search

halostatue / minitar

Minimal pure-ruby support for POSIX tar(1) archives.
Other
38 stars 27 forks source link

Minitar incorrectly roundtrips files with very long filenames #62

Open halostatue opened 2 months ago

halostatue commented 2 months ago

I recently discovered floj/minitar-lfn-problem illustrating an issue with minitar extraction of tarballs with very long filenames; it has never been reported as a bug. I have forked it as halostatue/minitar-lfn-problem and added an additional output because the diagnosis (missing files) is incorrect.

What is currently happening is worse because the files that are supposed to be missing are in fact mangled (that is, they are present, but they have been written to different locations than they should be). Comparing the extracted directories, we get this:

--- /var/folders/c6/k_j3j3w11590l8x6t8rwxw200000gn/T//.psub.N35VDqw9Zf  2024-08-11 12:03:28
+++ /var/folders/c6/k_j3j3w11590l8x6t8rwxw200000gn/T//.psub.CqZ7ky7GZ4  2024-08-11 12:03:28
@@ -30,7 +30,6 @@
 /k6hly56/mh/ri2pa1/04/ud6zm3nkjkls6ha1pqq81ptmg558psw33e8t32qsev.br
 /k6hly56/mh/ri2pa1/04/z5r3sv9isgut5tega9arqc146cna8.js
 /k6hly56/mh/ri2pa1/04/7b20zbxjqk834fd.js
-/k6hly56/mh/ri2pa1/04/5k8mnvwxe7hmvp1n932o4mn2b25gqrxfrbe4jfjbig6kzhphnsfkrtqruypfzl93u0ohlv9yyxcoxn6jg6iv5ml8e27jdqjiikyq3.js
 /k6hly56/mh/ri2pa1/04/nt3gzckca57gnnosgld6esjqi.br
 /k6hly56/mh/ri2pa1/04/8fpehrilj932d8twhwmxggcc7jufxr0ikycgw4hezmsqks5rkfnnxi80.map
 /k6hly56/mh/ri2pa1/04/r1x9nztj5zhh9wfijl97tg.js
@@ -45,39 +44,48 @@
 /k6hly56/mh/ri2pa1/04/1vunby5xs91kngniktvnjzlmgmr6n4pndzujb2jc4uipwqgqb1nkbb0out5meh.js
 /k6hly56/mh/ri2pa1/04/z99882uw2e2cuocouzx39t2gpvrjk1kad6j2djr1l727wumkozz67yz8yvtioi7b6ko4k7mu7oau7x3qpt1fu2hq1jo2zeh0i.js
 /k6hly56/mh/ri2pa1/04/ztj1tjnysbi07xibqbzw82r9jb13b04l.gz
-/k6hly56/mh/ri2pa1/04/zregt5t93h8u9wc62q6o9368j78zfcavfcwb3h44p6ueaw95jsu8goeiatyxkozcwr452fqo4iqz3r2eldu8g1q93icccegzw0chny35.gz
 /k6hly56/mh/ri2pa1/04/qxgbaykcnn2gdrzocbvufeuujx56at7vhshny91lbq14jms8mchv.js
 /k6hly56/mh/ri2pa1/04/q3lpuzyuhnjud3rc0h2hqgxj3ejec8x773bf2wy49nipvb61uwn9yr78w82jd5gi4d5fsgslhu6wjmejqt1f4trvmi4cws.map
 /k6hly56/mh/ri2pa1/04/md4zgeg689x338sc9y1hcn31q1zc8mcuzehe.js
 /k6hly56/mh/ri2pa1/04/hnh8hxmshvod7ogjvenyz0pwdzuw0frti9egyy.gz
