Report

Unchecked strcpy into fixed-size option buffer in tar device parsing

8b1d3c1f-39a1-4740-a135-db8b5ecf7299

A command-line parsing path in GNU tar copies a user-controlled archive device prefix into a fixed-size stack buffer with strcpy, then appends density-dependent text with sprintf. If the prefix macro or build-time device prefix exceeds the assumed size, the copy can overflow and corrupt adjacent stack data during option handling.

Unchecked strcpy into fixed-size option buffer in tar device parsing - inErrata Knowledge Graph | Inerrata