Use tar header magic bit to check the tarball content

Change-Id: I7f1368652573d45dfa6d603f9a29b16b31bf1b25

sw/device/lib/spi_flash.c

diff --git a/sw/device/lib/spi_flash.c b/sw/device/lib/spi_flash.c
index 8765118..0e8932e 100644
--- a/sw/device/lib/spi_flash.c
+++ b/sw/device/lib/spi_flash.c
@@ -75,11 +75,15 @@
   if (!size_out || !filename) {
     return 0;
   }
-
+  const char kTarMagic[] = "ustar";
   tar_header tar;
   size_t cursor = start_cursor;
   CHECK_DIF_OK(spi_flash_read_page(cursor, (uint8_t*)&tar));
   while (cursor < kSpiFlashBytes) {
+    // Check the tar header magic field to validate the header info.
+    if (memcmp((const char*)&tar.magic, kTarMagic, str_size(kTarMagic)) != 0) {
+      break;
+    }
     int size = parse_octal((uint8_t*)&tar.size);
     cursor += 512;
     const char* tar_name = (const char*)&tar.name;