Skip to content

gh-130577: tarfile now validates archives to ensure member offsets are non-negative #137027

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Jul 28, 2025
+162 −0
Merged

gh-130577: tarfile now validates archives to ensure member offsets are non-negative #137027

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
235f9d4
gh-130577: tarfile now validates archives to ensure member offsets ar…
aeurielesn Jul 22, 2025
04fd085
Typo
aeurielesn Jul 25, 2025
6d79444
move credit to NEWS, and remove the whatsnew entry (painful for backp…
gpshead Jul 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
move credit to NEWS, and remove the whatsnew entry (painful for backp… 
…orts)
  • Loading branch information
@gpshead @aeurielesn
gpshead authored and aeurielesn committed Jul 26, 2025
commit 6d794444416f44da7230b47a46fe5966f9533cba
2 changes: 0 additions & 2 deletions Doc/whatsnew/3.15.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -310,8 +310,6 @@ tarfile
:func:`~tarfile.TarFile.errorlevel` is zero.
(Contributed by Matt Prodani and Petr Viktorin in :gh:`112887`
and :cve:`2025-4435`.)
* :mod:`tarfile` now validates archives to ensure member offsets are non-negative.
(Contributed by Alexander Enrique Urieles Nieto in :gh:`130577`.)


types
Expand Down
3 changes: 2 additions & 1 deletion Misc/NEWS.d/next/Library/2025-07-23-00-35-29.gh-issue-130577.c7EITy.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,3 @@
:mod:`tarfile` now validates archives to ensure member offsets are
non-negative.
non-negative. (Contributed by Alexander Enrique Urieles Nieto in
:gh:`130577`.)
Loading
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy