[PATCH] erofs-utils: tar: refuse negative size in tar header

[Gao Xiang]

As @oscarjhk reported:

When tar-index mode is used, the inode chunk count will be calculated
as 0 if a crafted GNU base-256 size is UINT64_MAX, which will cause
a heap out-of-bounds write.

Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
Signed-off-by: Gao Xiang <hsiang...@linux.alibaba.com>
---
 lib/tar.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tar.c b/lib/tar.c
index 242f27ae49fd..cf60b02daf2b 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -886,6 +886,13 @@ out_eot:
                        goto invalid_tar;
        }
 
+       if ((s64)st.st_size < 0) {
+               erofs_err("invalid negative size=%lld @ %lld",
+                         (s64)st.st_size, tar_offset);
+               ret = -EFSCORRUPTED;
+               goto out;
+       }
+
        if (th->typeflag <= '7' && !eh.path) {
                eh.path = path;
                j = 0;
-- 
2.43.5