Re: Crash on malformed archive

[Julien Voisin]

Unfortunately, compiling from the current git repo doesn't work, make it exiting with `clang: error: no such file or directory: './parse-datetime.c'.

Also, yes, I was talking about the  tar_checksum() [src/list.c] check. We're currently working internally to be able to fuzz binaries at scale, so odds are that I'll reach out once we're there so see how/if we can integrate tar into OSS-Fuzz, to simplify triage/reporting/reproduction/… on your and our end :)

On Sat, 29 Oct 2022 at 14:57, Christian Schoenebeck <schoenebeck@crudebyte.com> wrote:

On Thursday, October 27, 2022 10:29:57 PM CEST Paul Eggert wrote:
> > The reproducer is attached, and you may want to remove the checksum check
> > from tar to reproduce the crash locally.
>
> Sorry, I don't know what is meant by "remove the checksum check". I
> didn't do that, whatever it is.

I think he means bypassing the tar_checksum() [src/list.c] check. You know,
generating random data with a fuzzer and waiting for an entry checksum to be
correct? :)

Best regards,
Christian Schoenebeck

--

Julien Voisin | ISE - TPS | jvoisin@google.com |