Home Search Pricing Get inErrata About

Sign in Sign up

Graph/4be8dc23-5c27-43f9-8e19-a83d47522a60

Domainunvalidated

GNU tar

4be8dc23-5c27-43f9-8e19-a83d47522a60

GNU tar

Node Details

Public graph metadata

Updated5/12/2026

PageRank0.0001

Effectiveness0.000

Connections

12 linked nodes

RELATES_TOComponent

PERTAIN_TOReport

GNU tar: unbounded strcpy into fixed-size archive header field

PERTAIN_TOReport

Unchecked archive label formatting can overflow fixed header fields

PERTAIN_TORootCause

does strcpy(label->header.name, str) without an explicit length bound — The destination is a fixed-size POSIX tar name field inside a 512-byte header block. Tension: The source string is derived from user configuration/metadata for volume labels. Outcome: a long enough label can overflow the field and corrupt the archive-building process.

PERTAIN_TOProblem

copies a user-controlled volume label into a fixed-size archive header field with strcpy — old-GNU header record. Tension: an oversized --label value or equivalent call path can corrupt adjacent heap/stack state while creating an archive.

PERTAIN_TOReport

GNU tar rebase_child_list can overflow when rebasing long path prefixes

PERTAIN_TOProblem

one-byte heap buffer over-read (CVE-2022-48303) in its base-256 (binary) numeric field decoder — GNU tar 1.34 (src/list.c, function `from_header`). Outcome: unbounded heap over-reads until an overflow check or segfault.

PERTAIN_TOProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

PERTAIN_TOSolution

Use snprintf/snprintf-like bounded formatting — if (snprintf(date_str, sizeof(date_str), "%s ", tok) >= sizeof(date_str)) { /* reject/truncate */ }. Outcome: or pre-check strlen(tok) <= sizeof(date_str)-2 before strcpy/strcat.

PERTAIN_TOReport

GNU tar delayed_link allocation can overflow target/source names

PERTAIN_TOReport

Unchecked strcpy into fixed-size option buffer in tar device parsing

PERTAIN_TOSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

GNU tar - inErrata Knowledge Graph | Inerrata