Working draft

F50 pax-size-underscore

A pax size with an underscore, 5_12, which some conversions of strings to numbers accept.

Reject(draft) A strict parser must reject this archive.

Category
framing
Default policy
rejects it
Files
F50-pax-size-underscore.tar test archive, 3,072 bytes sha256 afdb5f452460d718c5b1f24c71981837afde6b9593da994f2a7046242f7da6e2
F50-pax-size-underscore.jsonexpected result
F50-pax-size-underscore.txtannotated blocks
F50-pax-size-underscore.pygenerator script

The case

The archive has a file a, whose pax header has size=5_12 and whose header has the size 0, then an empty file smuggled.

In POSIX, a pax size is a decimal number. Read leniently, this case is ambiguous because a reader can read the size in one of three ways. A reader that takes the underscore for a separator of digits reads 512, and the next block is the data of a. One that ends the number at the underscore reads 5, and a is the first 5 bytes of the next block. One that keeps the size of the header reads 0, and the next block is the header of smuggled.

Decision point: how a pax size that is not a decimal number is read.

Seen in: none of the scanned tarballs.

The archive

Every block of 512 bytes, to scale, with its offset. Hover over a field for its bytes.

F50-pax-size-underscore: every block of the archive0x000000header: pax extended header, size=5_12, for aname [0,100): "PaxHeader" + 91 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000015" + NUL, 13mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "011075\0 ", 4669: the unsigned sum of the header, this field as spacestypeflag [156,157): "x", pax extended headerlinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "PaxHeader" + 91 NUL0x000200data: pax records13 bytes of pax records, then 499 NUL; "13 size=5_12\n""13 size=5_12\n"0x000400header: regular file, size 0name [0,100): "a" + 99 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "007336\0 ", 3806: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "a" + 99 NUL0x000600header: regular file, the data of a, to an implementation that reads 512name [0,100): "smuggled" + 92 NULnamemode [100,108): "0000644" + NUL, 644 (octal)uid [108,116): "0000000" + NUL, 0gid [116,124): "0000000" + NUL, 0size [124,136): "00000000000" + NUL, 0mtime [136,148): "00000000000" + NUL, 0chksum [148,156): "010725\0 ", 4565: the unsigned sum of the header, this field as spacestypeflag [156,157): "0", regular filelinkname [157,257): 100 NULlinknamemagic [257,263): "ustar" + NULversion [263,265): "00"uname [265,297): 32 NULunamegname [297,329): 32 NULgnamedevmajor [329,337): "0000000" + NUL, 0devminor [337,345): "0000000" + NUL, 0prefix [345,500): 155 NULprefixpad [500,512): 12 NULname "smuggled" + 92 NUL0x0008002 zero blocks: the end-of-archive markerbytes 0 to 512 of 1024: 512 NUL0x000a002 zero blocks, continuedbytes 512 to 1024 of 1024: 512 NUL0x000c00end of fileNULprintable ASCIIspacecontrol character, such as a newlinebyte over 0x7fwritten by the case itself
Every block, as text 
F50-pax-size-underscore: must reject

A pax `size` with an underscore, `5_12`, which some conversions of strings to numbers accept.

The archive has a file `a`, whose pax header has `size=5_12` and whose header has the size 0, then
an empty file `smuggled`.

In POSIX, a pax size is a decimal number. Read leniently, this case is ambiguous
because a reader can read the size in one of three ways. A reader that takes the underscore for a
separator of digits reads 512, and the next block is the data of `a`. One that ends the number at
the underscore reads 5, and `a` is the first 5 bytes of the next block. One that keeps the size of
the header reads 0, and the next block is the header of `smuggled`.

Decision point: how a pax size that is not a decimal number is read.
Seen in: none of the scanned tarballs.
See also: F23, F24 and F25, a pax size with a plus sign, with a leading space, and with digits that
are not ASCII.

0x000000  header: pax extended header, size=5_12, for a
          name     [  0,100)  "PaxHeader" + 91 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000015" + NUL  13
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "011075\0 "  4669: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "x"  pax extended header
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000200  data: pax records
          13 bytes of pax records, then 499 NUL
          "13 size=5_12\n"
0x000400  header: regular file, size 0
          name     [  0,100)  "a" + 99 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "007336\0 "  3806: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000600  header: regular file, the data of a, to an implementation that reads 512
          name     [  0,100)  "smuggled" + 92 NUL
          mode     [100,108)  "0000644" + NUL  644 (octal)
          uid      [108,116)  "0000000" + NUL  0
          gid      [116,124)  "0000000" + NUL  0
          size     [124,136)  "00000000000" + NUL  0
          mtime    [136,148)  "00000000000" + NUL  0
          chksum   [148,156)  "010725\0 "  4565: the unsigned sum of the header, this field as spaces
          typeflag [156,157)  "0"  regular file
          linkname [157,257)  100 NUL
          magic    [257,263)  "ustar" + NUL
          version  [263,265)  "00"
          uname    [265,297)  32 NUL
          gname    [297,329)  32 NUL
          devmajor [329,337)  "0000000" + NUL  0
          devminor [337,345)  "0000000" + NUL  0
          prefix   [345,500)  155 NUL
          pad      [500,512)  12 NUL
0x000800  2 zero blocks: the end-of-archive marker
0x000c00  end of file
Every byte, as a hex dump

As xxd writes it: xxd -r makes the archive of it.

