F41 number-size-leading-nulA size with a NUL before its digits, which takes the next header for its data.
Reject(draft) A strict parser must reject this archive.
F41-number-size-leading-nul.tar |
test archive, 2,048 bytes
sha256 7ba8ea57b3ba37094608b30636481ac6d7b1380783d057f4f9866a26dab19b7f |
F41-number-size-leading-nul.json | expected result |
F41-number-size-leading-nul.txt | annotated blocks |
F41-number-size-leading-nul.py | generator script |
The archive has a file a, whose size field is a NUL, followed by the digits 0000001000, followed by a NUL, then an empty file smuggled.
In POSIX, numeric fields are octal numbers filled with leading zeros, and each is terminated by a space or a NUL. Read leniently, this case is ambiguous because the size is either 512, octal 1000, if the NUL in front is skipped (and the next block is the data of a), or 0, if the field ends at its first NUL (and the next block is the header of smuggled).
Decision point: how a numeric field with a NUL before its digits is read.
Seen in: none of the scanned tarballs.
Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.
F41-number-size-leading-nul: must reject
A size with a NUL before its digits, which takes the next header for its data.
The archive has a file `a`, whose size field is a NUL, followed by the digits `0000001000`, followed
by a NUL, then an empty file `smuggled`.
In POSIX, numeric fields are octal numbers filled with leading zeros, and each is
terminated by a space or a NUL. Read leniently, this case is ambiguous because the size
is either 512, octal 1000, if the NUL in front is skipped (and the next block is the data of `a`),
or 0, if the field ends at its first NUL (and the next block is the header of `smuggled`).
Decision point: how a numeric field with a NUL before its digits is read.
Seen in: none of the scanned tarballs.
0x000000 header: regular file, a NUL, then 512 in octal
name [ 0,100) "a" + 99 NUL
mode [100,108) "0000644" + NUL 644 (octal)
uid [108,116) "0000000" + NUL 0
gid [116,124) "0000000" + NUL 0
size [124,136) "\00000001000" + NUL
mtime [136,148) "00000000000" + NUL 0
chksum [148,156) "007257\0 " 3759: the unsigned sum of the header, this field as spaces
typeflag [156,157) "0" regular file
linkname [157,257) 100 NUL
magic [257,263) "ustar" + NUL
version [263,265) "00"
uname [265,297) 32 NUL
gname [297,329) 32 NUL
devmajor [329,337) "0000000" + NUL 0
devminor [337,345) "0000000" + NUL 0
prefix [345,500) 155 NUL
pad [500,512) 12 NUL
0x000200 header: regular file, the data of a, to a reader that skips the NUL
name [ 0,100) "smuggled" + 92 NUL
mode [100,108) "0000644" + NUL 644 (octal)
uid [108,116) "0000000" + NUL 0
gid [116,124) "0000000" + NUL 0
size [124,136) "00000000000" + NUL 0
mtime [136,148) "00000000000" + NUL 0
chksum [148,156) "010725\0 " 4565: the unsigned sum of the header, this field as spaces
typeflag [156,157) "0" regular file
linkname [157,257) 100 NUL
magic [257,263) "ustar" + NUL
version [263,265) "00"
uname [265,297) 32 NUL
gname [297,329) 32 NUL
devmajor [329,337) "0000000" + NUL 0
devminor [337,345) "0000000" + NUL 0
prefix [345,500) 155 NUL
pad [500,512) 12 NUL
0x000400 2 zero blocks: the end-of-archive marker
0x000800 end of file
As xxd writes it: xxd -r makes the archive of it.
