authorgravatar for igor.anic@gmail.comIgor Anić <igor.anic@gmail.com> 2024-02-23 21:57:40+01:00
committergravatar for igor.anic@gmail.comIgor Anić <igor.anic@gmail.com> 2024-02-23 21:57:40+01:00
log0a86b117bf0a29b4996592d6ad29c46833ae44c9
treeee435f7780ba3b22238706e4ee8f383848e51d89
parentf67aa8b9b3cefddddf477850b8d8bffd3c8c26e4

std.tar fix integer overflow in header size parse

Found by fuzzing. Fixing code and adding test.

1 files changed, 2 insertions(+), 1 deletions(-)

lib/std/tar.zig+2-1
......@@ -155,7 +155,7 @@ pub const Header = struct {
155155 // If the leading byte is 0x80 (128), the non-leading bytes of the
156156 // field are concatenated in big-endian order.
157157 if (raw[0] == 0x80) {
158 if (raw[1] + raw[2] + raw[3] != 0) return error.TarNumericValueTooBig;
158 if (raw[1] != 0 or raw[2] != 0 or raw[3] != 0) return error.TarNumericValueTooBig;
159159 return std.mem.readInt(u64, raw[4..12], .big);
160160 }
161161 return try header.octal(start, len);
......@@ -769,6 +769,7 @@ test "tar header parse size" {
769769 .{ .in = "\x80\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08", .want = 0x0102030405060708 },
770770 .{ .in = "\x80\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09", .err = error.TarNumericValueTooBig },
771771 .{ .in = "\x80\x00\x00\x00\x07\x76\xa2\x22\xeb\x8a\x72\x61", .want = 537795476381659745 },
772 .{ .in = "\x80\x80\x80\x00\x01\x02\x03\x04\x05\x06\x07\x08", .err = error.TarNumericValueTooBig },
772773
773774 // // Test base-8 (octal) encoded values.
774775 .{ .in = "00000000227\x00", .want = 0o227 },