Skip to content

bpo-39017 Fix infinite loop in the tarfile module#21454

Merged
encukou merged 4 commits intopython:masterfrom
rishi93:fix-issue-39017
Jul 15, 2020
Merged

bpo-39017 Fix infinite loop in the tarfile module#21454
encukou merged 4 commits intopython:masterfrom
rishi93:fix-issue-39017

Conversation

@rishi93
Copy link
Copy Markdown
Contributor

@rishi93 rishi93 commented Jul 12, 2020 •
edited by bedevere-bot
Loading

Add a check for length = 0 in the _proc_pax function to avoid running into an infinite loop

https://bugs.python.org/issue39017

@rishi93
bpo-39017 Fix infinite loop in the tarfile module
1fa6ef2 
Add a check for length = 0 in the _proc_pax function to avoid running into an infinite loop
@rishi93 rishi93 requested a review from ethanfurman as a code owner July 12, 2020 22:04
encukou
encukou reviewed Jul 14, 2020
View reviewed changes
Copy link
Copy Markdown
Member

@encukou encukou left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you note the CVE number that got assigned to this flaw?

Comment thread Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst Outdated
Comment thread Lib/test/test_tarfile.py
bcaller
bcaller reviewed Jul 14, 2020
View reviewed changes
Comment thread Lib/test/test_tarfile.py Outdated
def test_length_zero_header(self):
with self.assertRaisesRegex(tarfile.ReadError, "file could not be opened successfully"):
with tarfile.open(support.findfile('recursion.tar')) as tar:
tar.getmembers()
Copy link
Copy Markdown
Contributor

@bcaller bcaller Jul 14, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this tar.getmembers() can be replaced with pass since it should never be called. Or you can call tarfile.is_tarfile instead of with tarfile.open.... Feel free to ignore this comment.

Copy link
Copy Markdown
Contributor Author

@rishi93 rishi93 Jul 14, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the comment, I replaced the tar.getmembers() with pass as you suggested

rishi93 and others added 2 commits July 14, 2020 12:39
@rishi93 @encukou
Apply suggestions from code review
5f7b945 
Add relevant CVE number in inline comments

Co-authored-by: Petr Viktorin <[email protected]>
@rishi93
bpo-39017: Fix infinite loop in the tarfile module
54084a8 
Replace code that is never called with pass in tarfile testcase
@encukou encukou merged commit 5a8d121 into python:master Jul 15, 2020
@miss-islington
Copy link
Copy Markdown
Contributor

miss-islington commented Jul 15, 2020

Thanks @rishi93 for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8, 3.9.
🐍🍒⛏🤖

@encukou
Copy link
Copy Markdown
Member

encukou commented Jul 15, 2020

Thank you!

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
2195cad 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
@bedevere-bot
Copy link
Copy Markdown

bedevere-bot commented Jul 15, 2020

GH-21482 is a backport of this pull request to the 3.9 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
a06a6bf 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
@bedevere-bot
Copy link
Copy Markdown

bedevere-bot commented Jul 15, 2020

GH-21483 is a backport of this pull request to the 3.8 branch.

@bedevere-bot
Copy link
Copy Markdown

bedevere-bot commented Jul 15, 2020

GH-21484 is a backport of this pull request to the 3.7 branch.

@bedevere-bot
Copy link
Copy Markdown

bedevere-bot commented Jul 15, 2020

GH-21485 is a backport of this pull request to the 3.6 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
418cd7e 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
0640f50 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
@rishi93
Copy link
Copy Markdown
Contributor Author

rishi93 commented Jul 15, 2020

Thank you everyone, for this opportunity

miss-islington added a commit that referenced this pull request Jul 15, 2020
@miss-islington
[3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
f323229 
…GH-21482)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)


Co-authored-by: Rishi <[email protected]>

Automerge-Triggered-By: @encukou
miss-islington added a commit that referenced this pull request Jul 15, 2020
@miss-islington
[3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
c554795 
…GH-21483)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)


Co-authored-by: Rishi <[email protected]>

Automerge-Triggered-By: @encukou
ned-deily pushed a commit that referenced this pull request Jul 15, 2020
@miss-islington @rishi93
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-2…
79c6b60 
…1484)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
ned-deily pushed a commit that referenced this pull request Jul 15, 2020
@miss-islington @rishi93
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21485)
47a2955 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
@rishi93 rishi93 deleted the fix-issue-39017 branch July 15, 2020 12:59
encukou pushed a commit that referenced this pull request Jul 15, 2020
@rishi93 @encukou
[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454)
bde4372 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
larryhastings pushed a commit that referenced this pull request Jul 16, 2020
@encukou @rishi93
[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
cac9ca8 
…#21489)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <[email protected]>
@mweinelt mweinelt mentioned this pull request Jul 28, 2020
Closed
1 task
shihai1991 pushed a commit to shihai1991/cpython that referenced this pull request Aug 4, 2020
@rishi93 @shihai1991
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
3c3411b 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
shihai1991 pushed a commit to shihai1991/cpython that referenced this pull request Aug 20, 2020
@rishi93 @shihai1991
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
ad7df48 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
xzy3 pushed a commit to xzy3/cpython that referenced this pull request Oct 18, 2020
@rishi93 @xzy3-cdc
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
f5481db 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@encukou encukou encukou left review comments

@ethanfurman ethanfurman Awaiting requested review from ethanfurman

+1 more reviewer

@bcaller bcaller bcaller left review comments

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@rishi93 @miss-islington @encukou @bedevere-bot @bcaller @the-knights-who-say-ni