postgres-github.git / summary / log / commit / refs

commit    bc30c704add5518fbd831a5ad3bc46990c4954cf
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Thu Apr 02 16:20:26 2026 +0000

    Harden astreamer tar parsing logic against archives it can't handle.
    
    Previously, there was essentially no verification in this code that
    the input is a tar file at all, let alone that it fits into the
    subset of valid tar files that we can handle.  This was exposed by
    the discovery that we couldn't handle files that FreeBSD's tar
    makes, because it's fairly aggressive about converting sparse WAL
    files into sparse tar entries.  To fix:
    
    * Bail out if we find a pax extension header.  This covers the
    sparse-file case, and also protects us against scenarios where
    the pax header changes other file properties that we care about.
    (Eventually we may extend the logic to actually handle such
    headers, but that won't happen in time for v19.)
    
    * Be more wary about tar file type codes in general: do not assume
    that anything that's neither a directory nor a symlink must be a
    regular file.  Instead, we just ignore entries that are none of the
    three supported types.
    
    * Apply pg_dump's isValidTarHeader to verify that a purported
    header block is actually in tar format.  To make this possible,
    move isValidTarHeader into src/port/tar.c, which is probably where
    it should have been since that file was created.
    
    I also took the opportunity to const-ify the arguments of
    isValidTarHeader and tarChecksum, and to use symbols not hard-wired
    constants inside tarChecksum.
    
    Back-patch to v18 but not further.  Although this code exists inside
    pg_basebackup in older branches, it's not really exposed in that
    usage to tar files that weren't generated by our own code, so it
    doesn't seem worth back-porting these changes across 3c9056981
    and f80b09bac.  I did choose to include a back-patch of 5868372bb
    into v18 though, to minimize cosmetic differences between these
    two branches.
    
    Author: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Thomas Munro <thomas.munro@gmail.com>
    Discussion: https://postgr.es/m/3049460.1775067940@sss.pgh.pa.us>
    Backpatch-through: 18

[parent: 57706799186a]