00000000: 6100 0000 0000 0000 0000 0000 0000 0000 a............... 00000010: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000020: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000030: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000060: 0000 0000 3030 3030 3634 3400 3030 3030 ....0000644.0000 00000070: 3030 3000 3030 3030 3030 3000 0030 3030 000.0000000..000 00000080: 3030 3031 3030 3000 3030 3030 3030 3030 0001000.00000000 00000090: 3030 3000 3030 3732 3537 0020 3000 0000 000.007257. 0... 000000a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000000f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000100: 0075 7374 6172 0030 3000 0000 0000 0000 .ustar.00....... 00000110: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000120: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000130: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000140: 0000 0000 0000 0000 0030 3030 3030 3030 .........0000000 00000150: 0030 3030 3030 3030 0000 0000 0000 0000 .0000000........ 00000160: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000170: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000180: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000190: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000001f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000200: 736d 7567 676c 6564 0000 0000 0000 0000 smuggled........ 00000210: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000220: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000230: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000240: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000250: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000260: 0000 0000 3030 3030 3634 3400 3030 3030 ....0000644.0000 00000270: 3030 3000 3030 3030 3030 3000 3030 3030 000.0000000.0000 00000280: 3030 3030 3030 3000 3030 3030 3030 3030 0000000.00000000 00000290: 3030 3000 3031 3037 3235 0020 3000 0000 000.010725. 0... 000002a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000002f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000300: 0075 7374 6172 0030 3000 0000 0000 0000 .ustar.00....... 00000310: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000320: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000330: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000340: 0000 0000 0000 0000 0030 3030 3030 3030 .........0000000 00000350: 0030 3030 3030 3030 0000 0000 0000 0000 .0000000........ 00000360: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000370: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000380: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000390: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000003f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000400: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000410: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000420: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000430: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000440: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000450: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000460: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000470: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000480: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000490: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000004f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000500: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000510: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000520: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000530: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000540: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000550: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000560: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000570: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000580: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000590: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000005f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000600: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000610: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000620: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000630: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000640: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000650: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000660: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000670: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000680: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000690: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000006f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000700: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000710: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000720: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000730: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000740: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000750: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000760: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000770: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000780: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 00000790: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007a0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007b0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007c0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007d0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007e0: 0000 0000 0000 0000 0000 0000 0000 0000 ................ 000007f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
In the outcome column, ✅ means that the implementation follows the default policy.
| implementation | version | outcome | what it makes of it |
|---|---|---|---|
| GNU tar | tar (GNU tar) 1.35 | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| bsdtar | bsdtar 3.8.11 - libarchive 3.8.11 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| BusyBox tar | BusyBox v1.38.0, defconfig | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| 7-Zip | 7-Zip (z) 26.05 (x64) | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Python tarfile, filter=data, as in pip | CPython 3.15.2 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Python tarfile, filter=tar | CPython 3.15.2 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Python tarfile, filter=fully_trusted | CPython 3.15.2 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| node-tar | tar 7.5.22 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| node-tar, strict | tar 7.5.22 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| tar-fs | tar-fs 3.1.3, on tar-stream 3.2.2 | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| Java Commons Compress | Commons Compress 1.28.0, Expander, on Java 27.0.1.0.2 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| .NET System.Formats.Tar | System.Formats.Tar of .NET 10.0.14, ExtractToDirectory | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| PHP PharData, as in Composer | PharData of PHP 8.5.12, as Composer's TarDownloader calls it | ✅ rejects | error: UnexpectedValueException: phar error: "suite/archives/F41-number-size-leading-nul.tar" is a corrupted tar file (invalid entry size) |
| Go containerd archive.Apply | containerd v2.4.2, archive.Apply, of go1.27.3 | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| Rust tar | tar 0.4.46, unpack | ✅ rejects | error: failed to iterate over archive |
| Rust astral-tokio-tar | astral-tokio-tar 0.7.1, unpack | ✅ rejects | error: failed to iterate over archive |
| Rust tar-codec, as in uv | tar-codec 0.0.16, with the policies of uv 0.13 | ✅ rejects | error: at byte 0: invalid tar size field: found [0, 48, 48, 48, 48, 48, 48, 49, 48, 48, 48, 0] |
| RubyGems | RubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| R untar, internal | utils::untar of R 4.6.2, tar = "internal" | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Perl Archive::Tar | Archive::Tar 3.12 of Perl v5.44.0 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Haskell tar | tar 0.7.2.0, extract, of GHC 9.14 | ⚠️ accepts | tree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442) |
| Julia Tar.jl | Tar 1.10.0 of Julia 1.13.3 | ✅ rejects | error: malformed size field: "" [header block data]: name = "a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0… |
| live-bootstrap untar | mescc-tools-extra a151c245e512, as live-bootstrap pins it | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
| live-bootstrap untar, --non-strict | mescc-tools-extra a151c245e512, as live-bootstrap pins it | ⚠️ accepts | tree A: a (512 B, 917dba8e) |
The table below shows how many release tarballs have the features of this test case.
| ecosystem | tarballs | with it | share |
|---|---|---|---|
| Spack | 37,553 | 0 | none |
| nixpkgs | 18,990 | 0 | none |
| Guix | 10,168 | 0 | none |
| PyPI | 10,000 | 0 | none |
| crates.io | 5,000 | 0 | none |
| RubyGems | 5,000 | 0 | none |
| live-bootstrap | 171 | 0 | none |
| total (distinct) | 82,586 | 0 | none |