[PATCH] erofs-utils: tar: fix multi-chunk metadata reads

[PATCH] erofs-utils: tar: fix multi-chunk metadata reads

[Vansh Choudhary]

Advance the destination buffer in erofs_iostream_bread() after each
erofs_iostream_read() call.

Without that, metadata reads that span multiple stream chunks keep
overwriting the start of the output buffer, which can corrupt PAX
headers, GNU long names, long links, and other buffered metadata.

Signed-off-by: Vansh Choudhary <ch@vnsh.in>
---
 lib/tar.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/tar.c b/lib/tar.c
index 70bf091..77754fd 100644
--- a/lib/tar.c
+++ b/lib/tar.c
@@ -250,6 +250,7 @@ int erofs_iostream_read(struct erofs_iostream *ios, void **buf, u64 bytes)
 int erofs_iostream_bread(struct erofs_iostream *ios, void *buf, u64 bytes)
 {
 	u64 rem = bytes;
+	u8 *dst = buf;
 	void *src;
 	int ret;
 
@@ -257,7 +258,8 @@ int erofs_iostream_bread(struct erofs_iostream *ios, void *buf, u64 bytes)
 		ret = erofs_iostream_read(ios, &src, rem);
 		if (ret < 0)
 			return ret;
-		memcpy(buf, src, ret);
+		memcpy(dst, src, ret);
+		dst += ret;
 		rem -= ret;
 	} while (rem && ret);
 
-- 
2.43.0

Re: [PATCH] erofs-utils: tar: fix multi-chunk metadata reads

[Ajay Rajera]

Tested-by: Ajay Rajera <newajay.11r@gmail.com>
(Tested with long PAX headers via mkfs.erofs --tar)

On Thu, 26 Mar 2026 at 16:03, Vansh Choudhary <ch@vnsh.in> wrote:
>
> Advance the destination buffer in erofs_iostream_bread() after each
> erofs_iostream_read() call.
>
> Without that, metadata reads that span multiple stream chunks keep
> overwriting the start of the output buffer, which can corrupt PAX
> headers, GNU long names, long links, and other buffered metadata.
>
> Signed-off-by: Vansh Choudhary <ch@vnsh.in>
> ---
>  lib/tar.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/lib/tar.c b/lib/tar.c
> index 70bf091..77754fd 100644
> --- a/lib/tar.c
> +++ b/lib/tar.c
> @@ -250,6 +250,7 @@ int erofs_iostream_read(struct erofs_iostream *ios, void **buf, u64 bytes)
>  int erofs_iostream_bread(struct erofs_iostream *ios, void *buf, u64 bytes)
>  {
>         u64 rem = bytes;
> +       u8 *dst = buf;
>         void *src;
>         int ret;
>
> @@ -257,7 +258,8 @@ int erofs_iostream_bread(struct erofs_iostream *ios, void *buf, u64 bytes)
>                 ret = erofs_iostream_read(ios, &src, rem);
>                 if (ret < 0)
>                         return ret;
> -               memcpy(buf, src, ret);
> +               memcpy(dst, src, ret);
> +               dst += ret;
>                 rem -= ret;
>         } while (rem && ret);
>
> --
> 2.43.0
>
>

Re: [PATCH] erofs-utils: tar: fix multi-chunk metadata reads

[Nithurshen]

Hi Xiang,

The bug caused multi-chunk reads to overwrite the destination
buffer because the pointer did not advance. To verify the fix
was working correctly, we had to trigger a read larger than a
standard 512-byte tar block without hitting macOS path limits.

I generated a custom tarball using Python with a PAX header
containing an 800-character symlink target. This safely exceeded
the 512-byte chunk size to force a multi-chunk read.

Applied the patch to lib/tar.c and rebuilt erofs-utils.

Built an EROFS image from the tarball using mkfs.erofs.

Extracted the image using fsck.erofs and verified that the
extracted 800-character symlink was perfectly intact.

Without the patch, extraction failed entirely because the
symlink target was corrupted in memory. With the patch, the
pointer advanced correctly and the full string was preserved.

Tested-by: Nithurshen <nithurshen.dev@gmail.com>
Reviewed-by: Nithurshen <nithurshen.dev@gmail.com>