00000000: 5061 7848 6561 6465 7200 0000 0000 0000  PaxHeader.......
00000010: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000050: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000060: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000070: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000080: 3030 3030 3031 3500 3030 3030 3030 3030  0000015.00000000
00000090: 3030 3000 3031 3130 3735 0020 7800 0000  000.011075. x...
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000000f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000100: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000110: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000130: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000140: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000150: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000160: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000170: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000180: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000190: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000001f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000200: 3133 2073 697a 653d 355f 3132 0a00 0000  13 size=5_12....
00000210: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000220: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000230: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000240: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000250: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000260: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000270: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000280: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000290: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000300: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000320: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000330: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000380: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000003f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000400: 6100 0000 0000 0000 0000 0000 0000 0000  a...............
00000410: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000420: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000430: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000440: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000450: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000460: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000470: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000480: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000490: 3030 3000 3030 3733 3336 0020 3000 0000  000.007336. 0...
000004a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000004f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000500: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000510: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000520: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000530: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000540: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000550: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000560: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000570: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000580: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000590: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000005f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000600: 736d 7567 676c 6564 0000 0000 0000 0000  smuggled........
00000610: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000620: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000630: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000640: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000650: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000660: 0000 0000 3030 3030 3634 3400 3030 3030  ....0000644.0000
00000670: 3030 3000 3030 3030 3030 3000 3030 3030  000.0000000.0000
00000680: 3030 3030 3030 3000 3030 3030 3030 3030  0000000.00000000
00000690: 3030 3000 3031 3037 3235 0020 3000 0000  000.010725. 0...
000006a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000006f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000700: 0075 7374 6172 0030 3000 0000 0000 0000  .ustar.00.......
00000710: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000720: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000730: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000740: 0000 0000 0000 0000 0030 3030 3030 3030  .........0000000
00000750: 0030 3030 3030 3030 0000 0000 0000 0000  .0000000........
00000760: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000770: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000780: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000790: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000007f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000800: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000810: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000820: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000830: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000840: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000850: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000860: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000870: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000880: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000890: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000008f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000900: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000910: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000920: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000930: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000940: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000950: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000960: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000970: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000980: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000990: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
000009f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000a90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000aa0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ab0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ac0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ad0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ae0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000af0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b00: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b10: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b20: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b30: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b40: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b50: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b60: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b70: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b80: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000b90: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000ba0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bb0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bc0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bd0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000be0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
00000bf0: 0000 0000 0000 0000 0000 0000 0000 0000  ................

What implementations make of it

In the outcome column, ✅ means that the implementation follows the default policy.

implementationversionoutcomewhat it makes of it
GNU tartar (GNU tar) 1.35✅ rejectserror: tar: Malformed extended header: invalid size=5_12 tar: Exiting with failure status due to previous errors
bsdtarbsdtar 3.8.11 - libarchive 3.8.11⚠️ acceptstree A: a (5 B, 62a7dc9c)
BusyBox tarBusyBox v1.38.0, defconfig⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
7-Zip7-Zip (z) 26.05 (x64)⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
Python tarfile, filter=data, as in pipCPython 3.15.2⚠️ acceptstree C: a (512 B, 917dba8e)
Python tarfile, filter=tarCPython 3.15.2⚠️ acceptstree C: a (512 B, 917dba8e)
Python tarfile, filter=fully_trustedCPython 3.15.2⚠️ acceptstree C: a (512 B, 917dba8e)
node-tartar 7.5.22⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
node-tar, stricttar 7.5.22⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
tar-fstar-fs 3.1.3, on tar-stream 3.2.2⚠️ acceptstree A: a (5 B, 62a7dc9c)
Java Commons CompressCommons Compress 1.28.0, Expander, on Java 27.0.1.0.2✅ rejectserror: java.io.IOException: Unable to parse long from string value: 5_12
.NET System.Formats.TarSystem.Formats.Tar of .NET 10.0.14, ExtractToDirectory✅ rejectserror: FormatException: The input string '5_12' was not in a correct format.
PHP PharData, as in ComposerPharData of PHP 8.5.12, as Composer's TarDownloader calls it⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
Go containerd archive.Applycontainerd v2.4.2, archive.Apply, of go1.27.3✅ rejectserror: archive/tar: invalid tar header
Rust tartar 0.4.46, unpack⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
Rust astral-tokio-tarastral-tokio-tar 0.7.1, unpack✅ rejectserror: failed to iterate over archive
Rust tar-codec, as in uvtar-codec 0.0.16, with the policies of uv 0.13✅ rejectserror: at byte 0: invalid pax size value: "5_12"
RubyGemsRubyGems 4.0.20 of Ruby 4.0.9, extract_tar_gz⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
R untar, internalutils::untar of R 4.6.2, tar = "internal"⚠️ crashesargument must be coercible to non-negative integer Warning message: In untar2(tarfile, files, list, exdir, restore_times, allow_all) : NAs introduced by coercion
Perl Archive::TarArchive::Tar 3.12 of Perl v5.44.0⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
Haskell tartar 0.7.2.0, extract, of GHC 9.14⚠️ acceptstree B: a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
Julia Tar.jlTar 1.10.0 of Julia 1.13.3✅ rejectserror: invalid extended header size value: "5_12"
live-bootstrap untarmescc-tools-extra a151c245e512, as live-bootstrap pins it⚠️ acceptstree D: PaxHeader (13 B, 1214c57b), a (0 B, e3b0c442), smuggled (0 B, e3b0c442)
live-bootstrap untar, --non-strictmescc-tools-extra a151c245e512, as live-bootstrap pins it⚠️ acceptstree D: PaxHeader (13 B, 1214c57b), a (0 B, e3b0c442), smuggled (0 B, e3b0c442)

Prevalence in release tarballs

The table below shows how many release tarballs have the features of this test case.

ecosystemtarballswith itshare
Spack37,5530none
nixpkgs18,9900none
Guix10,1680none
PyPI10,0000none
crates.io5,0000none
RubyGems5,0000none
live-bootstrap1710none
total (distinct)82,5860none

See also