Hi Cole, Thanks for a detailed rationale. You are right. I have installed the attached patch.
Regards, Sergey
>From e5bb73f8c2f32a999bdec31cdcaea8068875677c Mon Sep 17 00:00:00 2001 From: Sergey Poznyakoff <[email protected]> Date: Sat, 29 Aug 2026 09:34:40 +0300 Subject: [PATCH] Insist that uname and gname fields of a tar archive be nul-terminated. * src/tar.c (read_in_tar_header): Check for proper formatting of uname and gname fields. Ignore them if the check fails. --- src/tar.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/src/tar.c b/src/tar.c index 9ef5184..fc9bde9 100644 --- a/src/tar.c +++ b/src/tar.c @@ -351,16 +351,23 @@ read_in_tar_header (struct cpio_file_stat *file_hdr, int in_des) file_hdr->c_nlink = 1; file_hdr->c_mode = FROM_OCTAL (tar_hdr->mode); file_hdr->c_mode = file_hdr->c_mode & 07777; - /* Debian hack: This version of cpio uses the -n flag also to extract - tar archives using the numeric UID/GID instead of the user/group - names in /etc/passwd and /etc/groups. (98/10/15) -BEM */ + + /* Make sure uname and gname are nul-terminated */ + if (!memchr (tar_hdr->uname, 0, sizeof (tar_hdr->uname))) + tar_hdr->uname[0] = 0; + + if (!memchr (tar_hdr->gname, 0, sizeof (tar_hdr->gname))) + tar_hdr->gname[0] = 0; + if (archive_format == arf_ustar && !numeric_uid + && tar_hdr->uname[0] && (uidp = getuidbyname (tar_hdr->uname))) file_hdr->c_uid = *uidp; else file_hdr->c_uid = FROM_OCTAL (tar_hdr->uid); if (archive_format == arf_ustar && !numeric_uid + && tar_hdr->gname[0] && (gidp = getgidbyname (tar_hdr->gname))) file_hdr->c_gid = *gidp; else -- 2.35.1
