[release-branch.go1.24] archive/tar: set a limit on the size of GNU sparse file 1...

Sparse files in tar archives contain only the non-zero components
of the file. There are several different encodings for sparse
files. When reading GNU tar pax 1.0 sparse files, archive/tar did
not set a limit on the size of the sparse region data. A malicious
archive containing a large number of sparse blocks could cause
archive/tar to read an unbounded amount of data from the archive
into memory.

Since a malicious input can be highly compressable, a small
compressed input could cause very large allocations.

Cap the size of the sparse block data to the same limit used
for PAX headers (1 MiB).

Thanks to Harshit Gupta (Mr HAX) (https://www.linkedin.com/in/iam-harshit-gupta/)
for reporting this issue.

Fixes CVE-2025-58183
For #75677
Fixes #75710

Change-Id: I70b907b584a7b8676df8a149a1db728ae681a770
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2800
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-on: https://go-internal-review.googlesource.com/c/go/+/2967
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/709843
Reviewed-by: Carlos Amedee <carlos@golang.org>
TryBot-Bypass: Michael Pratt <mpratt@google.com>
Auto-Submit: Michael Pratt <mpratt@google.com>

diff --git a/src/archive/tar/common.go b/src/archive/tar/common.go
index 7b3945ff153144b6ef81c83696a3dbba7b57d6ca..ad31bbb64aaa5c631504aa1037d456fade5dff77 100644 (file)
--- a/src/archive/tar/common.go
+++ b/src/archive/tar/common.go
@@ -39,6 +39,7 @@ var (
        errMissData        = errors.New("archive/tar: sparse file references non-existent data")
        errUnrefData       = errors.New("archive/tar: sparse file contains unreferenced data")
        errWriteHole       = errors.New("archive/tar: write non-NUL byte in sparse hole")
+       errSparseTooLong   = errors.New("archive/tar: sparse map too long")
 )
 
 type headerError []string

diff --git a/src/archive/tar/reader.go b/src/archive/tar/reader.go
index 8483fb52a28f66c0bc7f169910785e443f533e23..16ac2f5b17c28b4ec4214bd7ba8be2c2634a333a 100644 (file)
--- a/src/archive/tar/reader.go
+++ b/src/archive/tar/reader.go
@@ -531,12 +531,17 @@ func readGNUSparseMap1x0(r io.Reader) (sparseDatas, error) {
                cntNewline int64
                buf        bytes.Buffer
                blk        block
+               totalSize  int
        )
 
        // feedTokens copies data in blocks from r into buf until there are
        // at least cnt newlines in buf. It will not read more blocks than needed.
        feedTokens := func(n int64) error {
                for cntNewline < n {
+                       totalSize += len(blk)
+                       if totalSize > maxSpecialFileSize {
+                               return errSparseTooLong
+                       }
                        if _, err := mustReadFull(r, blk[:]); err != nil {
                                return err
                        }
@@ -569,8 +574,8 @@ func readGNUSparseMap1x0(r io.Reader) (sparseDatas, error) {
        }
 
        // Parse for all member entries.
-       // numEntries is trusted after this since a potential attacker must have
-       // committed resources proportional to what this library used.
+       // numEntries is trusted after this since feedTokens limits the number of
+       // tokens based on maxSpecialFileSize.
        if err := feedTokens(2 * numEntries); err != nil {
                return nil, err
        }

diff --git a/src/archive/tar/reader_test.go b/src/archive/tar/reader_test.go
index 99340a3047191432f002edf79f833bf23a80a6da..fca53dae741bd51c2e2f7b5b5cfb54335a38f0dc 100644 (file)
--- a/src/archive/tar/reader_test.go
+++ b/src/archive/tar/reader_test.go
@@ -621,6 +621,11 @@ func TestReader(t *testing.T) {
                        },
                        Format: FormatPAX,
                }},
+       }, {
+               // Small compressed file that uncompresses to
+               // a file with a very large GNU 1.0 sparse map.
+               file: "testdata/gnu-sparse-many-zeros.tar.bz2",
+               err:  errSparseTooLong,
        }}
 
        for _, v := range vectors {

diff --git a/src/archive/tar/testdata/gnu-sparse-many-zeros.tar.bz2 b/src/archive/tar/testdata/gnu-sparse-many-zeros.tar.bz2
new file mode 100644 (file)
index 0000000..751d7fd
Binary files /dev/null and b/src/archive/tar/testdata/gnu-sparse-many-zeros.tar.bz2 differ