Issue 39017: [CVE-2019-20907] Infinite loop in the tarfile module

While playing with fuzzing and Python, I stumbled upon an infinite loop in Python's tarfile module: just open the attached file with `tarfile.open('timeout-a52710a313fdb35fb428c3399277cb640fe2f686')`, and Python will be endlessly stuck in the `_proc_pax` function in tarfile.py, likely due to a missing check of `length` being strictly superior to zero.

I've attached a minimal tar file which reproduces this. I think the minimum length is 516 bytes.

We need a 512 byte PAX format header block as normal.

Then we need a pax header which matches the regex in https://github.com/python/cpython/blob/b26a0db8ea2de3a8a8e4b40e69fc8642c7d7cb68/Lib/tarfile.py#L1243

    length, keyword = re.compile(br"(\d+) ([^=]+)=").groups()

We use the `length` variable to iterate:
https://github.com/python/cpython/blob/b26a0db8ea2de3a8a8e4b40e69fc8642c7d7cb68/Lib/tarfile.py#L1271

    while True:
        ...
        pos += length

So we can start the block with "0 X=". This makes length=0. So it will increment pos by 0 each loop and loop the same code forever.

Nice find.

Do you think this denial of service is worth requesting a CVE for? If so, can someone else do it.

A smaller bug: If instead of 0 you use a large number (> 2^63) e.g. 9999999999999999999 you get `OverflowError: Python int too large to convert to C ssize_t` rather than the expected `tarfile.ReadError` regardless of errorlevel.

Hi ! I would like to start contributing to CPython. Can I start working on this issue ?

Absolutely!

But first, you'll need to sign the Contributor License Agreement:

  https://www.python.org/psf/contrib/contrib-form/

Thank you for your help!

Thank you. I have signed the CLA agreement. I have pushed my code changes and also written a testcase for this issue

CVE-2019-20907 has been assigned to this issue.

New changeset 5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4 by Rishi in branch 'master':
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454)
https://github.com/python/cpython/commit/5a8d121a1f3ef5ad7c105ee378cc79a3eac0c7d4

Larry and Ned, do you want this fix in the security-only releases you manage?

PRs for 3.6 ad 3.7 are ready, should you wish to merge them.

New changeset f3232294ee695492f43d424cc6969d018d49861d by Miss Islington (bot) in branch '3.9':
[3.9] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21482)
https://github.com/python/cpython/commit/f3232294ee695492f43d424cc6969d018d49861d

New changeset c55479556db015f48fc8bbca17f64d3e65598559 by Miss Islington (bot) in branch '3.8':
[3.8] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21483)
https://github.com/python/cpython/commit/c55479556db015f48fc8bbca17f64d3e65598559

Yes, please.  It's a simple low-risk fix.  And 3.5.10rc1 is stuck waiting for a fix anyway.  Thanks!

New changeset 79c6b602efc9a906c8496f3d5f4d54c54b48fa06 by Miss Islington (bot) in branch '3.7':
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (GH-21484)
https://github.com/python/cpython/commit/79c6b602efc9a906c8496f3d5f4d54c54b48fa06

New changeset 47a2955589bdb1a114d271496ff803ad73f954b8 by Miss Islington (bot) in branch '3.6':
bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21485)
https://github.com/python/cpython/commit/47a2955589bdb1a114d271496ff803ad73f954b8

Thanks, the PRs for 3.7 and 3.6 are now merged.

New changeset cac9ca8ed99bd98f4c0dcd1913a146192bf5ee84 by Petr Viktorin in branch '3.5':
[3.5] bpo-39017: Avoid infinite loop in the tarfile module (GH-21454) (#21489)
https://github.com/python/cpython/commit/cac9ca8ed99bd98f4c0dcd1913a146192bf5ee84

Given that a CVE was assigned for this, I think it'd be better if the news were in the 'Security' category and not 'Library'.