archive/tar: return ErrHeader on V7/USTAR UID/GID integer overflow

[TurboRx]

When unpacking the V7/USTAR header, numeric UID and GID values are parsed
via p.parseNumeric, but are subsequently cast directly to platform-native
int without bounds checking. On 32-bit platforms, values >= 2^32 silently
truncate to 0 or wrap to negative numbers.

This change verifies that the parsed int64 fits within [math.MinInt,
math.MaxInt] and sets p.err to ErrHeader if out of bounds, matching the
behavior added to mergePAX.

Fixes #81446
Fixes #82121

[gopherbot]

This PR (HEAD: 5c3312c) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from Gopher Robot:

Patch Set 1:

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

This PR (HEAD: d02cff4) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from 14侯廷翰（10122 侯廷翰）:

Patch Set 3: Code-Review+1

(5 comments)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

This PR (HEAD: 1c40f24) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from Pranay Debnath:

Patch Set 4:

(5 comments)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from 14侯廷翰（10122 侯廷翰）:

Patch Set 4: Code-Review+1

(1 comment)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from qiu laidongfeng:

Patch Set 4: Commit-Queue+1

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com:

Patch Set 4:

Dry run: CV is trying the patch.

Bot data: {"action":"start","triggered_at":"2026-10-11T06:18:51Z","revision":"78da43ece3d0473fe4f23aaa1e2da234c79bb192"}

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from qiu laidongfeng:

Patch Set 4: -Commit-Queue

(Performed by <GERRIT_ACCOUNT_60063> on behalf of <GERRIT_ACCOUNT_64033>)

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com:

Patch Set 4:

This CL has passed the run

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

Message from golang-scoped@luci-project-accounts.iam.gserviceaccount.com:

Patch Set 4: LUCI-TryBot-Result+1

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!

[gopherbot]

This PR (HEAD: a4ede38) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

This PR (HEAD: a4d44d5) has been imported to Gerrit for code review.

Please visit Gerrit at https://go-review.googlesource.com/c/go/+/831024.

Important tips:

• Don't comment on this PR. All discussion takes place in Gerrit.
• You need a Gmail or other Google account to log in to Gerrit.
• To change your code in response to feedback:
  • Push a new commit to the branch used by your GitHub PR.
  • A new "patch set" will then appear in Gerrit.
  • Respond to each comment by marking as Done in Gerrit if implemented as suggested. You can alternatively write a reply.
  • Critical: you must click the blue Reply button near the top to publish your Gerrit responses.
  • Multiple commits in the PR will be squashed by GerritBot.
• The title and description of the GitHub PR are used to construct the final commit message.
  • Edit these as needed via the GitHub web interface (not via Gerrit or git).
  • You should word wrap the PR description at ~76 characters unless you need longer lines (e.g., for tables or URLs).
• See the Sending a change via GitHub and Reviews sections of the Contribution Guide as well as the FAQ for details.

[gopherbot]

Message from 14侯廷翰（10122 侯廷翰）:

Patch Set 6: Code-Review+1

PS6 is a clean rebase of PS4 (range-diff shows no code changes; the stray
conflict marker that was in PS5's reader_test.go is gone).

Re-tested PS6 locally: go test archive/tar passes on amd64 and GOARCH=386,
go vet and gofmt are clean, and with the reader.go/strconv.go/common.go
changes reverted the new TestHeaderNumericIDIntegerOverflow fails on 386
(7 subtests) as before. +1 again.

---

Please don’t reply on this GitHub thread. Visit golang.org/cl/831024.
After addressing review feedback, remember to publish your drafts!