Skip to content

/ cpython

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-39017 Fix infinite loop in the tarfile module #21454

Merged
merged 4 commits into from Jul 15, 2020
Merged

bpo-39017 Fix infinite loop in the tarfile module #21454

merged 4 commits into from Jul 15, 2020
+10 −0

Conversation

@rishi93
Copy link
Contributor

@rishi93 rishi93 commented Jul 12, 2020 •
edited by bedevere-bot

Add a check for length = 0 in the _proc_pax function to avoid running into an infinite loop

https://bugs.python.org/issue39017
Rajarishi Devarajan
bpo-39017 Fix infinite loop in the tarfile module
Loading status checks…
1fa6ef2 
Add a check for length = 0 in the _proc_pax function to avoid running into an infinite loop
@rishi93 rishi93 requested a review from ethanfurman as a code owner Jul 12, 2020
@blurb-it
📜🤖 Added by blurb_it.
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
c43a5af
@encukou
encukou reviewed Jul 14, 2020
View changes
Copy link
Member

@encukou encukou left a comment

Could you note the CVE number that got assigned to this flaw?
Misc/NEWS.d/next/Library/2020-07-12-22-16-58.bpo-39017.x3Cg-9.rst Outdated Show resolved Hide resolved
Lib/test/test_tarfile.py Outdated Show resolved Hide resolved
@bcaller
bcaller reviewed Jul 14, 2020
View changes
Lib/test/test_tarfile.py Outdated
def test_length_zero_header(self):
with self.assertRaisesRegex(tarfile.ReadError, "file could not be opened successfully"):
with tarfile.open(support.findfile('recursion.tar')) as tar:
tar.getmembers()

This comment has been minimized.

Sign in to view
@bcaller

bcaller Jul 14, 2020
Contributor

I think this tar.getmembers() can be replaced with pass since it should never be called. Or you can call tarfile.is_tarfile instead of with tarfile.open.... Feel free to ignore this comment.

This comment has been minimized.

Sign in to view
@rishi93

rishi93 Jul 14, 2020
Author Contributor

Thank you for the comment, I replaced the tar.getmembers() with pass as you suggested
rishi93 and others added 2 commits Jul 14, 2020
@rishi93 @encukou
Apply suggestions from code review
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
5f7b945 
Add relevant CVE number in inline comments

Co-authored-by: Petr Viktorin <encukou@gmail.com>
@rishi93
bpo-39017: Fix infinite loop in the tarfile module
Loading status checks…
54084a8 
Replace code that is never called with pass in tarfile testcase
@encukou encukou merged commit 5a8d121 into python:master Jul 15, 2020
10 checks passed
10 checks passed
Docs
Details
Check for source changes
Details
Windows (x86)
Details
Windows (x64)
Details
macOS
Details
Ubuntu
Details
Azure Pipelines PR #20200714.5 succeeded
Details
bedevere/issue-number Issue number 39017 found
Details
bedevere/news News entry found in Misc/NEWS.d
continuous-integration/travis-ci/pr The Travis CI build passed
Details
@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Jul 15, 2020

Thanks @rishi93 for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7, 3.8, 3.9.
🐍🍒⛏🤖
@encukou
Copy link
Member

@encukou encukou commented Jul 15, 2020

Thank you!
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
2195cad 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Jul 15, 2020

GH-21482 is a backport of this pull request to the 3.9 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
a06a6bf 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Jul 15, 2020

GH-21483 is a backport of this pull request to the 3.8 branch.
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Jul 15, 2020

GH-21484 is a backport of this pull request to the 3.7 branch.
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Jul 15, 2020

GH-21485 is a backport of this pull request to the 3.6 branch.
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
418cd7e 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
miss-islington added a commit to miss-islington/cpython that referenced this pull request Jul 15, 2020
@rishi93 @miss-islington
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
0640f50 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
@rishi93
Copy link
Contributor Author

@rishi93 rishi93 commented Jul 15, 2020

Thank you everyone, for this opportunity
miss-islington added a commit that referenced this pull request Jul 15, 2020
@miss-islington
[3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
f323229 
…GH-21482)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)


Co-authored-by: Rishi <rishi_devan@mail.com>

Automerge-Triggered-By: @encukou
miss-islington added a commit that referenced this pull request Jul 15, 2020
@miss-islington
[3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
c554795 
…GH-21483)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)


Co-authored-by: Rishi <rishi_devan@mail.com>

Automerge-Triggered-By: @encukou
ned-deily pushed a commit that referenced this pull request Jul 15, 2020
@miss-islington @rishi93
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-2…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
79c6b60 
…1484)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
ned-deily pushed a commit that referenced this pull request Jul 15, 2020
@miss-islington @rishi93
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21485)
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
Loading status checks…
47a2955 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
@rishi93 rishi93 deleted the rishi93:fix-issue-39017 branch Jul 15, 2020
encukou added a commit that referenced this pull request Jul 15, 2020
@rishi93 @encukou
[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454)
Loading status checks…
bde4372 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
larryhastings pushed a commit that referenced this pull request Jul 16, 2020
@encukou @rishi93
[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (…
Verified
This commit was created on GitHub.com and signed with a verified signature using GitHub’s key.
GPG key ID: 4AEE18F83AFDEB23 Learn about signing commits
cac9ca8 
…#21489)

Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
(cherry picked from commit 5a8d121)

Co-authored-by: Rishi <rishi_devan@mail.com>
J-Arun-Mani added a commit to J-Arun-Mani/cpython that referenced this pull request Jul 21, 2020
@rishi93 @J-Arun-Mani
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
184a367 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
@mweinelt mweinelt mentioned this pull request Jul 28, 2020
Closed
0 of 1 task complete
shihai1991 added a commit to shihai1991/cpython that referenced this pull request Aug 4, 2020
@rishi93 @shihai1991
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
3c3411b 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
shihai1991 added a commit to shihai1991/cpython that referenced this pull request Aug 20, 2020
@rishi93 @shihai1991
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
ad7df48 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
xzy3 pushed a commit to xzy3/cpython that referenced this pull request Oct 18, 2020
@rishi93 Seth Sims
bpo-39017: Avoid infinite loop in the tarfile module (pythonGH-21454)
f5481db 
Avoid infinite loop when reading specially crafted TAR files using the tarfile module
(CVE-2019-20907).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@encukou encukou

@bcaller bcaller

@ethanfurman ethanfurman

Assignees
No one assigned
Labels
CLA signed
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

None yet

6 participants
@rishi93 @miss-islington @encukou @bedevere-bot @bcaller @the-knights-who-say-ni
You can’t perform that action at this time.