mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-07-24 11:44:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

[3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21482)

Browse source 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121a1f)


Co-authored-by: Rishi <rishi_devan@mail.com>

Automerge-Triggered-By: @encukou
This commit is contained in:
Miss Islington (bot) 2020-07-15 05:30:33 -07:00 • committed by GitHub
parent 805874a9f1
commit f3232294ee
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
Lib/tarfile.py
View file

@ -1249,6 +1249,8 @@ class TarInfo(object):
length, keyword = match.groups()
length = int(length)
if length == 0:
raise InvalidHeaderError("invalid header")
value = buf[match.end(2) + 1:match.start(1) + length - 1]
# Normally, we could just use "utf-8" as the encoding and "strict"