From 337d3ddd1d262fbc9a8e5851402b164526978d38 Mon Sep 17 00:00:00 2001
From: icanhasmath <marcg@activestate.com>
Date: Wed, 28 Oct 2026 00:50:27 -0500
Subject: [PATCH] gh-151981: Make tarfile._Stream.seek break at EOF
 (CVE-2026-11972)

Backport of python/cpython GH-151982 (3.13 3f031d431f).

In streaming mode (mode="r|"), _Stream.seek() skipped forward by reading
the declared number of blocks even after the stream hit EOF.  A member
header that declares a huge size (e.g. 1 << 64 via a GNU/PAX header)
made getmembers() spin for an effectively unbounded time.  seek() now
stops reading once read() returns no data, and the following header read
raises ReadError("unexpected end of data").

2.7.18.x: xrange() loop; the test loops over GNU_FORMAT and PAX_FORMAT
instead of using support.subTests, and lives in StreamReadTest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 Lib/tarfile.py           |  4 +++-
 Lib/test/test_tarfile.py | 16 ++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/Lib/tarfile.py b/Lib/tarfile.py
index d1cb4fe15ae27d7..223b573f45122c3 100644
--- a/Lib/tarfile.py
+++ b/Lib/tarfile.py
@@ -556,7 +556,9 @@ def seek(self, pos=0):
         if pos - self.pos >= 0:
             blocks, remainder = divmod(pos - self.pos, self.bufsize)
             for i in xrange(blocks):
-                self.read(self.bufsize)
+                data = self.read(self.bufsize)
+                if not data:
+                    break
             self.read(remainder)
         else:
             raise StreamError("seeking backwards is not allowed")
diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
index fe66218eaa826fd..8fa499f55bda64c 100644
--- a/Lib/test/test_tarfile.py
+++ b/Lib/test/test_tarfile.py
@@ -592,6 +592,22 @@ def test_provoke_stream_error(self):
         f = self.tar.extractfile(tarinfos[0]) # read the first member
         self.assertRaises(tarfile.StreamError, f.read)
 
+    def test_getmembers_big_size(self):
+        # gh-151981: A loop in seek() for streaming files tried to read the
+        # declared number of blocks even at EOF
+        for format in (tarfile.GNU_FORMAT, tarfile.PAX_FORMAT):
+            tinfo = tarfile.TarInfo("huge-file")
+            tinfo.size = 1 << 64
+            bio = io.BytesIO()
+            # Write header without data
+            bio.write(tinfo.tobuf(format))
+
+            # Reset & try to get contents
+            bio.seek(0)
+            with tarfile.open(fileobj=bio, mode="r|") as tar:
+                with self.assertRaises(tarfile.ReadError):
+                    tar.getmembers()
+
     def test_compare_members(self):
         tar1 = tarfile.open(tarname, encoding="iso8859-1")
         try: