From cc09ac408409adbe0e41022bdb219067d53521ee Mon Sep 17 00:00:00 2001
From: Manjusaka <me@manjusaka.me>
Date: Sat, 2 Nov 2024 02:01:48 +0800
Subject: [PATCH 1/5] gh-107398: Fix tarfile stream mode exception when process
 the file with extra header data

---
 Lib/tarfile.py           | 18 ++++++++++--------
 Lib/test/test_tarfile.py |  6 +++++-
 2 files changed, 15 insertions(+), 9 deletions(-)

diff --git a/Lib/tarfile.py b/Lib/tarfile.py
index a0fab46b24e249..75de0e3a1d063a 100644
--- a/Lib/tarfile.py
+++ b/Lib/tarfile.py
@@ -480,25 +480,27 @@ def _init_read_gz(self):
         # taken from gzip.GzipFile with some alterations
         if self.__read(2) != b"\037\213":
             raise ReadError("not a gzip file")
-        if self.__read(1) != b"\010":
+        (method, flag, _) = struct.unpack("<BBIxx", self.__read(8))
+        if method != 8:
             raise CompressionError("unsupported compression method")
 
-        flag = ord(self.__read(1))
-        self.__read(6)
-
+        # process FEXTRA
         if flag & 4:
-            xlen = ord(self.__read(1)) + 256 * ord(self.__read(1))
-            self.read(xlen)
+            extra_len, = struct.unpack("<H", self.__read(2))
+            self.__read(extra_len)
+        # process FNAME
         if flag & 8:
             while True:
                 s = self.__read(1)
-                if not s or s == NUL:
+                if not s or s == b'\000':
                     break
+        # process FCOMMENT
         if flag & 16:
             while True:
                 s = self.__read(1)
-                if not s or s == NUL:
+                if not s or s == b'\000':
                     break
+        # process FHCRC
         if flag & 2:
             self.__read(2)
 
diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
index 54d329a15d4d25..9a271cdb598e80 100644
--- a/Lib/test/test_tarfile.py
+++ b/Lib/test/test_tarfile.py
@@ -45,6 +45,7 @@ def sha256sum(data):
 TEMPDIR = os.path.abspath(os_helper.TESTFN) + "-tardir"
 tarextdir = TEMPDIR + '-extract-test'
 tarname = support.findfile("testtar.tar", subdir="archivetestdata")
+tgzname_with_comment_extra_data_in_header = support.findfile("tgz_with_comment_extra_data_in_header.tgz", subdir="archivetestdata")
 gzipname = os.path.join(TEMPDIR, "testtar.tar.gz")
 bz2name = os.path.join(TEMPDIR, "testtar.tar.bz2")
 xzname = os.path.join(TEMPDIR, "testtar.tar.xz")
@@ -858,7 +859,10 @@ def test_read_through(self):
                                   "TarFile.extractfile() failed")
                     if not buf:
                         break
-
+    def test_read_with_extra_header(self):
+        with tarfile.open(tgzname_with_comment_extra_data_in_header,
+                          mode="r|*") as _:
+            pass
     def test_fileobj_regular_file(self):
         tarinfo = self.tar.next() # get "regtype" (can't use getmember)
         with self.tar.extractfile(tarinfo) as fobj:

From 726c8cf92466a9780e775ac29dc84d7aa6a84b95 Mon Sep 17 00:00:00 2001
From: Manjusaka <me@manjusaka.me>
Date: Sat, 2 Nov 2024 02:02:38 +0800
Subject: [PATCH 2/5] add news

---
 .../next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst | 2 ++
 1 file changed, 2 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst

diff --git a/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst b/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst
new file mode 100644
index 00000000000000..ec3502e8b5facd
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst
@@ -0,0 +1,2 @@
+Fix tarfile stream mode exception when process the file with extra header
+data.

