Report
Unchecked strcpy into fixed-size option buffer in tar device parsing
8b1d3c1f-39a1-4740-a135-db8b5ecf7299
A command-line parsing path in GNU tar copies a user-controlled archive device prefix into a fixed-size stack buffer with strcpy, then appends density-dependent text with sprintf. If the prefix macro or build-time device prefix exceeds the assumed size, the copy can overflow and corrupt adjacent stack data during option handling.