| ... | @@ -376,7 +376,7 @@ fn Iterator(comptime ReaderType: type) type { | ... | @@ -376,7 +376,7 @@ fn Iterator(comptime ReaderType: type) type { |
| 376 | self.file.link_name = try attr.value(&self.link_name_buffer); | 376 | self.file.link_name = try attr.value(&self.link_name_buffer); |
| 377 | }, | 377 | }, |
| 378 | .size => { | 378 | .size => { |
| 379 | var buf: [64]u8 = undefined; | 379 | var buf: [pax_max_size_attr_len]u8 = undefined; |
| 380 | self.file.size = try std.fmt.parseInt(u64, try attr.value(&buf), 10); | 380 | self.file.size = try std.fmt.parseInt(u64, try attr.value(&buf), 10); |
| 381 | }, | 381 | }, |
| 382 | } | 382 | } |
| ... | @@ -430,6 +430,9 @@ const PaxAttributeKind = enum { | ... | @@ -430,6 +430,9 @@ const PaxAttributeKind = enum { |
| 430 | size, | 430 | size, |
| 431 | }; | 431 | }; |
| 432 | | 432 | |
| | 433 | // maxInt(u64) has 20 chars, base 10 in practice we got 24 chars |
| | 434 | const pax_max_size_attr_len = 64; |
| | 435 | |
| 433 | fn PaxIterator(comptime ReaderType: type) type { | 436 | fn PaxIterator(comptime ReaderType: type) type { |
| 434 | return struct { | 437 | return struct { |
| 435 | size: usize, // cumulative size of all pax attributes | 438 | size: usize, // cumulative size of all pax attributes |
| ... | @@ -486,6 +489,9 @@ fn PaxIterator(comptime ReaderType: type) type { | ... | @@ -486,6 +489,9 @@ fn PaxIterator(comptime ReaderType: type) type { |
| 486 | try validateAttributeEnding(self.reader); | 489 | try validateAttributeEnding(self.reader); |
| 487 | continue; | 490 | continue; |
| 488 | }; | 491 | }; |
| | 492 | if (kind == .size and value_len > pax_max_size_attr_len) { |
| | 493 | return error.PaxSizeAttrOverflow; |
| | 494 | } |
| 489 | return Attribute{ | 495 | return Attribute{ |
| 490 | .kind = kind, | 496 | .kind = kind, |
| 491 | .len = value_len, | 497 | .len = value_len, |
Igor Anić <igor.anic@gmail.com> 2024-02-24 16:22:54+01:00
Andrew Kelley <andrew@ziglang.org> 2024-02-24 13:17:04-08:00