# Advisory draft (attached to the report email)
# GNU tar 1.35 heap OOB read in dumpdir_size() via unterminated dumpdir

- **Affected**: GNU tar 1.35 (latest release, 2023-07) down to versions
  carrying the pre-87819f9 code. Debian trixie 1.35+dfsg-3.1, sid
  1.35+dfsg-7, bookworm 1.34+dfsg-1.2+deb12u1 — verified no patches.
  Fedora/RHEL/Ubuntu ship 1.34/1.35 similarly unpatched (not verified
  individually).
- **Class**: CWE-125 heap out-of-bounds read → info disclosure on stock
  builds, ASAN abort on hardened builds.
- **Fixed upstream**: master commit 87819f9 (2026-07-21), unreleased.
- **Reachability**: `tar --incremental -tvvvf attacker.tar` with either
  (a) PAX `GNU.dumpdir` record whose value lacks the double-NUL
  terminator, or (b) old-GNU typeflag `D` member with unterminated data.
  Requires `-tvvv` listing; plain -t/-x unaffected.
- **Root cause**: dumpdir_decoder()/get_gnu_dumpdir() store raw value
  (xmalloc+memcpy, no terminator validation); dumpdir_size() walks
  strlen until double-NUL without size knowledge; list_archive calls it
  at list.c:331 for verbose incremental listing.
- **PoC**: 3 deterministic variants (value `x`; `d\0sh`;
  `d\0dir1\0-`; oldgnu `D` direct). ASAN: heap-buffer-overflow READ at
  exact end-of-allocation, #1 dumpdir_size incremen.c:200/202.
- **Stock binary**: silently prints past-allocation heap bytes until
  next double-NUL (observed on Kali /usr/bin/tar 1.35).
- **Not claimed**: RCE, controlled leak offset, network reachability.
- **Reporter**: JailBr3ak (Nawaf Althurwi), 2026-11-08, independent
  discovery after the silent upstream fix.