Skip to content

gh-151981: Make tarfile._Stream.seek break at EOF#151982

Merged
encukou merged 6 commits into
python:mainfrom
encukou:tarfile-seek-break
Jun 23, 2026
Merged

gh-151981: Make tarfile._Stream.seek break at EOF#151982
encukou merged 6 commits into
python:mainfrom
encukou:tarfile-seek-break

Conversation

@encukou

@encukou encukou commented Jun 23, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

@encukou encukou requested a review from ethanfurman as a code owner June 23, 2026 11:28
@bedevere-app bedevere-app Bot mentioned this pull request Jun 23, 2026
Open
@encukou encukou added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes and removed awaiting core review labels Jun 23, 2026
StanFromIreland
StanFromIreland approved these changes Jun 23, 2026
View reviewed changes

@StanFromIreland StanFromIreland left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread Lib/tarfile.py Outdated
Comment thread Misc/NEWS.d/next/Security/2026-06-23-13-28-16.gh-issue-151981.xBHEcU.rst

@StanFromIreland StanFromIreland Jun 23, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're issuing an advisory, this should be in Security.

encukou and others added 2 commits June 23, 2026 14:11
@encukou
Move to Security
49dac62
@encukou @StanFromIreland
Update Lib/tarfile.py
4a5cbce 
Co-authored-by: Stan Ulbrych <stan@python.org>
@encukou encukou merged commit f50bf13 into python:main Jun 23, 2026
54 checks passed
@miss-islington-app

miss-islington-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

Thanks @encukou for the PR 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@encukou encukou deleted the tarfile-seek-break branch June 23, 2026 13:13
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151991 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151992 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151993 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151994 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151995 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Jun 23, 2026
@bedevere-app

bedevere-app Bot commented Jun 23, 2026

Copy link
Copy Markdown

GH-151996 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Jun 23, 2026
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @encukou @StanFromIreland
[3.14] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#…
e86666c 
…151992)

(cherry picked from commit f50bf13)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @encukou @StanFromIreland
[3.15] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (
4ce6bf7 
#151991)

(cherry picked from commit f50bf13)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
StanFromIreland added a commit that referenced this pull request Jun 23, 2026
@miss-islington @encukou @StanFromIreland
[3.13] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#…
3f031d4 
…151993)

(cherry picked from commit f50bf13)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
pablogsal pushed a commit that referenced this pull request Jun 27, 2026
@miss-islington @encukou @StanFromIreland
[3.11] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#…
7f0dc59 
…151995)

gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982)
(cherry picked from commit f50bf13)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
pablogsal pushed a commit that referenced this pull request Jun 27, 2026
@miss-islington @encukou @StanFromIreland
[3.10] gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982) (#…
eb63c0f 
…151996)

gh-151981: Make tarfile._Stream.seek break at EOF (GH-151982)
(cherry picked from commit f50bf13)

Co-authored-by: Petr Viktorin <encukou@gmail.com>
Co-authored-by: Stan Ulbrych <stan@python.org>
pyctrl pushed a commit to pyctrl/cpython that referenced this pull request Jul 5, 2026
@encukou @StanFromIreland @pyctrl
pythongh-151981: Make tarfile._Stream.seek break at EOF (pythonGH-151982
63b21a7 
)

Co-authored-by: Stan Ulbrych <stan@python.org>
@skumar-secpod

skumar-secpod commented Jul 10, 2026

Copy link
Copy Markdown

Hello! Thank you for the fix.

Could you please clarify the first released version containing this fix for each maintained branch (e.g., 3.11, 3.12, 3.13, 3.14, and 3.15)? I can see the backports, but I couldn't determine the corresponding released versions from the PR or related discussions.

@StanFromIreland

StanFromIreland commented Jul 10, 2026

Copy link
Copy Markdown
Member

They haven't been released yet, you'll have to keep an eye out for releases. We recommend distributors apply patches themselves.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@StanFromIreland StanFromIreland StanFromIreland approved these changes
@ethanfurman ethanfurman Awaiting requested review from ethanfurman ethanfurman is a code owner

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@encukou @skumar-secpod @StanFromIreland