File CVE-2025-13462-tarinfo-header-parse.patch of Package python315
From 861656d8c21d329366e50c5081500d5941ebf566 Mon Sep 17 00:00:00 2001
From: Eashwar Ranganathan <eashwar@eashwar.com>
Date: Tue, 18 Nov 2025 06:12:40 -0500
Subject: [PATCH] gh-141707: Skip TarInfo DIRTYPE normalization during GNU long
name handling
---
Lib/tarfile.py | 29 ++++++++--
Lib/test/test_tarfile.py | 19 ++++++
Misc/ACKS | 1
Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst | 2
4 files changed, 47 insertions(+), 4 deletions(-)
create mode 100644 Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
Index: Python-3.15.0a7/Lib/tarfile.py
===================================================================
--- Python-3.15.0a7.orig/Lib/tarfile.py 2026-03-25 17:39:01.236324898 +0100
+++ Python-3.15.0a7/Lib/tarfile.py 2026-03-25 17:39:16.163869411 +0100
@@ -1276,6 +1276,20 @@
@classmethod
def frombuf(cls, buf, encoding, errors):
"""Construct a TarInfo object from a 512 byte bytes object.
+
+ To support the old v7 tar format AREGTYPE headers are
+ transformed to DIRTYPE headers if their name ends in '/'.
+ """
+ return cls._frombuf(buf, encoding, errors)
+
+ @classmethod
+ def _frombuf(cls, buf, encoding, errors, *, dircheck=True):
+ """Construct a TarInfo object from a 512 byte bytes object.
+
+ If ``dircheck`` is set to ``True`` then ``AREGTYPE`` headers will
+ be normalized to ``DIRTYPE`` if the name ends in a trailing slash.
+ ``dircheck`` must be set to ``False`` if this function is called
+ on a follow-up header such as ``GNUTYPE_LONGNAME``.
"""
if len(buf) == 0:
raise EmptyHeaderError("empty header")
@@ -1306,7 +1320,7 @@
# Old V7 tar format represents a directory as a regular
# file with a trailing slash.
- if obj.type == AREGTYPE and obj.name.endswith("/"):
+ if dircheck and obj.type == AREGTYPE and obj.name.endswith("/"):
obj.type = DIRTYPE
# The old GNU sparse format occupies some of the unused
@@ -1341,8 +1355,15 @@
"""Return the next TarInfo object from TarFile object
tarfile.
"""
+ return cls._fromtarfile(tarfile)
+
+ @classmethod
+ def _fromtarfile(cls, tarfile, *, dircheck=True):
+ """
+ See dircheck documentation in _frombuf().
+ """
buf = tarfile.fileobj.read(BLOCKSIZE)
- obj = cls.frombuf(buf, tarfile.encoding, tarfile.errors)
+ obj = cls._frombuf(buf, tarfile.encoding, tarfile.errors, dircheck=dircheck)
obj.offset = tarfile.fileobj.tell() - BLOCKSIZE
return obj._proc_member(tarfile)
@@ -1400,7 +1421,7 @@
# Fetch the next header and process it.
try:
- next = self.fromtarfile(tarfile)
+ next = self._fromtarfile(tarfile, dircheck=False)
except HeaderError as e:
raise SubsequentHeaderError(str(e)) from None
@@ -1535,7 +1556,7 @@
# Fetch the next header.
try:
- next = self.fromtarfile(tarfile)
+ next = self._fromtarfile(tarfile, dircheck=False)
except HeaderError as e:
raise SubsequentHeaderError(str(e)) from None
Index: Python-3.15.0a7/Lib/test/test_tarfile.py
===================================================================
--- Python-3.15.0a7.orig/Lib/test/test_tarfile.py 2026-03-25 17:39:03.781257203 +0100
+++ Python-3.15.0a7/Lib/test/test_tarfile.py 2026-03-25 17:39:16.165749330 +0100
@@ -1234,6 +1234,25 @@
self.assertIsNotNone(tar.getmember(longdir))
self.assertIsNotNone(tar.getmember(longdir.removesuffix('/')))
+ def test_longname_file_not_directory(self):
+ # Test reading a longname file and ensure it is not handled as a directory
+ # Issue #141707
+ buf = io.BytesIO()
+ with tarfile.open(mode='w', fileobj=buf, format=self.format) as tar:
+ ti = tarfile.TarInfo()
+ ti.type = tarfile.AREGTYPE
+ ti.name = ('a' * 99) + '/' + ('b' * 3)
+ tar.addfile(ti)
+
+ expected = {t.name: t.type for t in tar.getmembers()}
+
+ buf.seek(0)
+ with tarfile.open(mode='r', fileobj=buf) as tar:
+ actual = {t.name: t.type for t in tar.getmembers()}
+
+ self.assertEqual(expected, actual)
+
+
class GNUReadTest(LongnameTest, ReadTest, unittest.TestCase):
subdir = "gnu"
Index: Python-3.15.0a7/Misc/ACKS
===================================================================
--- Python-3.15.0a7.orig/Misc/ACKS 2026-03-10 13:31:15.000000000 +0100
+++ Python-3.15.0a7/Misc/ACKS 2026-03-25 17:39:16.166294347 +0100
@@ -1557,6 +1557,7 @@
Jeff Ramnani
Grant Ramsay
Bayard Randel
+Eashwar Ranganathan
Varpu Rantala
Brodie Rao
Rémi Rampin
Index: Python-3.15.0a7/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ Python-3.15.0a7/Misc/NEWS.d/next/Library/2025-11-18-06-35-53.gh-issue-141707.DBmQIy.rst 2026-03-25 17:39:16.166510375 +0100
@@ -0,0 +1,2 @@
+Don't change :class:`tarfile.TarInfo` type from ``AREGTYPE`` to ``DIRTYPE`` when parsing
+GNU long name or link headers.