-/k6hly56/mh/ri2pa1/04/6n2x1z7snqpjlio9jy80vp9acfczs47jfz3ap70m5zo7di3u8nynkkvztz8r6g94syr6ieu6yuslal639s81grtz3iivhwd7re6hm3pibp61.js
 /k6hly56/mh/ri2pa1/04/7h4a206nesx4tw5sd5ngtxy8ecnjp3j3uv3vhptmbwklnrh2q.gz
 /k6hly56/mh/ri2pa1/04/29jlo6x7h7e0yp6schyvwbr9ptsu07x43nebrd8g2oq1k9b5gfaz46p.br
 /k6hly56/mh/ri2pa1/04/vhc4rzsa6niofksx4a4sxh99q3.map
 /k6hly56/mh/ri2pa1/04/npfaxwy6rpc50fphlvbhirpnbxne82lcqwb1tlaqcpxbexx1k.br
 /k6hly56/mh/ri2pa1/04/02bys98rkjdibsyu9m2nvl2sl.js
-/k6hly56/mh/ri2pa1/04/1enluwg6n2ud7trxi3xw4el377y8iubbw5njt771qmdf072fyzb6a8y1g3r6u6ilowdy3r5q6ox059o4dzvragingszirip8wc9k.gz
 /k6hly56/mh/ri2pa1/04/9uc068lh7m66aojjownko6982130euvckbrg6bav22phjtxf8e.map
 /k6hly56/mh/ri2pa1/04/fvi1bj2yi3ayhvrxuhsj0php9xago39al.map
 /k6hly56/mh/ri2pa1/04/045vm9wslaywcqlnyc1p5c.js
 /k6hly56/mh/ri2pa1/04/pxwlo6x2wdp8p42wu1z2pd9897uoy234g2in0bcxehmgbore0.map
 /k6hly56/mh/ri2pa1/04/mj0k5np6arpm1z0qgb94djjxguid.js
+/k6hly56/mh/ri2pa1/04/k6hly56
+/k6hly56/mh/ri2pa1/04/k6hly56/mh
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/5k8mnvwxe7hmvp1n932o4mn2b25gqrxfrbe4jfjbig6kzhphnsfkrtqruypfzl93u0ohlv9yyxcoxn6jg6iv5ml8e27jdqjiikyq3.js
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/zregt5t93h8u9wc62q6o9368j78zfcavfcwb3h44p6ueaw95jsu8goeiatyxkozcwr452fqo4iqz3r2eldu8g1q93icccegzw0chny35.gz
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/6n2x1z7snqpjlio9jy80vp9acfczs47jfz3ap70m5zo7di3u8nynkkvztz8r6g94syr6ieu6yuslal639s81grtz3iivhwd7re6hm3pibp61.js
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/1enluwg6n2ud7trxi3xw4el377y8iubbw5njt771qmdf072fyzb6a8y1g3r6u6ilowdy3r5q6ox059o4dzvragingszirip8wc9k.gz
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/heim0nu29k5r9nd5rio5yw891bvj69flwn90pbeye6gb1gze85644kfi9w5xwaum0cgqj3mq6h265yudlwsj162jgr876coguulx0acttcnd5cj.br
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/s6qwh0va0isn6134ym6ihx0vfqrn2gz2jhkhuf8gomm0nwccp0kwyxypheqii8r19y4czvrlsd45pl7u8yyj7ku7pz1pmyi07hyki.map
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/tb3z3gmjkjmrzyomg7qz97fb7uxpc2s78hlu97gjqdgtzen0kdur28cmj12c2g2mlizviit6zpnmp32okqpx0a9nl8p5obzhrv2c5lse2z0gf8h.gz
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/0afdks3r6k1mbf64xzuwh5efkuxurro63rbckjssmz9mdratf6ayfduqpb0r9qxx2mgnrs0thi0ohh4qtfylfd6cd506zawwic0u3ec0iluu4myn.map
