Description

tonghuaroot

opened on Jul 13, 2026

Issue body actions

Bug description:

When a pax extended header carries a malformed GNU sparse number, tarfile parses it with a bare int() and lets the ValueError escape to the caller, unlike the GNU sparse 0.0 handler which reports such corruption as tarfile.InvalidHeaderError.

import tarfile
tarfile.TarInfo("x")._apply_pax_info(
    {"GNU.sparse.size": "x"}, "utf-8", "strict")   # ValueError

Reporting InvalidHeaderError makes the reader stop at the bad member like the 0.0 format does; a maintainer may prefer to raise instead, so the direction is open.

CPython versions tested on:

3.13, 3.14, 3.15

Operating systems tested on:

macOS

Linked PRs

• gh-153636: Raise InvalidHeaderError for malformed GNU sparse pax numbers in tarfile #153637

Activity

1. aisk

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory

   on Jul 13, 2026
2. aisk

   added this to Tarfile issues 🗄️on Jul 13, 2026
3. fedonman commented on Jul 18, 2026

   

   fedonman

   on Jul 18, 2026

   Contributor

   More actions

   While looking at this I noticed the same method has a closely related case that PR #153637 leaves untouched: the PAX_NUMBER_FIELDS block just below the GNU sparse handling.

   if keyword in PAX_NUMBER_FIELDS:
       try:
           value = PAX_NUMBER_FIELDS[keyword](value)
       except ValueError:
           value = 0
   

   A non-numeric size, uid, gid or mtime in a pax header is silently coerced to 0 instead of being reported. It is
   the same shape of bug as the GNU sparse one, in the same method, and raise InvalidHeaderError("invalid header")
   fits it just as well and matches what nti() already does. Like the sparse 0.0 case, in the common per-file header
   path the reader would just stop at the bad member rather than raise loudly, so it stays consistent with the
   rest.

   Happy to fold this into your PR or send a small follow-up, whichever you prefer.

Issue actions