`Archive::Tar::Minitar::PosixHeader.from_data` is vulnerable to DoS by negative size fields

[refashioned]

minitar is vulnerable to the same infinite loop that RubyGems was vulnerable to before version 2.7.6. See:

• https://hackerone.com/reports/281336
• https://github.com/rubygems/rubygems/commit/92e98bf8f810bd812f919120d4832df51bc25d83

Download loop.gem from the first link; then minitar list loop.gem will give an endless stream of

loop
loop
loop
loop
loop
loop

The problem is that Archive::Tar::Minitar::PosixHeader.from_data parses fields using oct, and oct allows lots of syntax including negative numbers.

Be aware that RubyGems' strict_oct fix made their code incompatible with some kinds of tar headers, so minitar may have to do something more careful. https://github.com/rubygems/rubygems/issues/2213