From 6df59b075346a014e69d18543a610cf790aba828 Mon Sep 17 00:00:00 2001 From: Siteshwar Vashisht Date: Tue, 8 Sep 2026 06:08:05 +0200 Subject: [PATCH] tar-util: fix an off by one read Standard Linux POSIX ACL tag values are 0x00, 0x01, 0x02, 0x04, 0x08, 0x10 and 0x20. ELEMENTSOF(tag_map) evaluates to 33, which is one past the last valid index 32. --- src/shared/tar-util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/shared/tar-util.c b/src/shared/tar-util.c index f3b63fe98f..1ba569e734 100644 --- a/src/shared/tar-util.c +++ b/src/shared/tar-util.c @@ -1341,7 +1341,7 @@ static int archive_write_acl( assert_cc(ACL_UNDEFINED_TAG == 0); /* safety check, we assume that holes are filled with ACL_UNDEFINED_TAG */ assert_cc(ELEMENTSOF(tag_map) <= 64); /* safety check, we assume that the tag ids are all packed and low */ - int tag = ntag >= 0 && ntag <= (acl_tag_t) ELEMENTSOF(tag_map) ? tag_map[ntag] : ACL_UNDEFINED_TAG; + int tag = ntag >= 0 && ntag < (acl_tag_t) ELEMENTSOF(tag_map) ? tag_map[ntag] : ACL_UNDEFINED_TAG; bool skip = false; id_t qualifier = UID_INVALID;