Description
An integer overflow in the mtar_next function in src/microtar.c in rxi microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. mtar_next computes the offset to the next record as round_up(h.size, 512) + sizeof(mtar_raw_header_t) using 32-bit arithmetic.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rxi | microtar | 0.1.0 | — |
References
- https://github.com/rxi/microtar/blob/master/src/microtar.c#L239 product
- https://github.com/rxi/microtar product
- Vulnerable source code: src/microtar.c (mtar_next) technical-description