GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-153636: Raise InvalidHeaderError for malformed GNU sparse pax numbers in tarfile by tonghuaroot · Pull Request #153637 · python/cpython

Conversation

@tonghuaroot

@tonghuaroot tonghuaroot commented Jul 13, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

A malformed GNU sparse number in a pax extended header leaked a bare ValueError from _proc_gnusparse_01, _proc_gnusparse_10, and the GNU.sparse.size/realsize branches, unlike the GNU sparse 0.0 handler. Raise InvalidHeaderError from those sites, giving the GNU sparse family one behavior on a corrupt header.

  • Issue: tarfile leaks ValueError instead of InvalidHeaderError for a malformed GNU sparse pax number #153636

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@tonghuaroot
pythongh-153636: Raise InvalidHeaderError for malformed GNU sparse pa…
3dd9d15
…x numbers in tarfile

When a pax extended header carried a malformed GNU sparse number, tarfile
parsed it with a bare int() and let the resulting ValueError escape to the
caller from _proc_gnusparse_01, _proc_gnusparse_10, and the GNU.sparse.size
and GNU.sparse.realsize branches of _apply_pax_info, unlike the GNU sparse
0.0 handler which already reports such corruption as InvalidHeaderError. Wrap
those conversions so a bad number raises tarfile.InvalidHeaderError, which the
reader treats as end of archive, giving the whole GNU sparse family
consistent behavior on a corrupt header.
@tonghuaroot
tonghuaroot requested a review from ethanfurman as a code owner July 13, 2026 01:09
@bedevere-app bedevere-app Bot mentioned this pull request Jul 13, 2026
tarfile leaks ValueError instead of InvalidHeaderError for a malformed GNU sparse pax number #153636
Open
@bedevere-app bedevere-app Bot added the awaiting review label Jul 13, 2026
tonghuaroot added 2 commits July 13, 2026 09:49
@tonghuaroot
Trim the test comments
bb12234
@tonghuaroot
Fix NEWS cross-reference for InvalidHeaderError
4713aa7
@github-actions

github-actions Bot commented Oct 18, 2026

Copy link
Copy Markdown

This PR is stale because it has been open for 90 days with no activity.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@github-actions github-actions Bot added the stale Stale PR or inactive for long period of time. label Oct 18, 2026
@ptim0626 ptim0626 mentioned this pull request Nov 7, 2026
Incomplete extraction of tar archive with invalid global PAX header 'size' in tarfile #161588
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

awaiting review stale Stale PR or inactive for long period of time.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

1 participant

@tonghuaroot
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.