mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-08-03 16:39:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

bpo-39017: Avoid infinite loop in the tarfile module (GH-21454)

Browse source 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
This commit is contained in:
Rishi 2020-07-15 13:51:00 +02:00 • committed by GitHub
parent bbceef6851
commit 5a8d121a1f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Lib/test/test_tarfile.py
View file

@ -429,6 +429,13 @@ class CommonReadTest(ReadTest):
with self.assertRaisesRegex(tarfile.ReadError, "unexpected end of data"):
tar.extractfile(t).read()
def test_length_zero_header(self):
# bpo-39017 (CVE-2019-20907): reading a zero-length header should fail
# with an exception
with self.assertRaisesRegex(tarfile.ReadError, "file could not be opened successfully"):
with tarfile.open(support.findfile('recursion.tar')) as tar:
pass
class MiscReadTestBase(CommonReadTest):
def requires_name_attribute(self):
pass