From db8e216d0f025379c446dd46ff031a10259cc2ca Mon Sep 17 00:00:00 2001
From: Manjusaka <me@manjusaka.me>
Date: Sat, 2 Nov 2024 02:03:47 +0800
Subject: [PATCH 3/5] add test file

---
 .../tgz_with_comment_extra_data_in_header.tgz    | Bin 0 -> 4183 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 create mode 100644 Lib/test/archivetestdata/tgz_with_comment_extra_data_in_header.tgz

diff --git a/Lib/test/archivetestdata/tgz_with_comment_extra_data_in_header.tgz b/Lib/test/archivetestdata/tgz_with_comment_extra_data_in_header.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..b3d5ca05c1f94d8a5960de1f1ef3c10df358861e
GIT binary patch
literal 4183
zcmV-d5UB4TiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc
zVQyr3R8em|NM&qo0PH+#ZyPz1^SOUTo$N&>xpYhNGiV?<c%AI5afu_unJfl_K|pnv
zB*qlkL$YOS9N%w0@X=2_EXN)vvul2^B{o@AEV3S~s@4SA^zRbMx%xolh%)RRPl(jf
zoJ`pd_tbj5UhiOU&;IZAdhP$co!;IL{k_9}f2ZHy@9qB3>+kLF?fn3~`yyan%atbb
zhu)oWwHNmnX(Xc`Q7S5U46~hpWLf#OAN3ESUXY?nB+az#JA!{An?hpF2#kb;|ILRe
zIcih^CsT}J;Xnm?o?#3m%NR|F0Tav$6uqb)^@4BBga72VDE~9Ua#Z)J0M^TYzqi{z
zY{~zAuitx=|A%N>@CrvHXBynTTcKV!6j87RA0|`*RY2gEqqlFuk&siOHKtGuc!dcg
z5@ALpB}0Y^w16Q(MwG%7DAxk!BA1|XnlYkLML_}gf-(jQHRuU~M5`*y*F@x8!&FEF
z${k87I3$D{$Rm;S6ecK*-qAW!akqP3Dx`>tZYmPhO$1Lc)2e$R<T(>0wOv{Y#!#wm
zg{~X;&&LLB4E>Tmg<4tK%tS&tN}y9R#(N{JgsZw1u<8c(e;k0}hfq`tIgf#lDZdN=
z+H_?(V~`0(leyhO2P6u>J{i~tF`SG}g&s&$$h8IXZiZ6Q6de$^Bu&O}F%b$O^+$vH
zwOg%UnFs@2lW`24PEb1_2E7@sFp*}lw!=_C`4|ZISVmGzfj}ndjA*Q_@vbb@M4elH
zj_5d-7-k|3OYU|J9igQl^r%CLW2&^AdyWrs#?CD1Du!Qwt1V0m5T0K(ei*YCS>snQ
z(=ud~Gq%tfZ24VF?81gQWvK#@YtJw_qX_~@?)TU$Oma!}yz3E!9)aoxzURnw#P&>_
zWth+rMFkfV)Dx6I7D!VQk+akglSm{Q(*XRZ7_`jM0y@gIFq9{RF|(~^B7w68$|nkr
z1}A22id<8|)c*tk#LRRuSV7}lXv+t?6C_Q|za@M#^Q*BjTwQy4LAzHVMoYP^1>_1N
zJN9G*TxhG12v7aW>=BSTJ_q6eQ3Ye<D9!pISLS#dz{Sp&dM*HPzR{wbDAd}_tK6uC
zb;3ZTM!o(+$R#IYg2}na^=1dboZcD53#$kzABPuIPeL*LjEPp=8q>NEWFkFkaq&jd
z-;g1)2d0`?oLxh&LvKknU(fupKNei$r7jP`Nc|*5p2e`!>-B;_tr(V&j0`EGnxb-o
z0gy_O6`w;mdh^D9mPpcfoXy`0q5nY{s=3lQtsPyN^CNXCxEavy{#l`np>Ii9&fq+&
