set exit code to 2 when failing to create symlink
+
+Reference:https://lists.gnu.org/archive/html/bug-cpio/2023-07/msg00001.html
+Conflict:NA
+---
+ src/copyin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/copyin.c b/src/copyin.c
+index dc715ff..6fa5699 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -742,7 +742,7 @@ replace_symlink_placeholders (void)
+ 		  res = UMASKED_SYMLINK (dl->source, dl->target, dl->mode);
+ 		}
+ 	      if (res < 0)
+-		symlink_error (dl->source, dl->target);
++          error (0, errno, _("%s: Cannot create symlink to %s"), quotearg_colon (dl->target), quote_n (1, dl->source));
+ 	      else if (!no_chown_flag)
+ 		{
+ 		  uid_t uid = set_owner_flag ? set_owner : dl->uid;
+@@ -795,7 +795,7 @@ copyin_link (struct cpio_file_stat *file_hdr, int in_file_des)
+ 	  res = UMASKED_SYMLINK (link_name, file_hdr->c_name, file_hdr->c_mode);
+ 	}
+       if (res < 0)
+-	symlink_error (link_name, file_hdr->c_name);
++	error (0, errno, _("%s: Cannot create symlink to %s"), quotearg_colon (file_hdr->c_name), quote_n (1, link_name));
+       else if (!no_chown_flag)
+ 	{
+ 	  uid_t uid = set_owner_flag ? set_owner : file_hdr->c_uid;
+-- 
+2.33.0
+
+

backport-fix-operation-of-no-absolute-filenames-make-director.patch

@@ -0,0 +1,35 @@
+From 06789cf2a6a0121f75fada35926f09ec851a609f Mon Sep 17 00:00:00 2001
+From: Sergey Poznyakoff <gray@gnu.org>
+Date: Thu, 18 May 2023 09:00:12 +0300
+Subject: [PATCH] Fix operation of --no-absolute-filenames --make-directories
+
+* src/copyin.c (symlink_placeholder): Try to create leading
+directories if unable to create placeholder.
+
+Reference:http://git.savannah.gnu.org/cgit/cpio.git/commit/?id=e3cc782c610729de7622a274e532817c18262a9d
+Conflict:NA
+---
+ src/copyin.c     |  6 ++++++
+ 2 files changed, 20 insertions(+)
+ create mode 100644 src/copyin.c.rej
+
+diff --git a/src/copyin.c b/src/copyin.c
+index 69d4ca4..53a84e5 100644
+--- a/src/copyin.c
++++ b/src/copyin.c
+@@ -668,6 +668,12 @@ symlink_placeholder (char *oldpath, char *newpath, struct cpio_file_stat *file_s
+   struct delayed_link *p;
+   size_t newlen = strlen (newpath);
+   
++  if (fd < 0 && create_dir_flag)
++    {
++      create_all_directories (newpath);
++      fd = open (newpath, O_WRONLY | O_CREAT | O_EXCL, 0);
++    }
++
+   if (fd < 0)
+     {
+       open_error (newpath);
+-- 
+2.27.0
+

cpio.spec

@@ -1,6 +1,6 @@
 Name:           cpio
 Version:        2.13
-Release:        5
+Release:        10
 Summary:        A GNU archiving program
 
 License:        GPLv3+
@@ -14,10 +14,15 @@ Patch3:         cpio-2.9.90-defaultremoteshell.patch
 Patch4:         cpio-2.10-patternnamesigsegv.patch
 Patch5:         cpio-2.10-longnames-split.patch
 Patch6:         cpio-2.11-crc-fips-nit.patch
-Patch7:		add-option-to-add-metadata-in-copy-out-mode.patch
-Patch8:		Fix-use-after-free-and-return-appropriate-error.patch
-Patch9:		revert-CVE-2015-1197.patch
-Patch10:        backport-cpio-2.13-mutiple-definition.patch
+Patch8:         backport-cpio-2.13-mutiple-definition.patch
+Patch9:         backport-0001-CVE-2021-38185-Rewrite-dynamic-string-support.patch
+Patch10:        backport-0002-CVE-2021-38185-Fix-previous-commit.patch
+Patch11:        backport-0003-CVE-2021-38185-Fix-dynamic-string-reallocations.patch
+Patch12:        backport-CVE-2015-1197.patch
+Patch13:        backport-fix-operation-of-no-absolute-filenames-make-director.patch
+Patch14:        backport-Do-not-set-exit-code-to-2-when-failing-to-create-sym.patch
+Patch9000:      add-option-to-add-metadata-in-copy-out-mode.patch
+Patch9001:      Fix-use-after-free-and-return-appropriate-error.patch
 
 Provides:       bundled(gnulib)
 Provides:       /bin/cpio
@@ -60,6 +65,36 @@ make check
 %{_datadir}/man/man1/%{name}.1.gz
 
 %changelog
+* Wed Aug 30 2023 chenziyang <chenziyang4@huawei.com> - 2.13-10
+- Type:CVE
+- ID:CVE-2015-1197
+- SUG:NA
+- DESC:backport CVE-2015-1197, delete revert-CVE-2015-1197.patch and backport the following 2 bugfix patches
+
+* Tue Jun 20 2023 fuanan <fuanan3@h-partners.com> - 2.13-9
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:revert fix CVE-2015-1197 because it causes AT testcases problems
+
+* Sat May 27 2023 fuanan <fuanan3@h-partners.com> - 2.13-8
+- Type:CVE
+- ID:CVE-2015-1197
+- SUG:NA
+- DESC:Fix CVE-2015-1197
+
+* Thu Oct 27 2022 dongyuzhen <dongyuzhen@h-partners.com> - 2.13-7
+- Type:bugfix
+- ID:NA
+- SUG:NA
+- DESC:Rebuild for next release
+
+* Tue Aug 24 2021 yangzhuangzhuang <yangzhuangzhuang1@huawei.com> - 2.13-6
+- Type:CVE
+- ID:CVE-2021-38185
+- SUG:NA
+- DESC:Fix CVE-2021-38185
+
 * Fri Jul 30 2021 yixiangzhike <zhangxingliang3@huawei.com> - 2.13-5
 - Type:bugfix
 - ID:NA