F29 number-size-base256-negativeA negative base-256 size in the header, -512, which a member cannot have.
Reject(draft) A strict parser must reject this archive.
F29-number-size-base256-negative.tar |
test archive, 2,048 bytes
sha256 fe1f7a6559dad8a7b1a0c5f0f80601ef06065748a5f34997bb51cb650169bb5b |
F29-number-size-base256-negative.json | expected result |
F29-number-size-base256-negative.txt | annotated blocks |
F29-number-size-base256-negative.py | generator script |
GNU tar writes numbers too large for octal in base 256: the first byte of the field is 0x80 for a positive number, and 0xff for a negative one, in two's complement. A negative size is meaningless, but the encoding allows it. Read leniently, this case is ambiguous because the size is 0, 512 without its sign, or the field read as an unsigned number. With 0 the next block is the header of smuggled, with 512 the data of a, and the unsigned number runs past the end of the archive.
Decision point: whether a size may be negative, and what a negative one means.
Seen in: none of the scanned tarballs.
Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.
F29-number-size-base256-negative: must reject
A negative base-256 size in the header, -512, which a member cannot have.
GNU tar writes numbers too large for octal in base 256: the first byte of the field is 0x80 for a
positive number, and 0xff for a negative one, in two's complement. A negative size is meaningless,
but the encoding allows it. Read leniently, this case is ambiguous because the size is 0, 512
without its sign, or the field read as an unsigned number. With 0 the next block is the header of
`smuggled`, with 512 the data of `a`, and the unsigned number runs past the end of the archive.
Decision point: whether a size may be negative, and what a negative one means.
Seen in: none of the scanned tarballs.
0x000000 header: regular file, size -512, in base 256
name [ 0,100) "a" + 99 NUL
mode [100,108) "0000644" + NUL 644 (octal)
uid [108,116) "0000000" + NUL 0
gid [116,124) "0000000" + NUL 0
size [124,136) "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\0" -512: base-256
mtime [136,148) "00000000000" + NUL 0
chksum [148,156) "013702\0 " 6082: the unsigned sum of the header, this field as spaces
typeflag [156,157) "0" regular file
linkname [157,257) 100 NUL
magic [257,263) "ustar" + NUL
version [263,265) "00"
uname [265,297) 32 NUL
gname [297,329) 32 NUL
devmajor [329,337) "0000000" + NUL 0
devminor [337,345) "0000000" + NUL 0
prefix [345,500) 155 NUL
pad [500,512) 12 NUL
0x000200 header: regular file, a member, unless a reading of the size covers it
name [ 0,100) "smuggled" + 92 NUL
mode [100,108) "0000644" + NUL 644 (octal)
uid [108,116) "0000000" + NUL 0
gid [116,124) "0000000" + NUL 0
size [124,136) "00000000000" + NUL 0
mtime [136,148) "00000000000" + NUL 0
chksum [148,156) "010725\0 " 4565: the unsigned sum of the header, this field as spaces
typeflag [156,157) "0" regular file
linkname [157,257) 100 NUL
magic [257,263) "ustar" + NUL
version [263,265) "00"
uname [265,297) 32 NUL
gname [297,329) 32 NUL
devmajor [329,337) "0000000" + NUL 0
devminor [337,345) "0000000" + NUL 0
prefix [345,500) 155 NUL
pad [500,512) 12 NUL
0x000400 2 zero blocks: the end-of-archive marker
0x000800 end of file
As xxd writes it: xxd -r makes the archive of it.
00000000: 6100 0000 0000 0000 0000 0000 0000 0000 a............... 00000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000060: 0000 0000 3030 3030 3634 3400 3030 3030 ....0000644.0000 00000070: 3030 3000 3030 3030 3030 3000 ffff ffff 000.0000000..... 00000080: ffff ffff ffff fe00 3030 3030 3030 3030 ........00000000 00000090: 3030 3000 3031 3337 3032 0020 3000 0000 000.013702. 0... 000000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000100: 0075 7374 6172 0030 3000 0000 0000 0000 .ustar.00....... 00000110: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000120: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000130: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000140: 0000 0000 0000 0000 0030 3030 3030 3030 .........0000000 00000150: 0030 3030 3030 3030 0000 0000 0000 0000 .0000000........ 00000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000200: 736d 7567 676c 6564 0000 0000 0000 0000 smuggled........ 00000210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000230: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000240: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000250: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000260: 0000 0000 3030 3030 3634 3400 3030 3030 ....0000644.0000 00000270: 3030 3000 3030 3030 3030 3000 3030 3030 000.0000000.0000 00000280: 3030 3030 3030 3000 3030 3030 3030 3030 0000000.00000000 00000290: 3030 3000 3031 3037 3235 0020 3000 0000 000.010725. 0... 000002a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000300: 0075 7374 6172 0030 3000 0000 0000 0000 .ustar.00....... 00000310: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000320: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000330: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000340: 0000 0000 0000 0000 0030 3030 3030 3030 .........0000000 00000350: 0030 3030 3030 3030 0000 0000 0000 0000 .0000000........ 00000360: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000370: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000380: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000390: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000400: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000410: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000420: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000430: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000440: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000450: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000460: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000470: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000480: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000490: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000500: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000510: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000520: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000530: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000540: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000550: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