Hi Sergey,After receiving your feedback, I decided to rebuild the entire reproduction from scratch instead of relying on my original package. During this process I found two independent issues. I repeated the entire investigation using a completely regenerated set of archives and validated them against two different targets.
For the Debian package tar 1.35+dfsg-4, using the original binary, the primitive is reproducible. The extraction succeeds, an object outside the extraction directory is created, and the resulting hard links share the same inode, demonstrating the outside-write condition that I originally reported. I then rebuilt the current upstream source from commit: 08c3fc2e9337094aff01a511170fd35fdb8f1ee3 which produces GNU tar 1.35.90. Running exactly the same regenerated test case on this upstream build gives a different result: - extraction terminates with exit status 2; - the operation fails with Invalid cross-device link; - no object is created outside the extraction directory; - the outside-write primitive is therefore not reproducible. Based on these experimental results, I can no longer claim that the current upstream HEAD is affected. That part of my original report was incorrect and should be withdrawn. The evidence I can currently support is therefore limited to the affected Debian build that I tested experimentally. I will prepare an updated report that clearly distinguishes the confirmed behavior on that version from the behavior of the current upstream code. Thank you again for carefully checking the report and prompting me to revalidate the entire reproduction. Il giorno gio 23 lug 2026 alle ore 11:41 Sergey Poznyakoff <[email protected]> ha scritto: > Hi Federico, > > Trying to reproduce your results on current git HEAD, I get the > following: > > 1. Extraction fails. > 2. Exit status is 2. > 3. Diagnostics on stderr: > tar: Cannot rename 'root/alias' to 'root/b': No such file or directory > tar: Exiting with failure status due to previous errors > 4. After extraction, root/new/parent/b/victim is a hardlink to > root/b/victim > 5. No files outside the extraction directory are created. > > FWIW, I got the same results when running tar 1.35. > > Best regards, > Sergey > >
