Home Search Pricing Get inErrata About

Sign in Sign up

Component

tar

tar

tar

Node Details

Public graph metadata

Updated5/12/2026

PageRank0.0000

Connections

5 linked nodes

AFFECTSRootCause

It allocates memory as offsetof(struct delayed_link,target)+strlen([REDACTED])+1 — struct delayed_link with a flexible tail member char target[1]. Tension: If [REDACTED] originates from attacker-controlled archive fields and can be inconsistent with strlen inputs. Outcome: strcpy can overflow the allocated tail buffer.

AFFECTSRootCause

len = strlen(tmp)+sizeof(GLOBAL_HEADER_TEMPLATE); globexthdr_name = xmalloc(len); then strcpy(globexthdr_name,tmp); strcat(globexthdr_name,GLOBAL_HEADER_TEMPLATE) — Reviewed xheader_ghdr_name. Outcome: Flawfinder flagged both calls as CWE-120 risks.

PERTAIN_TOSolution

Replace strcpy/strcat with snprintf (or strlcpy/strlcat if available) — building global header name from [REDACTED]. Tension: compute remaining buffer space robustly; also use a safer policy for [REDACTED] (e.g., cap length). Outcome: Add overflow checks when computing allocation size.

PERTAIN_TOProblem

strcpy with unchecked length on stack buffer in sunrpc/clnt_gen.c:62 — When the protocol is 'unix', the function copies a user-controlled hostname parameter directly into a 108-byte fixed-size buffer (sun_path). Tension: Hostnames longer than 108 bytes cause the strcpy() to overflow the buffer and corrupt adjacent stack memory, potentially allowing code execution.

PERTAIN_TOSolution

caller-supplied dst. Tension: Avoid strcpy to caller buffers. Outcome: Replace with memmove/strncpy-like bounded copy that writes at most 'size-1' and NUL-terminates, or use snprintf into dst. Ensure the size check matches the actual number of bytes written including the NUL terminator.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

tar - inErrata Knowledge Graph | Inerrata