A bug in XAR decompressor?

[Grzegorz Antoniak]

Hello,

I'm having a problem with unpacking XAR files with current master branch
of libarchive. I'm using this small program to test the library:

https://gist.github.com/antekone/2aabfbf22d789441143a2d5cae7de3b0

This is the archive file I'm trying to unpack:

http://dump.anadoxin.org/test.pkg

This is the output of this program:

    % ../build/testcase
    - bin/ls
    read 133584 bytes
    - bin/cat
    archive_read_data() error: -30

When trying to dig into the issue, I've found this part of code of the
XAR decompressor (archive_read_support_format_xar.c, 8f2449d, line 970):

    int64_t pos = __archive_read_seek(a, offset, SEEK_SET);

The problem is that the `offset` seems to be a relative offset value
taken from the TOC XML stored inside the XAR file. This means that this
value can't be used as an argument for an absolute file positioning
function. The <offset></offset> field inside the TOC XML file is
relative to the end of the compressed TOC stream, so it should be
increased by the absolute offset of the first byte right after the
compressed TOC stream.

After changing this line according to the description above:

    int64_t pos = __archive_read_seek(a, xar->h_base + offset, SEEK_SET);

my program started to work correctly:

    % ../build/testcase
    - bin/ls
    read 133584 bytes
    - bin/cat
    read 34856 bytes
    encountered EOF

Should this change be incorporated into the XAR decompressor or am I
missing something?

Regards,
Grzegorz Antoniak