| From 2d256d4bfd654bdcaf2d96733799be73b8ff8f69 Mon Sep 17 00:00:00 2001 |
| From: Petr Viktorin <encukou@gmail.com> |
| Date: Tue, 23 Jun 2026 15:13:30 +0200 |
| Subject: [PATCH 2/2] gh-151981: Make tarfile._Stream.seek break at EOF |
| (GH-151982) |
| |
| Co-authored-by: Stan Ulbrych <stan@python.org> |
| |
| CVE: CVE-2026-11972 |
| Upstream-Status: Backport [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896] |
| |
| Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com> |
| --- |
| Lib/tarfile.py | 4 +++- |
| Lib/test/test_tarfile.py | 16 ++++++++++++++++ |
| 2 files changed, 19 insertions(+), 1 deletion(-) |
| |
| diff --git a/Lib/tarfile.py b/Lib/tarfile.py |
| index 63f23490e8a1..399f906efdff 100644 |
| --- a/Lib/tarfile.py |
| +++ b/Lib/tarfile.py |
| @@ -524,7 +524,9 @@ def seek(self, pos=0): |
| if pos - self.pos >= 0: |
| blocks, remainder = divmod(pos - self.pos, self.bufsize) |
| for i in range(blocks): |
| - self.read(self.bufsize) |
| + data = self.read(self.bufsize) |
| + if not data: |
| + break |
| self.read(remainder) |
| else: |
| raise StreamError("seeking backwards is not allowed") |
| diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py |
| index 0fc7413be8db..045377d620cc 100644 |
| --- a/Lib/test/test_tarfile.py |
| +++ b/Lib/test/test_tarfile.py |
| @@ -4786,6 +4786,22 @@ def valueerror_filter(tarinfo, path): |
| with self.check_context(arc.open(errorlevel='boo!'), filtererror_filter): |
| self.expect_exception(TypeError) # errorlevel is not int |
| |
| + @support.subTests('format', [tarfile.GNU_FORMAT, tarfile.PAX_FORMAT]) |
| + def test_getmembers_big_size(self, format): |
| + # gh-151981: A loop in seek() for streaming files tried to read the |
| + # declared number of blocks even at EOF |
| + tinfo = tarfile.TarInfo("huge-file") |
| + tinfo.size = 1 << 64 |
| + bio = io.BytesIO() |
| + # Write header without data |
| + bio.write(tinfo.tobuf(format)) |
| + |
| + # Reset & try to get contents |
| + bio.seek(0) |
| + with tarfile.open(fileobj=bio, mode="r|") as tar: |
| + with self.assertRaises(tarfile.ReadError): |
| + tar.getmembers() |
| + |
| |
| class OverwriteTests(archiver_tests.OverwriteTests, unittest.TestCase): |
| testdir = os.path.join(TEMPDIR, "testoverwrite") |
| -- |
| 2.54.0 |
