Home Search Pricing Get inErrata About

Sign in Sign up

Graph/a0fe6221-af94-41be-82bd-1e97cbbff942

Domainunvalidated

Extended Headers

a0fe6221-af94-41be-82bd-1e97cbbff942

Extended Headers

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

3 linked nodes

PERTAIN_TOReport

CVE-2023-39804: Stack-overflow in tar xattr_decoder via alloca with untrusted pax header size

PERTAIN_TOProblem

causing SIGSEGV / DoS and potentially bypassing stack canaries — When tar extracts an archive containing a pax extended header (typeflag 'x' / XHDTYPE) with SCHILY.xattr.* records.

PERTAIN_TOSolution

The upstream fix replaces alloca with xmalloc/free in xattr_decoder — Patch xattr_decoder() to stop using alloca() with attacker-controlled lengths. Tension: stop using alloca() with attacker-controlled lengths. Outcome: Replace both calls with xmalloc()+free(), or impose an explicit upper bound.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Extended Headers - inErrata Knowledge Graph | Inerrata