gh-151497: Avoid huge pre-allocation for oversized tarfile extended headers#151498
Open
iamsharduld wants to merge 1 commit into
Open
gh-151497: Avoid huge pre-allocation for oversized tarfile extended headers#151498iamsharduld wants to merge 1 commit into
iamsharduld wants to merge 1 commit into
Conversation
…nded headers
tarfile reads a member's extended header (a GNU long name/link or a pax
header) with a single read sized by the header's size field:
buf = tarfile.fileobj.read(self._block(self.size))
The size is taken from the archive and is not validated, so a ~512-byte
crafted file can claim several gigabytes (or, via base-256 encoding, far
more) and make read() pre-allocate that much memory -- on open/iterate,
before any extraction filter runs.
Read the extended-header data in bounded chunks instead, so an oversized
or truncated header can no longer force a huge allocation. The bytes
returned for valid archives are unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
tarfilereads a member's extended header (a GNU long name/link, or a paxheader) with a single read sized directly by the header's
sizefield:self.sizeis taken from the archive and is not validated, so a ~512-bytecrafted file can claim several gigabytes (or, via base-256 encoding, far more)
and make
read()pre-allocate that much memory — on open/iterate(
tarfile.open(...).getmembers()), before any extraction filter runs. A512-byte archive claiming 1 GiB drives a ~950 MiB resident allocation; a claim
of 1 TiB raises
MemoryErroreven on high-RAM machines.This reads the extended-header data in bounded chunks instead, so an oversized
or truncated header can no longer force a huge up-front allocation. The bytes
returned for valid archives are unchanged, and the change is safe for both
seekable and streaming (
r|) tars.