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/ilrysiyw19lsmsdcu7kmz29zts2icanon5tz1xvguw80osbx0xz9bcrwvaddnt8l34jhamw3r5ptycvnojxe33evwhmxrar4qu3p.br
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/pawfxz3zbnqp4quqijcqt8netd0qr34beyu3s005xasto4u5q4bmghk9oba05ns5rv5p80pfy5voiximh32fvzm447g5wvivficjrmpo.br
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/prd9w2nwhepvce14welpkbvtwwjqasl8kzc55uebi11ci3bf694sutwrzjozcu03k03p892wko6z1nqd653xagg3dygxdhitjaahxq6t8.map
 /k6hly56/mh/ri2pa1/04/ng8xor0qr2t8147a72oo03nfi69ttn3kwlc9iz.br
-/k6hly56/mh/ri2pa1/04/heim0nu29k5r9nd5rio5yw891bvj69flwn90pbeye6gb1gze85644kfi9w5xwaum0cgqj3mq6h265yudlwsj162jgr876coguulx0acttcnd5cj.br
 /k6hly56/mh/ri2pa1/04/7wk604if3u1h2jra2zwgyrgt5fp33jjkrivwexhoxxqluavy9ti2u2vvxrk.gz
 /k6hly56/mh/ri2pa1/04/8ca9egq9e7z5kqkp9i4j7b7jmyqv1g35tgp51cdgczi3ht1tnnnk8gc4dw03pwi.js
 /k6hly56/mh/ri2pa1/04/n5xysijke75kbss6ecbn3rrqxud6ktj4mcvgzoll32cmb4.js
 /k6hly56/mh/ri2pa1/04/8gvmidn0s9j60mrneia5m00jeyflfphvaz5gpjh3kxu8efwiywdtu8r9bxgdp98ahtdbeohhji89e237odla4ancgg.js
 /k6hly56/mh/ri2pa1/04/6ea0o4uaztgufnvyzw9p0m1rye1fj3xf125vhsgtg2uje.js
 /k6hly56/mh/ri2pa1/04/r4o1apcmjs8xqjvxmni72pnqfha3yb71gvhtsigh5k9zqwgasgvek2u.gz
-/k6hly56/mh/ri2pa1/04/s6qwh0va0isn6134ym6ihx0vfqrn2gz2jhkhuf8gomm0nwccp0kwyxypheqii8r19y4czvrlsd45pl7u8yyj7ku7pz1pmyi07hyki.map
 /k6hly56/mh/ri2pa1/04/fr35ni2bx7utjgxx9p6kxfkl5o20u.map
 /k6hly56/mh/ri2pa1/04/d46ue2ozkuvw9o1fft72g5ig3xqgnm857rhvvzdqq3rujm5owrrhpxotl5t0p79ssd.br
 /k6hly56/mh/ri2pa1/04/l0k251brkarczd4xfos385hkz2dv6z0r.map
 /k6hly56/mh/ri2pa1/04/18c16hxihwk56jksg0fa5me1wq116.js
 /k6hly56/mh/ri2pa1/04/0ymmnpqxnj2tokdj7hxzyf36vxaptaviq09.js
 /k6hly56/mh/ri2pa1/04/5p56yla2oaoyf1qhc6vbfzq8zcdgc5og7k3jnn78yffhxltfzdzwc4wcd0d6qsh4c1.map
-/k6hly56/mh/ri2pa1/04/tb3z3gmjkjmrzyomg7qz97fb7uxpc2s78hlu97gjqdgtzen0kdur28cmj12c2g2mlizviit6zpnmp32okqpx0a9nl8p5obzhrv2c5lse2z0gf8h.gz
 /k6hly56/mh/ri2pa1/04/4undrwj7kg9ugz0b8m8nclrkd1q64obgh3ya5u95v575wtrhx9oxq4rnrlr16djveaprtr6g2.map
 /k6hly56/mh/ri2pa1/04/mmjumr8v9kq9f6qhz27b5amuesbfjoixl8z27xihr68h92hmkvx17exrss66zq09xp8vi.js
 /k6hly56/mh/ri2pa1/04/1y1kq8xw5pcjlzd4xgsyeom5488dq2hn27z8ptzh350s0wou.gz
