diff options
| author | Damien Neil <dneil@google.com> | 2022-09-02 20:45:18 -0700 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2022-10-05 20:40:43 +0000 |
| commit | 0bf7ee9977c0218562c50a0b0f0d9cbdf33f65e6 (patch) | |
| tree | b6a0ca78c1885bbe74e9acdf651ba8627524035b /src/archive/tar/reader_test.go | |
| parent | c3c4aea55b404c2e6ef109ec6a345f4ccb877381 (diff) | |
| download | go-0bf7ee9977c0218562c50a0b0f0d9cbdf33f65e6.tar.xz | |
archive/tar: limit size of headers
Set a 1MiB limit on special file blocks (PAX headers, GNU long names,
GNU link names), to avoid reading arbitrarily large amounts of data
into memory.
Thanks to Adam Korczynski (ADA Logics) and OSS-Fuzz for reporting
this issue.
Fixes CVE-2022-2879
For #54853
Change-Id: I85136d6ff1e0af101a112190e027987ab4335680
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1565555
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/439355
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Diffstat (limited to 'src/archive/tar/reader_test.go')
| -rw-r--r-- | src/archive/tar/reader_test.go | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/src/archive/tar/reader_test.go b/src/archive/tar/reader_test.go index a8e9b929d7..247030da57 100644 --- a/src/archive/tar/reader_test.go +++ b/src/archive/tar/reader_test.go @@ -6,6 +6,7 @@ package tar import ( "bytes" + "compress/bzip2" "crypto/md5" "errors" "fmt" @@ -244,6 +245,9 @@ func TestReader(t *testing.T) { file: "testdata/pax-bad-hdr-file.tar", err: ErrHeader, }, { + file: "testdata/pax-bad-hdr-large.tar.bz2", + err: ErrFieldTooLong, + }, { file: "testdata/pax-bad-mtime-file.tar", err: ErrHeader, }, { @@ -625,9 +629,14 @@ func TestReader(t *testing.T) { } defer f.Close() + var fr io.Reader = f + if strings.HasSuffix(v.file, ".bz2") { + fr = bzip2.NewReader(fr) + } + // Capture all headers and checksums. var ( - tr = NewReader(f) + tr = NewReader(fr) hdrs []*Header chksums []string rdbuf = make([]byte, 8) |