8000 gh-121285: Remove backtracking when parsing tarfile headers by sethmlarson · Pull Request #121286 · python/cpython · GitHub
[go: up one dir, main page]
Skip to content

gh-121285: Remove backtracking when parsing tarfile headers #121286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 11 commits into from
Aug 31, 2024
Merged

gh-121285: Remove backtracking when parsing tarfile headers #121286

merged 11 commits into from
Aug 31, 2024

Conversation

sethmlarson
Copy link
Contributor
@sethmlarson sethmlarson commented Jul 2, 2024 •
edited by bedevere-app bot
Loading

This removes all instances of backtracking from parsing tarfile headers, specifically hdrcharset, PAX, and GNU sparse headers.

@sethmlarson sethmlarson requested a review from ethanfurman as a code owner July 2, 2024 18:40
@bedevere-app bedevere-app bot mentioned this pull request Jul 2, 2024
Closed
@sethmlarson @Eclips4
Update Misc/NEWS.d/next/Security/2024-07-02-13-39-20.gh-issue-121285.…
647f4ef 
…hrl-yI.rst

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
@sethmlarson sethmlarson requested a review from gpshead July 2, 2024 18:45
@sethmlarson sethmlarson added type-security A security issue 3.11 only security fixes 3.10 only security fixes 3.9 only security fixes 3.8 (EOL) end of life 3.12 only security fixes labels Jul 2, 2024
@hugovk
Copy link
Member
hugovk commented Jul 2, 2024

@sethmlarson Did you mean to add the "Needs backport to 3.x" labels rather than the "3.x" ones?

@sethmlarson sethmlarson added needs backport to 3.8 needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes and removed 3.11 only security fixes 3.10 only security fixes 3.9 only security fixes 3.8 (EOL) end of life 3.12 only security fixes labels Jul 2, 2024
@sethmlarson
Copy link
Contributor Author

@hugovk Yes! Selected the wrong range of tags, my bad.

ethanfurman
ethanfurman requested changes Jul 2, 2024
View reviewed changes
Copy link
Member
@ethanfurman ethanfurman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the type hints.

@bedevere-app
Copy link
bedevere-app bot commented Jul 2, 2024

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] pythongh-121285: Remove backtracking when parsing tarfile head…
b743113 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link
bedevere-app bot commented Sep 3, 2024

GH-123639 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Sep 3, 2024
@bedevere-app
Copy link
bedevere-app bot commented Sep 3, 2024

GH-123639 is a backport of this pull request to the 3.11 branch.

sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] pythongh-121285: Remove backtracking when parsing tarfile head…
3ea4396 
…ers (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link
bedevere-app bot commented Sep 3, 2024

GH-123640 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] pythongh-121285: Remove backtracking when parsing tarfil 8000 e heade…
daf223e 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link
bedevere-app bot commented Sep 3, 2024

GH-123641 is a backport of this pull request to the 3.9 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.9 only security fixes label Sep 3, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] pythongh-121285: Remove backtracking when parsing tarfile heade…
80b31d4 
…rs (pythonGH-121286)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link
bedevere-app bot commented Sep 3, 2024

GH-123642 is a backport of this pull request to the 3.8 branch.

@sethmlarson
Copy link
Contributor Author

Backports have been created.

pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.11] gh-121285: Remove backtracking when parsing tarfile headers (G…
d449caf 
…H-121286) (#123639)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
pablogsal pushed a commit that referenced this pull request Sep 3, 2024
@sethmlarson @Eclips4 @gpshead
[3.10] gh-121285: Remove backtracking when parsing tarfile headers (G…
743acbe 
…H-121286) (#123640)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.8] gh-121285: Remove backtracking when parsing tarfile headers (GH…
7d1f50c 
…-121286) (#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
ambv pushed a commit that referenced this pull request Sep 4, 2024
@sethmlarson @Eclips4 @gpshead
[3.9] gh-121285: Remove backtracking when parsing tarfile headers (GH…
b4225ca 
…-121286) (#123641)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
182d6ca 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
@frenzymadness frenzymadness mentioned this pull request Sep 5, 2024
Merged
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Sep 5, 2024
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: [3.8] pythongh-121285: Remove backtracking when parsing tarfil…
3209abb 
…e headers (pythonGH-121286) (python#123642)

* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <seth@python.org>
Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
rickprice added a commit to ActiveState/cpython that referenced this pull request May 6, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
1b14072 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 9, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
792ad47 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
6eab8d7 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
11ad615 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 10, 2025
@rickprice
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
2ba202c 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request May 14, 2025
@rickprice @icanhasmath
CVE-2024-5262 Remove backtracking when parsing tarfile headers (pytho…
2fca073 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 15, 2025
@rickprice
CVE-2024-6232 Remove backtracking when parsing tarfile headers (pytho…
8ead5b7 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
rickprice added a commit to ActiveState/cpython that referenced this pull request May 15, 2025
@rickprice
CVE-2024-6232 Remove backtracking when parsing tarfile headers (pytho…
a6afb3c 
…nGH-121286)

Patched from:
https://github.com/python/cpython/commit/7d1f50cd92ff7e10a1c15a8f591dde8a6843a64d.patch
Had one reject, hand updated it.
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@personnumber3377 personnumber3377 personnumber3377 left review comments

@Eclips4 Eclips4 Eclips4 left review comments

@gpshead gpshead gpshead approved these changes

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

@serhiy-storchaka serhiy-storchaka Awaiting requested review from serhiy-storchaka

Assignees

@gpshead gpshead

Labels
type-security A security issue
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@sethmlarson @hugovk @ethanfurman @gpshead @serhiy-storchaka @personnumber3377 @Eclips4
0