astral-sh / astral-sh/python-build-standalone
Extra bytes after the null-terminator in the name buffer for tar.gz files
- Dominant language
- Python
- Stars
- 4.4k
- Forks
- 314
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 27
Description
Hi 🙋♂️
In the generated _*.tar.gz_ archives, there seem to be some extra bytes in the name buffer after the null-terminator character.
As far as I understand, this is absolutely legal according to [these specs](https://www.gnu.org/software/tar/manual/html_node/Standard.html), but it causes issues with some extractors ([in my case with .NET](https://github.com/dotnet/runtime/issues/117331)).
Here's a hex-dump of the buffer containing the file name for _python/bin/idle3.13_, but there is some extra stuff after the null-terminator character. The parser I'm using interprets this file name as _python/bin/idle3.13\0dle3.13_:
From what I understand, the problematic line seems to be the following:
https://github.com/astral-sh/python-build-standalone/blob/9bb8bcbeab73b8a962aba962c00f469cbe2cb9b3/src/release.rs#L416
If it doesn't cost too much, I would suggest filling the buffer with zeroes before setting the new path. Perhaps it might also make sense to report this issue upstream ([ref](https://docs.rs/tar/latest/src/tar/header.rs.html#1001-1003)), but I am not familiar enough with Rust to write a minimal example to reproduce the issue.
If you believe this is out-of-scope, my apologies. Feel free to close this issue.
Thank you!
Contributor guide
Assessment
This issue has not been assessed yet.