Guard against negative offset/length values in tarfile's GNU sparse extraction

Bug report

Bug description:

for i in range(21):
    try:
        offset = nti(buf[pos:pos + 12])
        numbytes = nti(buf[pos + 12:pos + 24])
    except ValueError:
        break
    if offset and numbytes:
        structs.append((offset, numbytes))
    pos += 24

https://github.com/python/cpython/blob/7040aa54f14676938970e10c5f74ea93cd56aa38/Lib/tarfile.py#L1441

• There is no check that offset or numbytes are non-negative.
• The check if offset and numbytes: only skips zero, not negative numbers.

validation should be added:

if offset >= 0 and numbytes >= 0:
    structs.append((offset, numbytes))

• This will prevent the addition of invalid sparse mappings, mitigating the risk.

CPython versions tested on:

3.13

Operating systems tested on:

Windows

Linked PRs

• gh-137805
• gh-138726