Skip to content

[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH-121286) #123641

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Sep 4, 2024
Merged

[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH-121286) #123641

merged 2 commits into from
Sep 4, 2024

Conversation

@sethmlarson
Copy link
Contributor

@sethmlarson sethmlarson commented Sep 3, 2024 •
edited by bedevere-app bot
Loading

  • Remove backtracking when parsing tarfile headers
  • Rewrite PAX header parsing to be stricter
  • Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

@sethmlarson @Eclips4 @gpshead
[3.9] pythongh-121285: Remove backtracking when parsing tarfile heade…
daf223e 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@sethmlarson sethmlarson requested a review from ambv September 3, 2024 14:56
This was referenced Sep 3, 2024
Merged
Closed
@sethmlarson
Copy link
Contributor Author

sethmlarson commented Sep 4, 2024

Fixed the failures, the ReadError from tarfile.open() no longer includes all the sub-errors that occurred per-compression format so we can only look at the top-level error.

@sethmlarson sethmlarson mentioned this pull request Sep 4, 2024
Merged
@ambv ambv merged commit b4225ca into python:3.9 Sep 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ambv ambv Awaiting requested review from ambv

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Assignees

No one assigned

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sethmlarson @ambv