000560: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000570: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000580: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000590: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000600: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000610: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000620: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000630: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000640: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000650: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000660: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000670: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000680: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000690: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000700: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000710: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000720: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000730: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000740: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000750: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000760: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000770: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000780: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000790: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
| implementation | version | outcome | what it makes of it |
|---|---|---|---|
| GNU tar | tar (GNU tar) 1.35 | ✅ as the verdict says | error: tar: Archive value -512 is out of off_t range 0..9223372036854775807 tar: This does not look like a tar archive tar: Skipping to next header tar: Exiting with failure status due to previous errors |
| bsdtar | bsdtar 3.8.10 - libarchive 3.8.10 | ✅ as the verdict says | error: bsdtar: Tar entry has negative file size bsdtar: Error exit delayed from previous errors |
| BusyBox tar | BusyBox v1.38.0, defconfig | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| 7-Zip | 7-Zip (z) 26.05 (x64) | ✅ as the verdict says | error: ERROR: suite/archives/F29-number-size-base256-negative.tar suite/archives/F29-number-size-base256-negative.tar Open ERROR: Cannot open the file as [tar] archive ERRORS: Is not archive |
| Python tarfile, filter=data, as in pip | CPython 3.15.2 | ✅ as the verdict says | error: ReadError: file could not be opened successfully: - method gz: ReadError('not a gzip file') - method bz2: ReadError('not a bzip2 file') - method xz: ReadError('not an lzma file') - method zst: ReadEr… |
| Python tarfile, filter=tar | CPython 3.15.2 | ✅ as the verdict says | error: ReadError: file could not be opened successfully: - method gz: ReadError('not a gzip file') - method bz2: ReadError('not a bzip2 file') - method xz: ReadError('not an lzma file') - method zst: ReadEr… |
| Python tarfile, filter=fully_trusted | CPython 3.15.2 | ✅ as the verdict says | error: ReadError: file could not be opened successfully: - method gz: ReadError('not a gzip file') - method bz2: ReadError('not a bzip2 file') - method xz: ReadError('not an lzma file') - method zst: ReadEr… |
| node-tar | tar 7.5.22 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| node-tar, strict | tar 7.5.22 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| tar-fs | tar-fs 3.1.3, on tar-stream 3.2.2 | ✅ as the verdict says | error: Error: Invalid header |
| Java Commons Compress | Commons Compress 1.28.0, Expander, on Java 27.0.1.0.2 | ✅ as the verdict says | error: java.io.IOException: broken archive, entry with negative size |
| .NET System.Formats.Tar | System.Formats.Tar of .NET 10.0.14, ExtractToDirectory | ✅ as the verdict says | error: InvalidDataException: The size field is negative in a tar entry. |
| PHP PharData, as in Composer | PharData of PHP 8.5.12, as Composer's TarDownloader calls it | ✅ as the verdict says | error: UnexpectedValueException: phar error: "suite/archives/F29-number-size-base256-negative.tar" is a corrupted tar file (invalid entry size) |
| Go containerd archive.Apply | containerd v2.4.2, archive.Apply, of go1.27.3 | ✅ as the verdict says | error: archive/tar: invalid tar header |
| Rust tar | tar 0.4.46, unpack | ✅ as the verdict says | error: failed to iterate over archive |
| Rust astral-tokio-tar | astral-tokio-tar 0.7.0, unpack | ✅ as the verdict says | error: failed to iterate over archive |
| Rust tar-codec, as in uv | tar-codec 0.0.15, with the policies of uv 0.13 | ✅ as the verdict says | error: at byte 0: invalid tar size field: found [255, 255, 255, 255, 255, 255, 255, 255, 255, 255, 254, 0] |
| RubyGems | RubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz | ✅ as the verdict says | error: Gem::Package::TarInvalidError: "\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFF\xFE" is not an octal string |
| R untar, internal | utils::untar of R 4.6.1, tar = "internal" | ✅ as the verdict says | error: invalid octal digit |
| Perl Archive::Tar | Archive::Tar 3.12 of Perl v5.44.0 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Haskell tar | tar 0.7.2.0, extract, of GHC 9.14 | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| Julia Tar.jl | Tar 1.10.0 of Julia 1.13.3 | ✅ as the verdict says | error: binary integer size value too large: "\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xfe\0" [header block data]: name = … |
| live-bootstrap untar | mescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc | ✅ as the verdict says | error: Checksum failure The extraction of suite/archives/F29-number-size-base256-negative.tar produced errors |
| live-bootstrap untar, --non-strict | mescc-tools-extra a151c245e512, as live-bootstrap pins it, built with cc | ✅ as the verdict says | error: non-strict mode enabled, preparing for chaos Checksum failure The extraction of suite/archives/F29-number-size-base256-negative.tar produced errors |
Release tarballs of Spack, nixpkgs, Guix and live-bootstrap, and samples of PyPI, crates.io and RubyGems with number.size.base256-negative.
| ecosystem | tarballs | with it | share |
|---|---|---|---|
| Spack | 37,553 | 0 | none |
| nixpkgs | 18,990 | 0 | none |
| Guix | 10,168 | 0 | none |
| PyPI | 10,000 | 0 | none |
| crates.io | 5,000 | 0 | none |
| RubyGems | 5,000 | 0 | none |
| live-bootstrap | 171 | 0 | none |
| total (distinct) | 82,586 | 0 | none |