Reject negative PAX size values when reading TAR headers (#128368)

This change adds a validation check while applying extended attributes
in TarHeader.Read.cs so that a negative size value from PAX metadata now
throws InvalidDataException instead of being accepted.

Author: iremyux

src/libraries/System.Formats.Tar/src/System/Formats/Tar/TarHeader.Read.cs

@@ -151,6 +151,11 @@ internal void ReplaceNormalAttributesWithExtended(IEnumerable<KeyValuePair<strin
             // The 'size' header field only fits 12 bytes, so the data section length that surpases that limit needs to be retrieved
             if (TarHelpers.TryGetStringAsBaseTenLong(ExtendedAttributes, PaxEaSize, out long size))
             {
+                if (size < 0)
+                {
+                    throw new InvalidDataException(SR.Format(SR.TarSizeFieldNegative));
+                }
+
                 _size = size;
             }