mirror of
https://github.com/vbatts/tar-split.git
synced 2025-02-08 19:13:33 +00:00
Vincent Batts
1c425c4aaa
Fixes: #76 In a specially crafted tar archive can cause `io.ReadAll()` to overrun the memory. The fix is taken from upstream golang, as this tar-split repo carries an old fork from upstream. Thanks to @tojoos and @bainsy88 for reporting. References: - https://nvd.nist.gov/vuln/detail/cve-2022-2879 - https://github.com/golang/go/commit/0bf7ee9 - https://go-review.googlesource.com/c/go/+/439355/2/src/archive/tar/reader.go#106 Signed-off-by: Vincent Batts <vbatts@hashbangbash.com> |
||
|---|---|---|
| .. | ||
| testdata | ||
| common.go | ||
| example_test.go | ||
| format.go | ||
| reader.go | ||
| reader_test.go | ||
| stat_actime1.go | ||
| stat_actime2.go | ||
| stat_unix.go | ||
| strconv.go | ||
| strconv_test.go | ||
| tar_test.go | ||
| writer.go | ||
| writer_test.go | ||