René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Guard against negative offset/length values in tarfile's GNU sparse extraction","articleBody":"# Bug report\n\n### Bug description:\n\n```\nfor i in range(21):\n    try:\n        offset = nti(buf[pos:pos + 12])\n        numbytes = nti(buf[pos + 12:pos + 24])\n    except ValueError:\n        break\n    if offset and numbytes:\n        structs.append((offset, numbytes))\n    pos += 24\n```\n\nhttps://github.com/python/cpython/blob/7040aa54f14676938970e10c5f74ea93cd56aa38/Lib/tarfile.py#L1441\n\n- There is no check that offset or numbytes are non-negative.\n- The check if offset and numbytes: only skips zero, not negative numbers.\n\n\n### validation should be added:\n```\nif offset \u003e= 0 and numbytes \u003e= 0:\n    structs.append((offset, numbytes))\n```\n- This will prevent the addition of invalid sparse mappings, mitigating the risk.\n\n\n### CPython versions tested on:\n\n3.13\n\n### Operating systems tested on:\n\nWindows\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-137805\n* gh-138726\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/VbhvGupta","@type":"Person","name":"VbhvGupta"},"datePublished":"2025-08-04T22:33:12.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":11},"url":"https://github.com/137396/cpython/issues/137396"}