[PATCH 3/8] erofs-utils: tar: fix out-of-bounds access when trimming PAX paths

[Yifan Zhao <stopire@gmail.com>]

An embedded NUL in a PAX path makes strdup() allocate less space than
the record length used to trim trailing slashes, causing out-of-bounds
accesses.

Use strlen() for the trim length and handle strdup() failures.

Assisted-by: Codex:gpt-6-astra
Assisted-by: Claude Code:deepseek-v4.1-flash-1017
Signed-off-by: Yifan Zhao <stopire@gmail.com>
---
 lib/tar.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/lib/tar.c b/lib/tar.c
index f5034da..bab855f 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -527,8 +527,12 @@ int tarerofs_parse_pax_header(struct erofs_iostream *ios,
 					eh->path = NULL;
 					continue;
 				}
-				j = p - 1 - value;
 				eh->path = strdup(value);
+				if (!eh->path) {
+					ret = -ENOMEM;
+					goto out;
+				}
+				j = strlen(eh->path);
 				while (j && eh->path[j - 1] == '/')
 					eh->path[--j] = '\0';
 			} else if (!strncmp(kv, "linkpath=",
-- 
2.56.0