Allow zero-length members in tar files

[hugovk]

Fixes regression from #10012.

[radarhere]

I would have thought a check that we weren't seeking backwards was the most direct?

What specification did you use to conclude that zero-length members need to be supported?

[hugovk]

I would have thought a check that we weren't seeking backwards was the most direct?

This creates a tar file with a block with a negative offset:

import os
import sys
import tempfile

from PIL import TarIO


def header(name, size):
    block = bytearray(512)
    block[: len(name)] = name.encode()
    block[124:135] = str(size).encode().rjust(11)
    return block


path = os.path.join(tempfile.mkdtemp(), "t.tar")
with open(path, "wb") as f:
    f.write(header("a", -1))
    f.write(header("b", 0))

try:
    TarIO.TarIO(path, "b")
except ValueError as e:
    print("rejected:", e)
else:
    print("accepted but should reject")
    sys.exit(1)

With the PR we get "rejected: size must not be negative".

With this instead:

             offset = (size + 511) & ~511
-            if offset <= 0:
-                msg = "offset must be positive"
+            if offset < 0:
+                self.fh.close()
+                msg = "cannot seek backwards"
                 raise ValueError(msg)
             self.fh.seek(offset, io.SEEK_CUR)

We get "accepted but should reject".

---

What specification did you use to conclude that zero-length members need to be supported?

It's needed for hard links and symlinks defined in POSIX.1-2024, which are zero length:

The size field is the size of the file in octets. If the typeflag field is set to specify a file to be of type 1 (a hard link) or 2 (a symbolic link), the size field shall be specified as zero.

https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html