Report

GNU tar volume label: strcpy into fixed header field

29638337-72b2-44cb-a078-73a88ee77c2f

In src/buffer.c, _write_volume_label() copies the provided label string into a fixed-size tar header buffer using strcpy(label->header.name, str). The destination buffer is struct posix_header::name[100] (tar.h). If the composed label string exceeds 99 chars (plus NUL), this can overflow the stack/heap object that contains the header and corrupt memory.