z3E=(d1Pf1v9JS|b(N}7Pc!`}U=rB(GgAlWo<wHi*#B6*yu25u#3T3R2y<!}*Txpai
zgJt$nNUa`*;1NZZhAP7(v{;P|7E;IXqT1pi6Uq6KjkZ>pk0mPi=+7kB<LL(egV}E6
z#&b(!7!jt-DNPtr>a@^a%QUOubrZFR7umU$%d$97GZm7=!Zt!-;7^3omJ%ai=1c6%
zY>1a+nlX%+NC>mf0WzW|ez2QhI%4RSJ#NScdpb_c^eJ*jy*F}+IXui6dMnnUcU#<&
z8>mCgl$ZUA%&h|TGAaX!O5`%Z$_o7pAy>IIh!PVqogz=It<eIMrD<NeUFB?RgtP#L
zWM*6s<AobXJP}+aROF7VWFm}Y7VcNBP)6>w5vBxCZp@fMWk}_T`)`Co<{ShE<TEM-
zHykqlxSjx`S~IVz3R0ef%9Dvf|CVxUwlgx;axQX61zZr`SV?VK&fRLAt1}Xei3`fd
z7CNKc3?b>~T-oPSgMed#N)b7KZr3kyDrVmC$|ak_P!h|VkwytmDpo&<JkTkv_9)46
zt7WJD`xK|vpYHFxcuV~ff6q~EI-}_pD%4(h8J!_F((6bjDYf4+DTa7w{j=V+t@;Zh
z!jgc{+;VlEg^rMJPz)KE?`Fvc?N6wkG}YzE=`Qm)D8b!oR?F#KV%>5rR6^|i;Qp_A
zHR#=-_GPKMn^OMXUkA<g4`50zYaP9wz4FL0>f^!BKWob9AC}Ak%EYLaF<LcmPK+D&
z)}ETxBZDnCN>gf{5C${B@+m4Kj^;3lTxYq4SC}y|x3ZJsh;lnR3jAPyNeR7=IT9i;
z$JME^IB*K8uGFS;_su^NnL}PMVHrhl?RDWcWVsnDXtS>Uz@C;)7j@Dd3DL1n3RlW|
zNdXrro*~0T3+Ws?Etv7RodNpww;&)Ri+gS#f9r6{U#>02|H|l0_w?O|*JqKw)OW;j
zL;Qbt_psNB{~he???1->9-{Rl_{oReY7u()`TZLh&W&rp{k2vh7z0jts^Z}4Dg-)$
z=%b4j7Y?6Sr*M63M@YiQ2;0V2g81daXzN3nu>jTR$oh1y*Xa4HD}!jeJy$a`MqOQj
z@t>}*<8Jrr%AvAw;rjaO$^ok|xS>J&BU5N_ctfh7b1G6C2&p?I$=-dA?5)Sb!%Jh~
z;Pl<A*PjOO-hX(x{i88QiDocH4Pj_Bp2|pqU<i4S%=li>Y1w;y4WWR~N^nEu%g$9~
zoTkX$7=G>j7I9C+b*H#<DFcb}gykthXE8=w#2q>i!S(gi7Lg}|7KsLd`YJ-H#;K)I
zX`*u#ku)`%g0|0px$am3l8La}7<aqdo{V_AWZDY;zY!$;J7LC2mFxBZ0E~)?;Y7of
z%t4cL1Og+xFm^mILXYNb*FnO`z(=OZj8JBdY*f23z%L@VUdIK|$polY;MQ3eh$pw+
zY&A<DytvgCKB>0w?DhMPC&x>6(SqFs|7{RM7#3ClI#*Ynt1B;^KT@9JB@`RaYFsTu
z6M9dr@I_Vvot$;9mmG&`NwFciwaa$ZD<!nN>2DySgLkh!ogTe?-C|rO(oIi4gAU2E
zsOfH+i7(ePwPNV=#rc#gZ5a2mjo0vNrNm89lay#;VSA>!Wgfpf{cv=0`uhDcb(D#8
zv$bv)+*+!fsw9P>rBqdAx6@bUPIo?1MRl>^{hh<87xkik{G#`w=fkZoAyl(GodBSq
zd?Sht72!z83nJ4R`36V4-DFB#^M7l*`@OVv{@<qwvJ9n)batmy@J;^T{_al8|2ypO
z9X$Gf57Dl!y3c~wmzj+)wK60&J`@Gdx?T_4TizN?7gpnJ{3>##L{_O4YPy~hgD>Wm
z#}hc%wIAv9EFX>NC3M10%TWs~oyRT@LrM(BY|Y{KoG?0~m>Nam^Kt(|2iuO<27_6R
zf*~fv=p7}dSWjKpb=%0T0wU2xkI<)>sDdAdbIX%gr)OrY@d1oVd>REOBalupIUuE#
zs?vi%waai1ZCEaK(K|!Dr*;DtR~EWpbIk#7CmRdyt$e--=Z)3%pSSHQ;+LCmZAD|r
z4+o@e>l~ep&RY_fNy_yII)78)-&Cgs%OTzTpe_H{IDWN#HB#e?narNrz4Zshjk4LP
