authorgravatar for igor.anic@gmail.comIgor Anić <igor.anic@gmail.com> 2024-02-24 16:22:54+01:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-02-24 13:17:04-08:00
log8d651f512bf5032e1255dd66750faff0152e2f84
tree799f41ae576ce4bf25bf0e3384db25e22ce99947
parent3eacd1b2e56728a291b4e5dc443a56fa0b4cab14

std.tar fix assert exploited by fuzzing

3 files changed, 11 insertions(+), 1 deletions(-)

lib/std/tar.zig+7-1
......@@ -376,7 +376,7 @@ fn Iterator(comptime ReaderType: type) type {
376376 self.file.link_name = try attr.value(&self.link_name_buffer);
377377 },
378378 .size => {
379 var buf: [64]u8 = undefined;
379 var buf: [pax_max_size_attr_len]u8 = undefined;
380380 self.file.size = try std.fmt.parseInt(u64, try attr.value(&buf), 10);
381381 },
382382 }
......@@ -430,6 +430,9 @@ const PaxAttributeKind = enum {
430430 size,
431431};
432432
433// maxInt(u64) has 20 chars, base 10 in practice we got 24 chars
434const pax_max_size_attr_len = 64;
435
433436fn PaxIterator(comptime ReaderType: type) type {
434437 return struct {
435438 size: usize, // cumulative size of all pax attributes
......@@ -486,6 +489,9 @@ fn PaxIterator(comptime ReaderType: type) type {
486489 try validateAttributeEnding(self.reader);
487490 continue;
488491 };
492 if (kind == .size and value_len > pax_max_size_attr_len) {
493 return error.PaxSizeAttrOverflow;
494 }
489495 return Attribute{
490496 .kind = kind,
491497 .len = value_len,
lib/std/tar/test.zig+4
......@@ -317,6 +317,10 @@ test "tar run Go test cases" {
317317 .data = @embedFile("testdata/fuzz1.tar"),
318318 .err = error.TarCorruptInput,
319319 },
320 .{
321 .data = @embedFile("testdata/fuzz2.tar"),
322 .err = error.PaxSizeAttrOverflow,
323 },
320324 };
321325
322326 for (cases) |case| {
lib/std/tar/testdata/fuzz2.tar created
Binary files /dev/null and b/lib/std/tar/testdata/fuzz2.tar differ