SECURITY:

GNU tar allows user-assisted attackers to overwrite arbitrary files
via a tar file that contains a GNUTYPE_NAMES record with a symbolic
link. (CVE-2006-6097)

archivers/gtar/Makefile

@@ -1,9 +1,9 @@
-# $OpenBSD: Makefile,v 1.39 2006/11/13 16:25:10 naddy Exp $
+# $OpenBSD: Makefile,v 1.40 2006/11/30 20:37:29 naddy Exp $
 
 COMMENT=	"GNU version of the traditional tar archiver"
 
 DISTNAME=	tar-1.16
-PKGNAME=	g${DISTNAME}
+PKGNAME=	g${DISTNAME}p0
 CATEGORIES=	archivers
 HOMEPAGE=	http://www.gnu.org/software/tar/
 
@@ -21,7 +21,7 @@ EXTRACT_SUFX=	.tar.bz2
 
 MODULES=	devel/gettext
 RUN_DEPENDS=	:bzip2-*:archivers/bzip2
-REGRESS_DEPENDS=::devel/autoconf/2.60
+REGRESS_DEPENDS=:autoconf-2.60:devel/autoconf/2.60
 REGRESS_FLAGS=	AUTOCONF_VERSION=2.60
 
 CONFIGURE_STYLE=gnu

archivers/gtar/patches/patch-src_extract_c

@@ -0,0 +1,14 @@
+$OpenBSD: patch-src_extract_c,v 1.3 2006/11/30 20:37:30 naddy Exp $
+--- src/extract.c.orig	Thu Nov 30 16:56:55 2006
++++ src/extract.c	Thu Nov 30 16:57:55 2006
+@@ -1121,10 +1121,6 @@ prepare_to_extract (char const *file_nam
+       *fun = extract_volhdr;
+       break;
+ 
+-    case GNUTYPE_NAMES:
+-      *fun = extract_mangle_wrapper;
+-      break;
+-
+     case GNUTYPE_MULTIVOL:
+       ERROR ((0, 0,
+ 	      _("%s: Cannot extract -- file is continued from another volume"),