alexcrichton / tar-rs

Tar file reading/writing for Rust
https://docs.rs/tar
Apache License 2.0
625 stars 184 forks source link

`append_dir_all` will add the archive being created to itself #350

Open larswirzenius opened 9 months ago

larswirzenius commented 9 months ago

The following program creates a tar archive that contains itself. This creates an archive of infinite size. If you run it, please be prepared to kill it before it fills your disk space.

fn main() -> anyhow::Result<()> {
    let f = std::fs::File::create("inf.tar")?;
    let mut builder = tar::Builder::new(f);
    builder.append_dir_all(".", ".")?;
    builder.finish()?;
    Ok(())
}

I'm not sure if this happens only with append_dir_all or if there are other ways to trigger this.

GNU tar notices this situation and refuses to add the archive being created to itself. It does this by keeping track of the device and inode numbers of the archive being created and comparing that to every file being added. This is almost not overhead as each file needs to be stated anyway.

For this crate, the archive being created may is not necessarily a file, of course, but perhaps the check could be added for those cases where it is?