archive/tar: malformed input causes panic in parsePAXRecord [1.15 backport]

[gopherbot]

@odeke-em requested issue #40196 to be considered for backport to the next 1.15 minor release.

@gopherbot please backport this issue as it is a security problem and has existed since for the past 8 years as per https://codereview.appspot.com/6700047.

[gopherbot]

Change https://golang.org/cl/290650 mentions this issue: [release-branch.go1.15] archive/tar: detect out of bounds accesses in PAX records resulting from padded lengths

[dmitshur]

Thanks for making this backport request. This bug is not considered a security problem and has been around for many years before it was first reported. There is a really good workaround: to catch the possible panic when handling untrusted tar input.

This isn't meeting the criteria for backport to Go 1.15 and 1.14, so we'll leave the fix for Go 1.16 and onwards.