[issue22163] max_wbits set incorrectly to -zlib.MAX_WBITS in tarfile, shouldn't be negative

2014-08-07 Thread Eduardo Robles Elvira
New submission from Eduardo Robles Elvira: I think I have found a small typo-bug in tarfile.py, that seems to be present in cpython upstream, which makes tarfile compression slower. The issue can be seen here, in line 415 [1] of tarfile.py: self.cmp = self.zlib.compressobj(9

[issue21109] tarfile: Traversal attack vulnerability

2014-04-26 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: Also, I guess this patch solves and is closely related to #1044 which was, at the time (2007), considered "not a bug". -- ___ Python tracker <http://bugs.python.o

[issue21109] tarfile: Traversal attack vulnerability

2014-04-26 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: Do we have any final decision on what's the best approach to solve this? I see some possibilities: a) leave the issue to the library user. I think that's a not good solution security-wise as many will be unaware of the problem and this pro

[issue18321] Multivolume support in tarfile module

2014-04-13 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: >> [...] but remember, we split a volume only in the middle of a big file, not >> in any other case (AFAIK). Hopefully you don't get huge pax headers or >> anything strange. [...] > Hopefully? Sorry, but have you tested

[issue18321] Multivolume support in tarfile module

2014-04-13 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: > The example I gave is based on the idea that there is a TarVolumeSet class in > the tarfile module that implements all the required file-object methods (e.g. > read(), write(), seek(), etc.) and acts as if the sequence of volumes is >

[issue18321] Multivolume support in tarfile module

2014-03-11 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: I guess I got it wrong, it's not part of the POSIX standard, just part of the GNU tar documentation. About the getmembers and getnames not reflecting the entirety of the archive, it's an optimization I needed and I think ccan be quite handy.

[issue18321] Multivolume support in tarfile module

2014-01-29 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: > I cannot yet go into the details, because I have not tested the patch. > The comments, docstrings and quoting are not very consistent with the rest of > the module. There are a few spelling mistakes. I can try to take care of this, thoug

[issue18321] Multivolume support in tarfile module

2014-01-27 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: Do we have any news on this patch? -- ___ Python tracker <http://bugs.python.org/issue18321> ___ ___ Python-bugs-list m

[issue18321] Multivolume support in tarfile module

2013-10-22 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: could you please check if my contributor form is already processed? -- ___ Python tracker <http://bugs.python.org/issue18

[issue18575] Fixing tarfile._mode when using gzip via ":gz"

2013-07-28 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: Fixing gzip.patch, it was using basestring (python2) instead of str -- Added file: http://bugs.python.org/file31062/gzip.patch ___ Python tracker <http://bugs.python.org/issue18

[issue18575] Fixing tarfile._mode when using gzip via ":gz"

2013-07-28 Thread Eduardo Robles Elvira
Changes by Eduardo Robles Elvira : Removed file: http://bugs.python.org/file31061/gzip.patch ___ Python tracker <http://bugs.python.org/issue18575> ___ ___ Python-bug

[issue18575] Fixing tarfile._mode when using gzip via ":gz"

2013-07-28 Thread Eduardo Robles Elvira
New submission from Eduardo Robles Elvira: A TarFile object constructor accepts a fileobj argument. When this argument is set and it has a "mode" property, tarfile._mode is blindly copied from there. Otherwise, mode is set using the mode argument in the constructor. This usually wor

[issue18321] Multivolume support in tarfile module

2013-07-28 Thread Eduardo Robles Elvira
Eduardo Robles Elvira added the comment: Sure, I will fill it out. But is it required? -- ___ Python tracker <http://bugs.python.org/issue18321> ___ ___ Python-bug

[issue18321] Multivolume support in tarfile module

2013-06-28 Thread Eduardo Robles Elvira
New submission from Eduardo Robles Elvira: The patch attached provides implementation for multivolume support for tarfile module. It contains both the changes in the module and a battery of unit tests. It contains support for multivolume for both GNU and PAX formats. The main idea behind this