zjrP}$uQs>6s5-yhXP<<JFScI7Si{bLccAmBb9=E8)2ZN&R<#MOZlojDJdM<(Yw3?~
za5McPBS*%%k;(^s-gs0|?L>J79F>I#=Gmf$RaTi9-(g|O7x+CF8e0rmgfb<Zj4=&|
z^SI%J_%!xXh87X4Td=gf-f$@~E{wLR*SQ2h;dRCf4%NC7-!=@(Q|Fs4v!47vU8T>O
z!y=!5Z<&`LH@nX~T?LibS6$O51^kZxuyDs%3SdEJd~3_TSzG7-rDcHkZq<M{_<wsl
zd;4ww@8EFf(f@mhR<HjhS*E(PesE5C8rQ=6L2>Jh%Sx8pL=yt=deCKwtf;S^%Swg+
z1vup?at(V1igCAMAIYPxKBth&T2`kXgM_k@(5X8=x?bbA5F7+3G_j+0N^~-LQzQSz
z1uR;wY9R*>MImAyMUA@!e4BqQ2yT|*l(DZyF1`$4nb}(WLZ+;N`9(FYv0BquV|ib-
zLpAWr7vM{STBFtzx<G1i1ePLc7w=VY7RvhW!mLFLc9S$Lvw2Y+V6*;cDRC7eTUAZV
zsjdPw_3DUHbnD(^joWKzSwW9lNlbsI3E361LZ>E&wkxU?eqLY43y(D!!<Y88qv82=
z+E@m)g4YFjRW)prJ{!zxuD4*AO=3f%H6mUOEbaJZb6zHe7Kvand^jG|o-JhK*K)lv
zdJWGP)Aeh?Hixf;Ta;Sd46>+TSq*JLkQ*uI#?VG;c_r=}a5bcP1@ao+BFlakow0zW
zp4P60HIm);im%9#*K9|THNRIpwd8y?s-Cg`I&9zCN%}W#>-_&oM(*V`pd0-E{^4QU
z|3BC{IDGW~AELD`-YY!m#x0>%Pc_@|mxX@{N&hfLkqtz8<VT?VzHSbdrVq9(>phMf
z%w_i<)4y;BvI_cZR?sLZt9c4_R@cV(N%gX`Rg<bQeiCX)lRC4OZ|wR4wn77kzN-4Y
zx8Xt4_*bgjaV5#}vd1B)TWANWhOhRF%utds)*h~0@@AB`?9`2%SW~0-mCSIpq7TK7
z4d`DPqFSf_i(;F*+JGDM|4x7RU?Kl^(0|nb57BO@<O*BLzj}QjI)CA!>_xoj#7+G^
zRQ|H~fL|JEhf)^8C@Xx^y@g;=JtVahSNZmYo9erdt9L4lTrY`1t=JV^L{M~{KfZ8o
z)!5=iik9>3XVr@ETnimdwe(1RRx1=z6&0IF)%T^Exba2i3~yXRgSg^#5QE8<_$`oV
z3r$LLTQ7&KDl)9r?aJ4iWrNMxZjXysO4=i;S52y2ZO(6S&$S^*&XK2aD^O5-1FP9?
zCsEsrAqZcZzt9W7^XU+!1-^ZAIAe*C{j26c{*&7}`(JGSpKSko2fg<1KOFY=AAkSh
zL0aSYUkX$1bKBpCDKCtyE>-KwiqBdQH}r2H-58p6F7%*!UCArSC6U@jIJlW6x<gKA
z@0%*h4dmZv`M+Kb+$jIM{igiy^!9fi^S=+$HY&Vm-vZi-!VkZ-zF3nP`;#sKt@YjG
zU7-BQiY8A!h;!u2)KE!6G4I>BPV3}fqtfngm<Z0@`<q{(25v9^{lkOZNBMt<wp6SK
zB3&ZOo!c1yuyt%Y_a@T|BHAfR5GO*McVaM@ORu4w2``em7h}}*@_-nIxtb5fWtl;@
z@4ChC>k~8d$!|s8OpcZ5ybUkbyx(HsO0;ih7dh)woT2=7@*kNlI_5&+J>j@X{`Ys=
z`JcVRgGc}WLE07!h}J0Gj}5tPhl>gNAE%;x3>itz-H(YCKdO>v?&nn01Q~-d6GK-g
zMfvzSNMuCQ8QOSAt)K8T*aD7Y_lD_@nZyyj#MBw+|9Tq1JI>}HxSeT8f()hoZHOp{
zUY&h9(?Vjf1-@MQ<MA1!RH`5vQ{A<H9r-~t{6lu_-=bqO?wUWvS2g3^3eb=w=Xqv-
z#!dy#B6X1k&!QnY51vJOYCa1|$HBAz3%1}RkyPXgPF}rML6k}H8512uG)2;N!=?Bf
hL^G9$6uXb%kH_}d9^3ca{yzW!|NrTtcclPY006yQArk-q

