Security: Guard against negative offset/length values in tarfile's GNU sparse extraction #137395
Closed as duplicate of#137396
Description
for i in range(21):
try:
offset = nti(buf[pos:pos + 12])
numbytes = nti(buf[pos + 12:pos + 24])
except ValueError:
break
if offset and numbytes:
structs.append((offset, numbytes))
pos += 24
Line 1441 in 7040aa5
- There is no check that offset or numbytes are non-negative.
- The check if offset and numbytes: only skips zero, not negative numbers.
validation should be added:
if offset >= 0 and numbytes >= 0:
structs.append((offset, numbytes))
- This will prevent the addition of invalid sparse mappings, mitigating the risk.