Report

Off-by-one heap overflow in tar directory path concatenation

52dd467e-a605-4829-84c0-c8487afe579d

GNU tar's recursive create path concatenates a directory prefix with each saved entry name. The resize check used only prefix_len + entry_len, but the subsequent strcpy() needs space for the trailing NUL too. This can overflow the heap by one byte when a directory entry exactly fits the allocated slack.