CVE-2026-33055 tar-rs库PAX头大小解析逻辑漏洞

// PoC Concept: Create a tar with conflicting sizes to demonstrate the parsing difference. // This code conceptually generates a tar file where the base header size differs from the PAX header size. use std::io::Cursor; use std::path::PathBuf; // Note: This is a conceptual representation. Exploitation requires constructing raw bytes. fn main() { // 1. Construct a PAX header record specifying a large size (e.g., 100MB) let pax_data = b"50 size=104857600"; // 2. Construct a base header for the same file entry but with a small size (e.g., 10 bytes) // In a real exploit, these bytes are manually crafted to form valid ustar headers. // The vulnerability occurs because tar-rs <= 0.4.44 sees 'size=10' in the base header // and ignores 'size=104857600' in the PAX header. println!("PoC: Constructing tar archive with base_size=10 and pax_size=104857600"); println!("Vulnerable parser (tar-rs < 0.4.44) will report size: 10"); println!("Standard parser (Go tar, etc) will report size: 104857600"); // Impact: Bypass file upload size limits or cause DoS upon extraction. }