Skip to content

Incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined #141707

Closed
Closed
Incorrect parsing of TarInfo header when GNU long name and type AREGTYPE are combined#141707
Labels
stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

Description

@e-nomem
e-nomem
opened on Nov 18, 2025

Bug report

Bug description:

When an entry uses GNU long name encoding the tarfile module reads in the data blocks for the name and then calls self.fromtarfile() again to get the 'actual' header. This second header is the source of truth for everything except the name which is just garbage data.

The problem is that fromtarfile() eventually calls frombuf() where this logic incorrectly uses the garbage data and overrides the entry type to directory, corrupting the entry.

Because the entry is detected as a directory, the offset is not updated properly and the next call to read a TarInfo entry will usually result in an exception. However, the exception lands up in this block where neither of the if conditions are met, so the exception is silently discarded. tarinfo remains None and the code eventually decides that there are no more entries in the tar file.

I initially ran into this issue due to reports of invalid sdists being generated by maturin.
See: PyO3/maturin#2855

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14

Operating systems tested on:

macOS, Linux

Linked PRs

Activity

  1. e-nomem
    added
    type-bugAn unexpected behavior, bug, or error
    on Nov 18, 2025
  2. messense
    added a commit that references this issue on Nov 18, 2025

    Set entry type when adding to the tar file (#2859)

    5e42853
  3. StanFromIreland
    added
    stdlibStandard Library Python modules in the Lib/ directory
    on Nov 18, 2025
  4. StanFromIreland
    added this to Tarfile issues 🗄️on Nov 18, 2025
  5. messense
    added a commit that references this issue on Nov 19, 2025

    Set entry type when adding to the tar file (#2859)

    10c977d

  6. konstin commented on Dec 11, 2025

    @konstin
    konstin
    on Dec 11, 2025
    Contributor

    uv is affected by this too: astral-sh/uv#17043

  7. heathdutton
    added 2 commits that reference this issue on Dec 24, 2025

    pythongh-141707: Fix tarfile type corruption with GNU long names

    8e61d0b

    pythongh-141707: Fix tarfile type corruption with GNU long names

    5186da2
  8. sethmlarson
    added
    type-securityA security issue
    on Jan 16, 2026
  9. sethmlarson
    added a commit that references this issue on Jan 16, 2026

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    861656d
  10. sethmlarson
    added a commit that references this issue on Mar 11, 2026

    gh-141707: Skip TarInfo DIRTYPE normalization during GNU long name ha…

    42d754e
  11. miss-islington
    added 4 commits that reference this issue on Mar 11, 2026

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    4c5d0c7

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    8ce97a5

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    0540c4e

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    548d5f4

  12. 1 remaining item

  13. encukou
    added 2 commits that reference this issue on Mar 17, 2026

    [3.14] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long …

    7ad3093

    [3.13] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long …

    ae99fe3
  14. ljfp
    added a commit that references this issue on Apr 25, 2026

    pythongh-141707: Skip TarInfo DIRTYPE normalization during GNU long n…

    bb83f8c
  15. pablogsal
    added 2 commits that reference this issue on Apr 30, 2026

    [3.11] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long …

    9a23b75

    [3.10] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long …

    72dde10
  16. Yhg1s
    added a commit that references this issue on May 18, 2026

    [3.12] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long …

    d109507
  17. StanFromIreland
    closed this as completedon Jun 6, 2026
  18. github-project-automation
    moved this to Done in Tarfile issues 🗄️on Jun 6, 2026
  19. arnout
    added a commit that references this issue on Aug 14, 2026

    package/python3: security bump to v3.12.14

    80251a0
  20. mcepl
    added 3 commits that reference this issue on Sep 18, 2026

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    f924021

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    f9993e9

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    2ff8925
  21. mcepl
    added 3 commits that reference this issue on Oct 1, 2026

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    9bcd825

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    55d5e00

    [CVE-2025-13462] Skip TarInfo DIRTYPE normalization during GNU long n…

    e7e390f
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    stdlibStandard Library Python modules in the Lib/ directorytype-bugAn unexpected behavior, bug, or errortype-securityA security issue

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions