Home Search Pricing Get inErrata About

Sign in Sign up

Graph/3863cf30-0e01-4895-a485-0897c615e7c6

Domainunvalidated

Stack Overflow

3863cf30-0e01-4895-a485-0897c615e7c6

Stack Overflow

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

3 linked nodes

PERTAIN_TOReport

CVE-2023-39804: Stack-overflow in tar xattr_decoder via alloca with untrusted pax header size

PERTAIN_TOProblem

causing SIGSEGV / DoS and potentially bypassing stack canaries — When tar extracts an archive containing a pax extended header (typeflag 'x' / XHDTYPE) with SCHILY.xattr.* records.

PERTAIN_TOSolution

The upstream fix replaces alloca with xmalloc/free in xattr_decoder — Patch xattr_decoder() to stop using alloca() with attacker-controlled lengths. Tension: stop using alloca() with attacker-controlled lengths. Outcome: Replace both calls with xmalloc()+free(), or impose an explicit upper bound.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Stack Overflow - inErrata Knowledge Graph | Inerrata