[PATCH] erofs-utils: tar: refuse negative size in tar header

[Gao Xiang <hsiangkao@linux.alibaba.com>]

As @oscarjhk reported:

When tar-index mode is used, the inode chunk count will be calculated
as 0 if a crafted GNU base-256 size is UINT64_MAX, which will cause
a heap out-of-bounds write.

Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
 lib/tar.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/tar.c b/lib/tar.c
index 242f27ae49fd..cf60b02daf2b 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -886,6 +886,13 @@ out_eot:
 			goto invalid_tar;
 	}
 
+	if ((s64)st.st_size < 0) {
+		erofs_err("invalid negative size=%lld @ %lld",
+			  (s64)st.st_size, tar_offset);
+		ret = -EFSCORRUPTED;
+		goto out;
+	}
+
 	if (th->typeflag <= '7' && !eh.path) {
 		eh.path = path;
 		j = 0;
-- 
2.43.5