astral-sh / astral-sh/python-build-standalone

Extra bytes after the null-terminator in the name buffer for tar.gz files

Open
#686 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
4.4k
Forks
314
Avg merge
1d 9h
Merged PRs (30d)
27

Description

Hi 🙋‍♂️

In the generated _*.tar.gz_ archives, there seem to be some extra bytes in the name buffer after the null-terminator character.

As far as I understand, this is absolutely legal according to [these specs](https://www.gnu.org/software/tar/manual/html_node/Standard.html), but it causes issues with some extractors ([in my case with .NET](https://github.com/dotnet/runtime/issues/117331)).

Here's a hex-dump of the buffer containing the file name for _python/bin/idle3.13_, but there is some extra stuff after the null-terminator character. The parser I'm using interprets this file name as _python/bin/idle3.13\0dle3.13_:
Image

From what I understand, the problematic line seems to be the following:
https://github.com/astral-sh/python-build-standalone/blob/9bb8bcbeab73b8a962aba962c00f469cbe2cb9b3/src/release.rs#L416

If it doesn't cost too much, I would suggest filling the buffer with zeroes before setting the new path. Perhaps it might also make sense to report this issue upstream ([ref](https://docs.rs/tar/latest/src/tar/header.rs.html#1001-1003)), but I am not familiar enough with Rust to write a minimal example to reproduce the issue.

If you believe this is out-of-scope, my apologies. Feel free to close this issue.

Thank you!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.