From 4fca350fb34c31e681fd6750692d6089b9810c3d Mon Sep 17 00:00:00 2001
From: Rob Landley <rob@landley.net>
Date: Sat, 19 Mar 2022 20:03:27 -0500
Subject: [PATCH] The ".." removal logic was looping on file/dir names starting
 with "..", reported by hg42 on github.

---
 tests/tar.test   | 8 ++++++++
 toys/posix/tar.c | 8 ++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 tests/tar.test

diff --git a/tests/tar.test b/tests/tar.test
old mode 100644
new mode 100755
index 6db35185..740e0abf
--- a/tests/tar.test
+++ b/tests/tar.test
@@ -275,6 +275,14 @@ testcmd 'replace dir with file' '-xf test.tar && cat one/two/three' \
   'hello\n' '' ''
 rm -rf one test.tar
 
+mkdir ..dotsdir
+testing "create ..dotsdir" "$TAR ..dotsdir | SUM 3" \
+  "de99091a91c74ef6b90093e9165b413670730572\n" "" ""
+
+testing "pass ..dotsdir" "$TAR ..dotsdir | LST" \
+  "drwxrwxr-x root/root 0 2009-02-13 23:31 ..dotsdir/\n" "" ""
+rmdir ..dotsdir
+
 if false
 then
 
diff --git a/toys/posix/tar.c b/toys/posix/tar.c
index bd68873c..0566bb65 100644
--- a/toys/posix/tar.c
+++ b/toys/posix/tar.c
@@ -225,8 +225,12 @@ static int add_to_tar(struct dirtree *node)
     if (!(lnk = strstr(lnk, ".."))) break;
     if (lnk == hname || lnk[-1] == '/') {
       if (!lnk[2]) goto done;
-      if (lnk[2]=='/') lnk = hname = lnk+3;
-    } else lnk+= 2;
+      if (lnk[2]=='/') {
+        lnk = hname = lnk+3;
+        continue;
+      }
+    }
+    lnk += 2;
   }
   if (!*hname) goto done;
 
-- 
2.39.2