foundry
foundry copied to clipboard
Fix infinite loop in TAR extraction when encountering invalid file sizes
The extractFileFromTarball function in npm/src/install.mjs could enter an infinite loop when processing TAR archives with corrupted or malicious headers. If fileSize parsing resulted in NaN (due to invalid octal data in the TAR header), the offset calculation (offset + fileSize + 511) & ~511 would evaluate to 0, causing the parser to repeatedly process the same header block without advancing.