From afc7e1f780c3c3273dcd691ac7a2b6f8ff304731 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Reynir=20Bj=C3=B6rnsson?= <reynir@reynir.dk>
Date: Mon, 19 Feb 2024 11:54:52 +0100
Subject: [PATCH] Header.marshal, checksum: check length

Fixes #144.
---
 lib/tar.ml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/tar.ml b/lib/tar.ml
index 35b2403..cda2780 100644
--- a/lib/tar.ml
+++ b/lib/tar.ml
@@ -510,11 +510,12 @@ module Header = struct
   let checksum x : int64 =
     (* Sum of all the byte values of the header with the checksum field taken
        as 8 ' ' (spaces) *)
+    assert (String.length x >= length);
     let result = ref 0 in
     let in_checksum_range i =
       i >= hdr_chksum_off && i < hdr_chksum_off + sizeof_hdr_chksum
     in
-    for i = 0 to String.length x - 1 do
+    for i = 0 to length - 1 do
       let v =
         if in_checksum_range i then
           int_of_char ' '
@@ -577,6 +578,11 @@ module Header = struct
   (** Marshal a header block, computing and inserting the checksum *)
   let marshal ?level c (x: t) =
     let level = compatibility level in
+    let* () =
+      if Bytes.length c < length then
+        Error (`Msg "buffer too short")
+      else Ok ()
+    in
     (* The caller (e.g. write_block) is expected to insert the extra ././@LongLink header *)
     let* () =
       if String.length x.file_name > sizeof_hdr_file_name && level <> GNU then