literal 0
HcmV?d00001


From 28eb332d5bbb1f2653e9c64985ea5cffa46028f3 Mon Sep 17 00:00:00 2001
From: Nadeshiko Manju <lizheao940510@gmail.com>
Date: Sat, 2 Nov 2024 20:28:51 +0800
Subject: [PATCH 4/5] Update Lib/test/test_tarfile.py

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
---
 Lib/test/test_tarfile.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Lib/test/test_tarfile.py b/Lib/test/test_tarfile.py
index 9a271cdb598e80..eadf83fecdc914 100644
--- a/Lib/test/test_tarfile.py
+++ b/Lib/test/test_tarfile.py
@@ -859,6 +859,8 @@ def test_read_through(self):
                                   "TarFile.extractfile() failed")
                     if not buf:
                         break
+
+    @unittest.skipIf(zlib is None, "requires zlib")
     def test_read_with_extra_header(self):
         with tarfile.open(tgzname_with_comment_extra_data_in_header,
                           mode="r|*") as _:

From 3bc23ceea1abfbed5dc445db6aef9ad74761d9ea Mon Sep 17 00:00:00 2001
From: Nadeshiko Manju <lizheao940510@gmail.com>
Date: Sat, 2 Nov 2024 20:28:59 +0800
Subject: [PATCH 5/5] Update
 Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst

Co-authored-by: Kirill Podoprigora <kirill.bast9@mail.ru>
---
 .../next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst b/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst
index ec3502e8b5facd..728784cb42c5c1 100644
--- a/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst
+++ b/Misc/NEWS.d/next/Library/2024-11-02-02-02-31.gh-issue-107398.uUtA6Q.rst
@@ -1,2 +1,2 @@
-Fix tarfile stream mode exception when process the file with extra header
+Fix :mod:`tarfile` stream mode exception when process the file with extra header.
 data.