From: Johannes Schindelin via GitGitGadget Date: Wed, 14 Oct 2026 06:09:27 GMT Subject: [PATCH 1/5] archive-tar: guard get_path_prefix against zero-length input Message-ID: In-Reply-To: From: Johannes Schindelin The `get_path_prefix()` function uses a `do ... while()` loop that unconditionally decrements the `size_t` index variable before checking the loop condition. When that variable is 0 on entry, the decrement wraps to `SIZE_MAX`, and `path[SIZE_MAX]` is an out-of-bounds read. The current caller (`write_tar_entry()`) only invokes this function when `pathlen > sizeof(header.name)` i.e. when `pathlen` is at least 100. Therefore, the bug is unreachable in practice. However, the function's interface accepts arbitrary pathlen and maxlen values, and a future caller or a maxlen of 0 could trigger the wrap, so let's add a check for that. Pointed out by Coverity. Assisted-by: Claude Opus 4.6 Signed-off-by: Johannes Schindelin --- archive-tar.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/archive-tar.c b/archive-tar.c index a1c66024d4..2da6e55484 100644 --- a/archive-tar.c +++ b/archive-tar.c @@ -210,6 +210,8 @@ static size_t get_path_prefix(const char *path, size_t pathlen, size_t maxlen) i--; if (i > maxlen) i = maxlen; + if (!i) + return 0; do { i--; } while (i > 0 && path[i] != '/'); -- gitgitgadget