GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — 00437: [3.8] gh-121285: Remove backtracking when parsing tarfile head… by frenzymadness · Pull Request #87 · fedora-python/cpython

Conversation

@frenzymadness

@frenzymadness frenzymadness commented Sep 5, 2024

Copy link
Copy Markdown
Member

…ers (pythonGH-121286) (python#123642)

  • Remove backtracking when parsing tarfile headers
  • Rewrite PAX header parsing to be stricter
  • Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@frenzymadness
frenzymadness force-pushed the fedora-3.6-tarfile branch from 182d6ca to 3209abb Compare September 5, 2024 12:23
@frenzymadness

frenzymadness commented Sep 5, 2024

Copy link
Copy Markdown
Member Author

I had to remove one usage of the walrus operator to make the patch work.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hroncok

hroncok commented Sep 5, 2024

Copy link
Copy Markdown
Member

Could you please remove the 3.8 bit from the commit message? It is kinda confusing.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@stratakis

stratakis commented Sep 5, 2024

Copy link
Copy Markdown
Member

I would rewrite the commit message something like 00437: CVE-2024-6232 Remove backtracking when parsing tarfile headers
hroncok reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@frenzymadness
frenzymadness force-pushed the fedora-3.6-tarfile branch from 3209abb to 7f22d2a Compare September 5, 2024 20:18
@sethmlarson @Eclips4
@gpshead @frenzymadness
00437: CVE-2024-6232 Remove backtracking when parsing tarfile headers
7f22d2a 
* Remove backtracking when parsing tarfile headers
* Rewrite PAX header parsing to be stricter
* Optimize parsing of GNU extended sparse headers v0.0

(cherry picked from commit 34ddb64)

Co-authored-by: Seth Michael Larson <[email protected]>
Co-authored-by: Kirill Podoprigora <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
@frenzymadness

frenzymadness commented Sep 5, 2024

Copy link
Copy Markdown
Member Author

Fixed and reflected everywhere.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@frenzymadness

frenzymadness commented Nov 4, 2024

Copy link
Copy Markdown
Member Author

This PR completely slipped out of my radar. The fix is already delivered in all Fedora releases so I'm going to merge this as well and add a proper tag.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@frenzymadness
frenzymadness merged commit 05f8c58 into fedora-python:fedora-3.6 Nov 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@frenzymadness @hroncok @stratakis @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.