Bug#523515: libarchive-ar-perl: wrong permissions on files in ar archive - module writes wrong ar header

[Stephen Gran]

Package: libarchive-ar-perl
Version: 1.13b-2
Severity: important
Tags: patch

So I was beating my head against what was happening to files I'm adding
to an ar archive for quite a bit of the afternoon, and I finally dug out
a hex editor and the ar archive header spec.  This is what I've found.

The files on disk:

rw-r--r-- 1002/1002     29 Apr 10 19:53 2009 result.tar.gz
rw-r--r-- 1002/1002    452 Apr 10 19:53 2009 log.tar.gz

The files in the ar:

-wx-wx--x 1002/1002     29 Apr 10 19:53 2009 result.tar.gz
-wx-wx--x 1002/1002    452 Apr 10 19:53 2009 log.tar.gz


First, the spec:

An ar file begins with a global header, followed by a header and data
section for each file stored within the ar file.  The data section is
2 byte aligned. If it would end on an odd offset, a '\n' is used as filler.

The global header is a single field containing the magic ASCII string
"!<arch>" followed by a single LF control character

The common file header format is as follows:

Field Offset from       Field Offset to  Field Name                      Field Format
0                        15              File name                       ASCII
16                       27              File modification timestamp     Decimal
28                       33              Owner ID                        Decimal
34                       39              Group ID                        Decimal
40                       47              File mode                       Octal
48                       57              File size in bytes              Decimal
58                       59              File magic                      \140\012

The doecumentation:
·   "add_files("filename1", "filename2")"
·   "add_files(["filename1", "filename2"])"

    Takes an array or an arrayref of filenames to add to the ar archive,
    in order.  The filenames can be paths to files, in which case the path
    information is stripped off.  Filenames longer than 16 characters
    are truncated when written to disk in the format, so keep that in
    mind when adding files.

    Due to the nature of the ar archive format, "add_files()" will store
    the uid, gid, mode, size, and creation date of the file as returned by
    "stat()";

The code:

my $ar = Archive::Ar->new();
for my $t (qw(result log)) {
        $ar->add_files("$t.tar.gz"}, );
}

And now the hexdump:

0000000 21 3c 61 72 63 68 3e 0a 72 65 73 75 6c 74 2e 74
        !  <  a  r  c  h  >  \n r  e  s  u  l  t  .  t
0000020 61 72 2e 67 7a 20 20 20 31 32 33 39 33 38 37 38
        a  r  .  g  z           1  2  3  9  3  8  7  8
0000040 37 31 20 20 31 30 30 32 20 20 31 30 30 32 20 20
        7  1        1  0  0  2        1  0  0  2
0000060 33 33 31 38 38 20 20 20 32 39 20 20 20 20 20 20
        3  3  1  8  8           2  9

As you can see, it's storing 33188 in the mode parameter of the header.
This is the decimal representation of 100644 (the octal representation
of the mode).  This is wrong, as the ar spec says it needs to store that
parameter as an octal value.  The reason it does this is because perl's
stat() call returns the decimal value, and Archive::Ar does not cast it
to octal.  Simple minded patch below.

--- /usr/share/perl5/Archive/Ar.pm      2009-04-10 19:57:39.000000000 +0100
+++ Ar.pm       2009-04-10 19:58:05.000000000 +0100
@@ -173,7 +173,7 @@
                        "date" => $mtime,
                        "uid"  => $uid,
                        "gid"  => $gid, 
-                       "mode" => $mode,
+                       "mode" => sprintf("%o",$mode),
                        "size" => $size,
                };

Cheers,

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.28-varinia (SMP w/2 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libarchive-ar-perl depends on:
ii  perl                          5.10.0-19  Larry Wall's Practical Extraction 

libarchive-ar-perl recommends no packages.

libarchive-ar-perl suggests no packages.

-- no debconf information

-- 
 -----------------------------------------------------------------
|   ,''`.                                            Stephen Gran |
|  : :' :                                        sgran at debian.org |
|  `. `'                        Debian user, admin, and developer |
|    `-                                     http://www.debian.org |
 -----------------------------------------------------------------