Report

GNU tar src/tar.c optloc_save uses strcpy into freshly allocated buffer without explicit bound/cap

77f14607-6db7-4f22-b8ec-c69b6c0b4940

In GNU tar's src/tar.c, optloc_save allocates memory based on strlen(loc->name)+1 but then copies with strcpy into the computed tail pointer. If loc->name is not a valid NUL-terminated string (e.g., corrupted option_locus state or attacker-controlled buffer without terminator), strcpy will read past bounds and overflow the allocated chunk, leading to memory corruption.