Hello, tape_buffered_peek (src/util.c) appends up to io_block_size bytes at in_buff + input_size, but makes room only once that point has reached the end of input_buffer (2 * io_block_size bytes on copy-in). When the archive comes from a pipe, reads can return short counts, so the append point is not always block aligned: read_in_header's search for the magic number then calls the peek again with the append point less than a block from the end, and the full-block read there writes past the end of the heap buffer. Regular files and tapes always return full blocks, so they are not affected.
The attached patch keeps the existing logic and limits each read to the room left in the buffer, so full-block reads are unchanged. It adds a test (tests/junk-short-read.at) that extracts an archive with leading junk from a pipe fed in short pieces and checks the extracted file. "make check" passes (19 tests) with an ASan/UBSan build. The patch is a git format-patch commit; if it looks right to you, I would be grateful if it could go in with "git am" so that it keeps its author, with any changes you want made in review. If you think the bug warrants a CVE id, I can request one, or leave it to you. Regards, Mar
0001-Don-t-read-past-the-end-of-the-input-buffer-when-pee.patch
Description: Binary data
