Fix two crashes when reading invalid pax headers
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 889d312..402f3d5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+## 1.0.3
+
+- Fix the reader throwing a `FormatException` (instead of a `TarException`)
+ when reading tar files with invalid UTF bytes in their PAX headers.
+- Fix a range error for invalid zero-length PAX entries.
+
## 1.0.2
- Fix a few typos in documentation comments.
diff --git a/lib/src/reader.dart b/lib/src/reader.dart
index 3148a65..d7cc33c 100644
--- a/lib/src/reader.dart
+++ b/lib/src/reader.dart
@@ -730,6 +730,18 @@
Never error() => throw TarException.header('Invalid PAX record');
+ String decodeString(
+ List<int> data, int start, int end, bool allowMalformed) {
+ assert(start < data.length && end <= data.length && start < end);
+ final decoder = allowMalformed ? unsafeUtf8Decoder : utf8.decoder;
+
+ try {
+ return decoder.convert(data, start, end);
+ } on FormatException {
+ error();
+ }
+ }
+
while (offset < data.length) {
// At the start of an entry, expect its length which is terminated by a
// space char.
@@ -763,13 +775,14 @@
error();
}
- // Read the key
+ // Read the key, and ensure there is enough space for the value and the
+ // trailing newline.
final nextEquals = data.indexOf($equal, offset);
- if (nextEquals == -1 || nextEquals >= endOfEntry) {
+ if (nextEquals == -1 || nextEquals >= endOfEntry - 1) {
error();
}
- final key = utf8.decoder.convert(data, offset, nextEquals);
+ final key = decodeString(data, offset, nextEquals, false);
// Skip over the equals sign
offset = nextEquals + 1;
@@ -783,7 +796,7 @@
// If we're seeing weird PAX Version 0.0 sparse keys, expect alternating
// GNU.sparse.offset and GNU.sparse.numbytes headers.
if (key == paxGNUSparseNumBytes || key == paxGNUSparseOffset) {
- final value = utf8.decoder.convert(data, offset, endOfValue);
+ final value = decodeString(data, offset, endOfValue, false);
if (!_isValidPaxRecord(key, value) ||
(sparseMap.length.isEven && key != paxGNUSparseOffset) ||
@@ -796,7 +809,7 @@
} else if (!ignoreUnknown || supportedPaxHeaders.contains(key)) {
// Ignore unrecognized headers to avoid unbounded growth of the global
// header map.
- final value = unsafeUtf8Decoder.convert(data, offset, endOfValue);
+ final value = decodeString(data, offset, endOfValue, true);
if (!_isValidPaxRecord(key, value)) {
error();
diff --git a/pubspec.yaml b/pubspec.yaml
index bed57e7..be54f62 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -1,6 +1,6 @@
name: tar
description: Memory-efficient, streaming implementation of the tar file format
-version: 1.0.2
+version: 1.0.3
repository: https://github.com/simolus3/tar/
environment:
diff --git a/reference/bad/invalid_pax_header.tar b/reference/bad/invalid_pax_header.tar
new file mode 100644
index 0000000..6a5c581
--- /dev/null
+++ b/reference/bad/invalid_pax_header.tar
Binary files differ
diff --git a/reference/bad/invalid_pax_len.tar b/reference/bad/invalid_pax_len.tar
new file mode 100644
index 0000000..ba49b86
--- /dev/null
+++ b/reference/bad/invalid_pax_len.tar
Binary files differ
diff --git a/test/reader_test.dart b/test/reader_test.dart
index d1abde5..f0a2147 100644
--- a/test/reader_test.dart
+++ b/test/reader_test.dart
@@ -972,6 +972,18 @@
});
});
+ test('throws for invalid utf8 in pax key', () async {
+ final reader =
+ TarReader(fs.file('reference/bad/invalid_pax_header.tar').openRead());
+ expect(reader.moveNext(), throwsA(isA<TarException>()));
+ });
+
+ test('throws for zero-length pax data', () async {
+ final reader =
+ TarReader(fs.file('reference/bad/invalid_pax_len.tar').openRead());
+ expect(reader.moveNext(), throwsA(isA<TarException>()));
+ });
+
group('PAX headers', () {
test('locals overwrite globals', () {
final header = PaxHeaders()
diff --git a/tool/fuzz.dart b/tool/fuzz.dart
new file mode 100644
index 0000000..0909385
--- /dev/null
+++ b/tool/fuzz.dart
@@ -0,0 +1,30 @@
+import 'dart:io';
+
+import 'package:tar/tar.dart';
+
+const verbose = bool.fromEnvironment('verbose');
+
+/// Reads tar files from arguments and expects not to crash.
+///
+/// When something goes wrong, the name of the problematic tar file is printed.
+/// By running with `-Dverbose=true`, a stack trace is printed as well.
+void main(List<String> files) async {
+ for (final file in files) {
+ try {
+ await TarReader.forEach(File(file).openRead(), (entry) {});
+ } on TarException {
+ // These are fine
+ } on Object catch (e, s) {
+ // Other exceptions indicate a bug in pkg:tar
+ if (verbose) {
+ print(e);
+ print(s);
+ } else {
+ print(
+ 'failed for $file - run `dart -Dverbose=true tool/fuzz.dart $file`');
+ }
+
+ exit(128);
+ }
+ }
+}
diff --git a/tool/run_fuzz.sh b/tool/run_fuzz.sh
new file mode 100755
index 0000000..0ad165f
--- /dev/null
+++ b/tool/run_fuzz.sh
@@ -0,0 +1,9 @@
+rm -r /tmp/fuzz
+mkdir /tmp/fuzz
+dart compile exe tool/fuzz.dart -o /tmp/fuzz/fuzz.exe
+
+while true; do
+ radamsa -o /tmp/fuzz/gen-%n -n 100 reference/**/*.tar
+ /tmp/fuzz/fuzz.exe /tmp/fuzz/gen-*
+ test $? -gt 127 && break
+done
