python / python/cpython

tarfile leaks ValueError instead of InvalidHeaderError for a malformed GNU sparse pax number

Open
#153,636 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib type-bug
Dominant language
Python
Stars
77.2k
Forks
36k
PR merge metrics
PR metrics pending

Description

Bug description:

When a pax extended header carries a malformed GNU sparse number, tarfile parses it with a bare int() and lets the ValueError escape to the caller, unlike the GNU sparse 0.0 handler which reports such corruption as tarfile.InvalidHeaderError.

import tarfile
tarfile.TarInfo("x")._apply_pax_info(
    {"GNU.sparse.size": "x"}, "utf-8", "strict")   # ValueError

Reporting InvalidHeaderError makes the reader stop at the bad member like the 0.0 format does; a maintainer may prefer to raise instead, so the direction is open.

CPython versions tested on:

3.13, 3.14, 3.15

Operating systems tested on:

macOS

Linked PRs
  • gh-153637

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at TarInfo._apply_pax_info using the malformed GNU.sparse.size example in the issue, and review linked PR gh-153637 for the current direction. Confirm that the chosen handling of a malformed GNU sparse pax number matches the intended behavior and no longer leaks an unintended bare ValueError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.