Package: perl
Version: 5.42.3-1
Control: found -1 5.44.0-1
Forwarded: https://github.com/jib/archive-tar-new/issues/47
As discussed in the upstream bug, the current Archive-Tar
behaviour after the CVE-2026-9538 fix does not seem quite right.
The below script from the upstream issue outputs four lines
of error messages. Increasing the entry size tenfold multiplies
the number of messages similarly.
So huge entries still cause unproportional work when extracting,
even though they are rejected (due to exceeding $MAX_FILE_SIZE).
At the very least there should be just one line of the error output.
use Archive::Tar;
use File::Temp qw(tempdir);
my $tmpdir = tempdir(CLEANUP => 1);
my $tarfile = "$tmpdir/test.tar";
my $tar = Archive::Tar->new;
$tar->add_data("big.txt", "A" x 2048);
$tar->add_data("small.txt", "B" x 50);
$tar->write($tarfile);
local $Archive::Tar::MAX_FILE_SIZE = 1024;
my $tar2 = Archive::Tar->new;
my @files = $tar2->read($tarfile);
# Observe: 4 spurious "Invalid header block" or "checksum error" warnings
# before small.txt is successfully parsed
--
Niko Tyni [email protected]
