Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detect UStar tar archives #308

Merged
merged 2 commits into from
Jul 18, 2022

Conversation

chrisnovakovic
Copy link
Contributor

@chrisnovakovic chrisnovakovic commented Jul 13, 2022

UStar tar archives have a magic header field at byte offset 257 in each entry whose value begins with the string ustar. Identify them with the MIME type application/x-tar.

Also add test cases for a number of UStar-compatible formats, created by GNU tar 1.29 (with --format=<format-name>):

  • tar.gnu.tar
  • tar.oldgnu.tar
  • tar.posix.tar
  • tar.ustar.tar

as well as tar.star.tar (created by star 1.6) and, for completeness, tar.v7-gnu.tar (a v7 tar archive created by GNU tar 1.29).

Fixes #307.

UStar tar archives have a `magic` header field at byte offset 257 in
each entry whose value begins with the string `ustar`. Identify them
with the MIME type `application/x-tar`.

Also add test cases for a number of UStar-compatible formats, created by
GNU tar 1.29 (with `--format=<format-name>`):

* `tar.gnu.tar`
* `tar.oldgnu.tar`
* `tar.posix.tar`
* `tar.ustar.tar`

as well as `tar.star.tar` (created by star 1.6) and, for completeness,
`tar.v7-gnu.tar` (a v7 tar archive created by GNU tar 1.29).

Fixes gabriel-vasile#307.
@codecov-commenter
Copy link

Codecov Report

Merging #308 (bc2b8c3) into master (e59e9d7) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #308   +/-   ##
=======================================
  Coverage   94.96%   94.96%           
=======================================
  Files           3        3           
  Lines         159      159           
=======================================
  Hits          151      151           
  Misses          6        6           
  Partials        2        2           

📣 Codecov can now indicate which changes are the most critical in Pull Requests. Learn more

Copy link
Owner

@gabriel-vasile gabriel-vasile left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like fuzzing found a problem.

@chrisnovakovic
Copy link
Contributor Author

Good catch 🙂 There's now a more sensible bounds check in place - the UStar format detection is now only performed if the buffer is long enough to store a (512-byte) UStar header. I've kept the old 256-byte length check because that's still relevant for the v7 format detection.

Copy link
Owner

@gabriel-vasile gabriel-vasile left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good.

@gabriel-vasile gabriel-vasile merged commit 98f3091 into gabriel-vasile:master Jul 18, 2022
alecthomas added a commit to cashapp/hermit that referenced this pull request Oct 10, 2022
alecthomas added a commit to cashapp/hermit that referenced this pull request Oct 10, 2022
kodiakhq bot referenced this pull request in cloudquery/cloudquery Apr 1, 2023
…#9604)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/gabriel-vasile/mimetype](https://togithub.com/gabriel-vasile/mimetype) | indirect | patch | `v1.4.1` -> `v1.4.2` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>gabriel-vasile/mimetype</summary>

### [`v1.4.2`](https://togithub.com/gabriel-vasile/mimetype/releases/tag/v1.4.2)

[Compare Source](https://togithub.com/gabriel-vasile/mimetype/compare/v1.4.1...v1.4.2)

#### What's Changed

-   Improve mov detection; closes [#&#8203;302](https://togithub.com/gabriel-vasile/mimetype/issues/302) by [@&#8203;gabriel-vasile](https://togithub.com/gabriel-vasile) in [https://github.com/gabriel-vasile/mimetype/pull/304](https://togithub.com/gabriel-vasile/mimetype/pull/304)
-   \[codespell] Fix typos. by [@&#8203;mdosch](https://togithub.com/mdosch) in [https://github.com/gabriel-vasile/mimetype/pull/303](https://togithub.com/gabriel-vasile/mimetype/pull/303)
-   Detect UStar tar archives by [@&#8203;chrisnovakovic](https://togithub.com/chrisnovakovic) in [https://github.com/gabriel-vasile/mimetype/pull/308](https://togithub.com/gabriel-vasile/mimetype/pull/308)
-   add jxr support [#&#8203;155](https://togithub.com/gabriel-vasile/mimetype/issues/155) by [@&#8203;dijotmathews](https://togithub.com/dijotmathews) in [https://github.com/gabriel-vasile/mimetype/pull/312](https://togithub.com/gabriel-vasile/mimetype/pull/312)
-   Added support for JXS file format by [@&#8203;V-R-Dighe](https://togithub.com/V-R-Dighe) in [https://github.com/gabriel-vasile/mimetype/pull/319](https://togithub.com/gabriel-vasile/mimetype/pull/319)
-   Bump golang.org/x/net from 0.7.0 to 0.8.0 by [@&#8203;dependabot](https://togithub.com/dependabot) in [https://github.com/gabriel-vasile/mimetype/pull/367](https://togithub.com/gabriel-vasile/mimetype/pull/367)

#### New Contributors

-   [@&#8203;mdosch](https://togithub.com/mdosch) made their first contribution in [https://github.com/gabriel-vasile/mimetype/pull/303](https://togithub.com/gabriel-vasile/mimetype/pull/303)
-   [@&#8203;chrisnovakovic](https://togithub.com/chrisnovakovic) made their first contribution in [https://github.com/gabriel-vasile/mimetype/pull/308](https://togithub.com/gabriel-vasile/mimetype/pull/308)
-   [@&#8203;dijotmathews](https://togithub.com/dijotmathews) made their first contribution in [https://github.com/gabriel-vasile/mimetype/pull/312](https://togithub.com/gabriel-vasile/mimetype/pull/312)
-   [@&#8203;V-R-Dighe](https://togithub.com/V-R-Dighe) made their first contribution in [https://github.com/gabriel-vasile/mimetype/pull/319](https://togithub.com/gabriel-vasile/mimetype/pull/319)

**Full Changelog**: gabriel-vasile/mimetype@v1.4.1...v1.4.2

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "before 3am on the first day of the month" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://togithub.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNC4xNTQuMCIsInVwZGF0ZWRJblZlciI6IjM0LjE1NC4wIn0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

tar archives with large UIDs/GIDs not detected
3 participants