I can confirm this independently. On upstream head e5bb73f8, an ASan/UBSan build of cpio reports a heap-buffer-overflow WRITE of 512 bytes at the end of the 1024-byte input buffer when cpio -i reads a junk-prefixed archive from a pipe with short reads (3 of 3 runs; a single burst is clean).
I have not tested the attached patch yet. Regards, Vivek Kumar
