[icanhasmath]

Backport of python/cpython pythonGH-151982 / pythongh-151981 (CVE-2026-11972, PSF-2026-31) to 2.7.18.x.

Problem: in streaming mode (mode="r|"), tarfile._Stream.seek() reads forward by the declared number of blocks, and it keeps going after EOF. A header that declares a huge member size (1 << 64) makes getmembers() loop for an effectively unbounded time.

Fix: stop the loop once read() returns no data. The next header read then raises ReadError("unexpected end of data").

Test: StreamReadTest.test_getmembers_big_size covers both GNU and PAX formats. It hangs on 2.7.18.15 (killed by a timeout) and passes with the fix. test_tarfile passes against OpenSSL 1.1.1w on Linux.

This is one of the 2.7.18.16 fixes. Each one targets the 2.7.18.16 integration branch, which is cut from 2.7.18.15 (#91). The release PR will take 2.7.18.16 into 2.7.

[ezequielp-activestate]

No blockers.

• Fix matches upstream. _Stream.seek() now stops at EOF, the same change as upstream pythonGH-151982 (f50bf13). No later upstream fix touches this loop.
• Repro: a streaming-mode (r|) archive whose single header declares a size of 1 << 64 (GNU) or (1 << 64) - 1 (PAX), followed by one zero block:
  • 2.7.18.16 base: getmembers() still running after 10 s, killed by an alarm.
  • This branch: ReadError: unexpected end of data immediately, for both formats.
• Tests: test_tarfile passes on this branch (Python 2.7.18 built from the 2.7.18.16 branch).