@@ -87,7 +95,6 @@
 /k6hly56/mh/ri2pa1/04/65khbci5z35naa6pg1g93tv0b8u7jem33bht90o.js
 /k6hly56/mh/ri2pa1/04/gbnvvlvy8zqeyti7xnhs8q9bdxps4dk.gz
 /k6hly56/mh/ri2pa1/04/7j5iy1b2xym5namyiqn1udrypm.map
-/k6hly56/mh/ri2pa1/04/0afdks3r6k1mbf64xzuwh5efkuxurro63rbckjssmz9mdratf6ayfduqpb0r9qxx2mgnrs0thi0ohh4qtfylfd6cd506zawwic0u3ec0iluu4myn.map
 /k6hly56/mh/ri2pa1/04/odf0z0sgx66abu2ceqnofo77j6jftyx5avm.gz
 /k6hly56/mh/ri2pa1/04/3of8pexdljiy6hdnjef5lhx5vsa7jti98pjeg5w0us1fa546ew2b5n3632uiwwybjm.gz
 /k6hly56/mh/ri2pa1/04/x663kca3h32cu0122d0aynzwndlok66vtp2r21udev75u01wctzycujt1kbcksqyudakhskl.br
@@ -101,15 +108,12 @@
 /k6hly56/mh/ri2pa1/04/y2h909f85lnj5ico69rhjhx4j.gz
 /k6hly56/mh/ri2pa1/04/q21tfokz6pga8xvtmv5kdpk24vk3.gz
 /k6hly56/mh/ri2pa1/04/5pq89tkb9xqy8g403l97gdp4332w38cl9t6d.map
-/k6hly56/mh/ri2pa1/04/ilrysiyw19lsmsdcu7kmz29zts2icanon5tz1xvguw80osbx0xz9bcrwvaddnt8l34jhamw3r5ptycvnojxe33evwhmxrar4qu3p.br
 /k6hly56/mh/ri2pa1/04/vx0b0auew59oy0nhpsm31d82esyxjxt4o1vgug2jqldcmtah92uoedhu28dcs8fh2.br
 /k6hly56/mh/ri2pa1/04/v9ld2v2dz4vlmeurab1eikdl5bjpg042lxv3oqhhwa1b0uzslon86ab8ffujh95tv2e.map
-/k6hly56/mh/ri2pa1/04/pawfxz3zbnqp4quqijcqt8netd0qr34beyu3s005xasto4u5q4bmghk9oba05ns5rv5p80pfy5voiximh32fvzm447g5wvivficjrmpo.br
 /k6hly56/mh/ri2pa1/04/76oaddmvunzyujlpkg9kuny59a96.br
 /k6hly56/mh/ri2pa1/04/4so02o6niizrdvow5jqn6smfya5rmfy0ipmltze8pkl7sc0amr1a0sh0urp11y28568ztawt4fel9qm564j4zc8s4561b.br
 /k6hly56/mh/ri2pa1/04/palbewllu66smo9lj5dppwdysk9pdlyoc.map
 /k6hly56/mh/ri2pa1/04/9v7lsclu6pgtj1iq9vwjdyt8zfat5zsbl32sluawprf.map
-/k6hly56/mh/ri2pa1/04/prd9w2nwhepvce14welpkbvtwwjqasl8kzc55uebi11ci3bf694sutwrzjozcu03k03p892wko6z1nqd653xagg3dygxdhitjaahxq6t8.map
 /k6hly56/mh/ri2pa1/04/gjxyan453zzsk9e1tq.gz
 /k6hly56/mh/ri2pa1/04/ok74zk0gycvov98paxifnlmz6sbsszw7e.map
 /fjkornv7deyzvu9j0qc4j.sh
@@ -134,7 +138,6 @@
 /hpg5lfg/1j
 /hpg5lfg/1j/973e4t
 /hpg5lfg/1j/973e4t/hqc
-/hpg5lfg/1j/973e4t/hqc/rliudafdwjtth7uic5nm0pyf6w93qxa61gg810hnl93i5pats2dq5vt3uisguw5w58bcv8b4s2m4ey9pe8es0qiz2s1qefkll8tekn1sd.br
 /hpg5lfg/1j/973e4t/hqc/bui77tmck7icifwtu0ghgwtfyvshkcue0ets8062wxuw6xjp4pts1b9ppvgty8ak6odi2j9le40p4ql5tdfybq2srzobs9.gz
 /hpg5lfg/1j/973e4t/hqc/7korbrdhmc4zve2wz5jf16qwujro4e9h.br
