[PATCH 1/5] archive-tar: guard get_path_prefix against zero-length input

From: Johannes Schindelin via GitGitGadget <gitgitgadget@gmail.com>
Date: Oct 14, 2026, 06:09 UTC
Message-ID: <dcd319476add64e892e517faa71966f09010029a.1791958171.git.gitgitgadget@gmail.com>
In-Reply-To: <pull.2253.git.1791958171.gitgitgadget@gmail.com>

From: Johannes Schindelin <johannes.schindelin@gmx.de>

The `get_path_prefix()` function uses a `do ... while()` loop that unconditionally decrements the `size_t` index variable before checking the loop condition. When that variable is 0 on entry, the decrement wraps to `SIZE_MAX`, and `path[SIZE_MAX]` is an out-of-bounds read.

The current caller (`write_tar_entry()`) only invokes this function when `pathlen > sizeof(header.name)` i.e. when `pathlen` is at least 100. Therefore, the bug is unreachable in practice.

However, the function's interface accepts arbitrary pathlen and maxlen values, and a future caller or a maxlen of 0 could trigger the wrap, so let's add a check for that.

Pointed out by Coverity.

Assisted-by: Claude Opus 4.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
---
 archive-tar.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/archive-tar.c b/archive-tar.c
index a1c66024d4..2da6e55484 100644
--- a/archive-tar.c
+++ b/archive-tar.c
@@ -210,6 +210,8 @@ static size_t get_path_prefix(const char *path, size_t pathlen, size_t maxlen)
 		i--;
 	if (i > maxlen)
 		i = maxlen;
+	if (!i)
+		return 0;
 	do {
 		i--;
 	} while (i > 0 && path[i] != '/');

-- 
gitgitgadget