Comment 5 for bug 489690

A quick analysis of this bug, from looking at the tarfile.py code.

Line 386: TarInfo.getheader() returns a tar header block which is padded to 512 bytes.

It constructs it from several parts, such as the "member" name, file permissions, link name, user name, group name, etc.

Each field is padded to its own field length. e.g. User and group names are padded to 32 characters. They however, are not restricted to their appropriate sizes.

The code will fail to pad/truncate the whole header to 512 bytes if any of these fields exceed their intended size. The assert checks the size is a multiple of 512.

I am not familiar with each of the fields or external checks to ensure that they are not too long, but those checks do not appear to be here. I cannot tell if the appropriate action is to truncate the fields, to assert, or to take some other preventative action when these fields are too long.