 /hpg5lfg/1j/973e4t/hqc/dvpsr7fz8z1kbqy1gwopetlt9fmv0.css
@@ -146,12 +149,17 @@
 /hpg5lfg/1j/973e4t/hqc/s2zg1s46vq7tag7ilb71j87bc8.css
 /hpg5lfg/1j/973e4t/hqc/qno9wreweo0hhfdfoc9m99ap9pn418iwiqvlt6wskc3ibux6h0fti32qekokisdqyl.br
 /hpg5lfg/1j/973e4t/hqc/x2r7wzmt3b0zaftsmtklw3k.css
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j/973e4t
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j/973e4t/hqc
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j/973e4t/hqc/rliudafdwjtth7uic5nm0pyf6w93qxa61gg810hnl93i5pats2dq5vt3uisguw5w58bcv8b4s2m4ey9pe8es0qiz2s1qefkll8tekn1sd.br
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j/973e4t/hqc/djcrcb1l49ardcthyl5u80dcgmo03cp5mh938wr38dka7us1ja4i3dfrp3ahg4q2ooet6avyw45nqpzrcxfzdemvzj07oftcghtkl5bdc.gz
+/hpg5lfg/1j/973e4t/hqc/hpg5lfg/1j/973e4t/hqc/mioxx4h9tgcc9gqw0j8z2fj2covf6nsplrwggyjsg4swmh0glzy2jji4n2gspvb2vlki7zmu81046hvgt4fstlk6fldv0p1w3nf7o6.css
 /hpg5lfg/1j/973e4t/hqc/37wwl113n8ft3y1liuf2bn1lnj8q8nmb.gz
 /hpg5lfg/1j/973e4t/hqc/jt9u4il0ykycx1mtazpiqmlkjka25.br
 /hpg5lfg/1j/973e4t/hqc/0q5babw8cxxrhlrw0j3yfikfkjgnqwq54mi9jkwglus0xtqa0.gz
-/hpg5lfg/1j/973e4t/hqc/djcrcb1l49ardcthyl5u80dcgmo03cp5mh938wr38dka7us1ja4i3dfrp3ahg4q2ooet6avyw45nqpzrcxfzdemvzj07oftcghtkl5bdc.gz
 /hpg5lfg/1j/973e4t/hqc/85tkhjmkvku4stpaqzv.br
-/hpg5lfg/1j/973e4t/hqc/mioxx4h9tgcc9gqw0j8z2fj2covf6nsplrwggyjsg4swmh0glzy2jji4n2gspvb2vlki7zmu81046hvgt4fstlk6fldv0p1w3nf7o6.css
 /hpg5lfg/1j/973e4t/hqc/71dwg7tgt381fykcolp4ak4zvfve18bo9y227y4pea8dqrbz42xtjzsexso9.br
 /hpg5lfg/1j/973e4t/hqc/o9nyzw5eg3incwrhi4t5vek48v.gz
 /hpg5lfg/1j/973e4t/hqc/0vzqtchg3lx5fcgngmm.gz

The most interesting part of that output is that the target directory structure is being duplicated:

+/k6hly56/mh/ri2pa1/04/k6hly56
+/k6hly56/mh/ri2pa1/04/k6hly56/mh
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04

We can see that the files are being written to a duplicate tree inside the tree:

-/k6hly56/mh/ri2pa1/04/5k8mnvwxe7hmvp1n932o4mn2b25gqrxfrbe4jfjbig6kzhphnsfkrtqruypfzl93u0ohlv9yyxcoxn6jg6iv5ml8e27jdqjiikyq3.js
+/k6hly56/mh/ri2pa1/04/k6hly56/mh/ri2pa1/04/5k8mnvwxe7hmvp1n932o4mn2b25gqrxfrbe4jfjbig6kzhphnsfkrtqruypfzl93u0ohlv9yyxcoxn6jg6iv5ml8e27jdqjiikyq3.js

This was originally found with Minitar 0.9 but exists in Minitar 1.0.