archive: Unconditionally honor PAX size (#441)

This synchronizes our behavior with most other tar parsers
(including astral-tokio-tar and Go archive/tar) ensuring
that we don't parse things differently.

The problem with parsing size in particular differently is
it's easy to craft a tar archive that appears completely differently
between two parsers. This is the case with e.g. crates.io where
astral-tokio-tar is used for validation server side, but cargo uses
the `tar` crate to upload.

With this, the two projects agree.

Signed-off-by: Colin Walters <walters@verbum.org>
Co-authored-by: Colin Walters <walters@verbum.org>
FG: drop test-related changes, adapt version
Signed-off-by: Fabian Grünbichler <debian@fabian.gruenbichler.email>
Fixes: CVE-2026-33055
Gbp-Pq: Topic vendor
Gbp-Pq: Name tar-CVE-2026-33055.patch

diff --git a/vendor/tar-0.4.43/src/archive.rs b/vendor/tar-0.4.43/src/archive.rs
index 17938a8c0d9244c689948952580657b7199cf8b2..519049ef44b0fff8cc418e8fb599c68af372aa1f 100644 (file)
--- a/vendor/tar-0.4.43/src/archive.rs
+++ b/vendor/tar-0.4.43/src/archive.rs
@@ -351,10 +351,11 @@ impl<'a> EntriesFields<'a> {
 
         let file_pos = self.next;
         let mut size = header.entry_size()?;
-        if size == 0 {
-            if let Some(pax_size) = pax_size {
-                size = pax_size;
-            }
+        // If this exists, it must override the header size. Disagreement among
+        // parsers allows construction of malicious archives that appear different
+        // when parsed.
+        if let Some(pax_size) = pax_size {
+            size = pax_size;
         }
         let ret = EntryFields {
             size: size,