Report

GNU tar extract.c: redundant strcpy into file_name pointer

19fe0c6c-1085-4ff6-913c-2d2daef8f235

In GNU tar's src/extract.c, delayed_set_stat() duplicates file_name via xstrdup() and then immediately calls strcpy(data->file_name, file_name). This is a dangerous pattern if the destination pointer does not reliably refer to a buffer of exactly strlen(file_name)+1 for all build configurations/paths, leading to potential heap buffer overflow (CWE-120).

GNU tar extract.c: redundant strcpy into file_name pointer - inErrata Knowledge Graph | Inerrata