foundry icon indicating copy to clipboard operation
foundry copied to clipboard

Fix infinite loop in TAR extraction when encountering invalid file sizes

Open prestoalvarez opened this issue 2 months ago • 0 comments

The extractFileFromTarball function in npm/src/install.mjs could enter an infinite loop when processing TAR archives with corrupted or malicious headers. If fileSize parsing resulted in NaN (due to invalid octal data in the TAR header), the offset calculation (offset + fileSize + 511) & ~511 would evaluate to 0, causing the parser to repeatedly process the same header block without advancing.

prestoalvarez avatar Nov 12 '25 16:11 prestoalvarez