|
| 1 | +From 0bd8354eb316bc25cc698e276be032ba4ceca855 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Damien Neil <dneil@google.com> |
| 3 | +Date: Mon, 23 Mar 2026 13:12:44 -0700 |
| 4 | +Subject: [PATCH] archive/tar: limit the number of old GNU sparse format |
| 5 | + entries |
| 6 | + |
| 7 | +We did not set a limit on the maximum size of sparse maps in |
| 8 | +the old GNU sparse format. Set a limit based on the cumulative |
| 9 | +size of the extension blocks used to encode the map (consistent |
| 10 | +with how we limit the sparse map size for other formats). |
| 11 | + |
| 12 | +Add an additional limit to the total number of sparse file entries, |
| 13 | +regardless of encoding, to all sparse formats. |
| 14 | + |
| 15 | +Thanks to Colin Walters (walters@verbum.org), |
| 16 | +Uuganbayar Lkhamsuren (https://github.com/uug4na), |
| 17 | +and Jakub Ciolek for reporting this issue. |
| 18 | + |
| 19 | +Fixes #78301 |
| 20 | +Fixes CVE-2026-32288 |
| 21 | + |
| 22 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 23 | +Upstream Patch reference: https://github.com/golang/go/commit/82b0cdb7411ea2cf02d3a45e6983cc7c8c009d9e |
| 24 | +--- |
| 25 | + .../vbatts/tar-split/archive/tar/format.go | 6 ++++ |
| 26 | + .../vbatts/tar-split/archive/tar/reader.go | 28 ++++++++++++++++--- |
| 27 | + 2 files changed, 30 insertions(+), 4 deletions(-) |
| 28 | + |
| 29 | +diff --git a/vendor/github.com/vbatts/tar-split/archive/tar/format.go b/vendor/github.com/vbatts/tar-split/archive/tar/format.go |
| 30 | +index 6097798..6f31845 100644 |
| 31 | +--- a/vendor/github.com/vbatts/tar-split/archive/tar/format.go |
| 32 | ++++ b/vendor/github.com/vbatts/tar-split/archive/tar/format.go |
| 33 | +@@ -147,6 +147,12 @@ const ( |
| 34 | + // Max length of a special file (PAX header, GNU long name or link). |
| 35 | + // This matches the limit used by libarchive. |
| 36 | + maxSpecialFileSize = 1 << 20 |
| 37 | ++ |
| 38 | ++ // Maximum number of sparse file entries. |
| 39 | ++ // We should never actually hit this limit |
| 40 | ++ // (every sparse encoding will first be limited by maxSpecialFileSize), |
| 41 | ++ // but this adds an additional layer of defense. |
| 42 | ++ maxSparseFileEntries = 1 << 20 |
| 43 | + ) |
| 44 | + |
| 45 | + // blockPadding computes the number of bytes needed to pad offset up to the |
| 46 | +diff --git a/vendor/github.com/vbatts/tar-split/archive/tar/reader.go b/vendor/github.com/vbatts/tar-split/archive/tar/reader.go |
| 47 | +index bea60e9..8573499 100644 |
| 48 | +--- a/vendor/github.com/vbatts/tar-split/archive/tar/reader.go |
| 49 | ++++ b/vendor/github.com/vbatts/tar-split/archive/tar/reader.go |
| 50 | +@@ -532,7 +532,8 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err |
| 51 | + } |
| 52 | + s := blk.GNU().Sparse() |
| 53 | + spd := make(sparseDatas, 0, s.MaxEntries()) |
| 54 | +- for { |
| 55 | ++ totalSize := len(s) |
| 56 | ++ for totalSize < maxSpecialFileSize { |
| 57 | + for i := 0; i < s.MaxEntries(); i++ { |
| 58 | + // This termination condition is identical to GNU and BSD tar. |
| 59 | + if s.Entry(i).Offset()[0] == 0x00 { |
| 60 | +@@ -543,7 +544,11 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err |
| 61 | + if p.err != nil { |
| 62 | + return nil, p.err |
| 63 | + } |
| 64 | +- spd = append(spd, sparseEntry{Offset: offset, Length: length}) |
| 65 | ++ var err error |
| 66 | ++ spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length}) |
| 67 | ++ if err != nil { |
| 68 | ++ return nil, err |
| 69 | ++ } |
| 70 | + } |
| 71 | + |
| 72 | + if s.IsExtended()[0] > 0 { |
| 73 | +@@ -555,10 +560,12 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err |
| 74 | + tr.rawBytes.Write(blk[:]) |
| 75 | + } |
| 76 | + s = blk.Sparse() |
| 77 | ++ totalSize += len(s) |
| 78 | + continue |
| 79 | + } |
| 80 | + return spd, nil // Done |
| 81 | + } |
| 82 | ++ return nil, errSparseTooLong |
| 83 | + } |
| 84 | + |
| 85 | + // readGNUSparseMap1x0 reads the sparse map as stored in GNU's PAX sparse format |
| 86 | +@@ -632,7 +639,10 @@ func readGNUSparseMap1x0(r io.Reader) (sparseDatas, error) { |
| 87 | + if err1 != nil || err2 != nil { |
| 88 | + return nil, ErrHeader |
| 89 | + } |
| 90 | +- spd = append(spd, sparseEntry{Offset: offset, Length: length}) |
| 91 | ++ spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length}) |
| 92 | ++ if err != nil { |
| 93 | ++ return nil, err |
| 94 | ++ } |
| 95 | + } |
| 96 | + return spd, nil |
| 97 | + } |
| 98 | +@@ -666,12 +676,22 @@ func readGNUSparseMap0x1(paxHdrs map[string]string) (sparseDatas, error) { |
| 99 | + if err1 != nil || err2 != nil { |
| 100 | + return nil, ErrHeader |
| 101 | + } |
| 102 | +- spd = append(spd, sparseEntry{Offset: offset, Length: length}) |
| 103 | ++ spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length}) |
| 104 | ++ if err != nil { |
| 105 | ++ return nil, err |
| 106 | ++ } |
| 107 | + sparseMap = sparseMap[2:] |
| 108 | + } |
| 109 | + return spd, nil |
| 110 | + } |
| 111 | + |
| 112 | ++func appendSparseEntry(spd sparseDatas, ent sparseEntry) (sparseDatas, error) { |
| 113 | ++ if len(spd) >= maxSparseFileEntries { |
| 114 | ++ return nil, errSparseTooLong |
| 115 | ++ } |
| 116 | ++ return append(spd, ent), nil |
| 117 | ++} |
| 118 | ++ |
| 119 | + // Read reads from the current file in the tar archive. |
| 120 | + // It returns (0, io.EOF) when it reaches the end of that file, |
| 121 | + // until Next is called to advance to the next file. |
| 122 | +-- |
| 123 | +2.45.4 |
| 124 | + |
0 commit comments