Skip to content

archive/tar: return ErrHeader on V7/USTAR UID/GID integer overflow - #81471

Open
TurboRx wants to merge 1 commit into
golang:masterfrom
TurboRx:archive-tar-v7-uid-overflow
Open

archive/tar: return ErrHeader on V7/USTAR UID/GID integer overflow#81471
TurboRx wants to merge 1 commit into
golang:masterfrom
TurboRx:archive-tar-v7-uid-overflow

Conversation

@TurboRx

@TurboRx TurboRx commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

When unpacking the V7/USTAR header, numeric UID and GID values are parsed
via p.parseNumeric, but are subsequently cast directly to platform-native
int without bounds checking. On 32-bit platforms, values >= 2^32 silently
truncate to 0 or wrap to negative numbers.

This change verifies that the parsed int64 fits within [math.MinInt,
math.MaxInt] and sets p.err to ErrHeader if out of bounds, matching the
behavior added to mergePAX.

Fixes #81446
Fixes #82121

@TurboRx
TurboRx force-pushed the archive-tar-v7-uid-overflow branch from 6a46a2b to 5c3312c Compare September 11, 2026 13:22
@gopherbot

gopherbot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

This PR (HEAD: 5c3312c) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

@gopherbot

gopherbot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Message from Gopher Robot:

Patch Set 1:

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

@TurboRx
TurboRx force-pushed the archive-tar-v7-uid-overflow branch from 5c3312c to d02cff4 Compare October 3, 2026 05:40
@gopherbot

gopherbot commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

This PR (HEAD: d02cff4) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

@houtinghang houtinghang mentioned this pull request Oct 10, 2026
Closed
@gopherbot

gopherbot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

Message from 14侯廷翰（10122 侯廷翰）:

Patch Set 3: Code-Review+1

(5 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

@TurboRx
archive/tar: return ErrHeader on V7/USTAR UID/GID integer overflow
1c40f24 
When unpacking the V7/USTAR header, numeric UID and GID values are parsed
via p.parseNumeric, but are subsequently cast directly to platform-native
int without bounds checking. On 32-bit platforms, values >= 2^32 silently
truncate to 0 or wrap to negative numbers.

This change verifies that the parsed int64 fits within [math.MinInt,
math.MaxInt] and sets p.err to ErrHeader if out of bounds, matching the
behavior added to mergePAX.

Fixes golang#81446
Fixes golang#82121
@TurboRx
TurboRx force-pushed the archive-tar-v7-uid-overflow branch from d02cff4 to 1c40f24 Compare October 10, 2026 09:07
@gopherbot

gopherbot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

This PR (HEAD: 1c40f24) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

  • Don't comment on this PR. All discussion takes place in Gerrit.
  • You need a Gmail or other Google account to log in to Gerrit.
  • To change your code in response to feedback:
    • Push a new commit to the branch used by your GitHub PR.
    • A new "patch set" will then appear in Gerrit.
    • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
    • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
    • Multiple commits in the PR will be squashed by GerritBot.
  • The title and description of the GitHub PR are used to construct the final commit message.
    • Edit these as needed via the GitHub web interface (not via Gerrit or git).
    • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
  • See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

@gopherbot

gopherbot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

Message from Pranay Debnath:

Patch Set 4:

(5 comments)

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

@gopherbot

gopherbot commented Oct 10, 2026

Copy link
Copy Markdown
Contributor

Message from 14侯廷翰（10122 侯廷翰）:

Patch Set 4: Code-Review+1

(1 comment)

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

2 participants

@TurboRx @gopherbot