Reproduction

Requires a C compiler with AddressSanitizer (gcc or clang) and Python 3.

# 1. Clone upstream libtar
git clone https://github.com/tklauser/libtar.git
cd libtar

# 2. Generate the listhash sources (normally done by autotools)
mkdir -p build
sed -e 's/@LISTHASH_PREFIX@/libtar/g' -e 's|/\* @configure_input@ \*/||' \
    listhash/listhash.h.in > build/libtar_listhash.h
sed -e 's/@LISTHASH_PREFIX@/libtar/g' -e 's|/\* @configure_input@ \*/||' \
    listhash/list.c.in > build/libtar_list.c
sed -e 's/@LISTHASH_PREFIX@/libtar/g' -e 's|/\* @configure_input@ \*/||' \
    listhash/hash.c.in > build/libtar_hash.c

# 3. Build libtar + the PoC consumer under ASan
#    (CFLAGS below patch over values autotools would normally supply)
CFLAGS="-Ilib -Icompat -Ibuild -Ipoc \
  -DNEED_MAKEDEV -DMAJOR_IN_SYSMACROS -DNEED_STRMODE \
  -DPACKAGE_VERSION=\"1.2.20\" \
  -include sys/sysmacros.h -include fnmatch.h -include fcntl.h -include string.h \
  -O1 -g -std=gnu11"
SRCS="lib/append.c lib/block.c lib/decode.c lib/encode.c lib/extract.c \
      lib/handle.c lib/output.c lib/util.c lib/wrapper.c compat/strmode.c \
      build/libtar_list.c build/libtar_hash.c"
for f in $SRCS; do
  gcc $CFLAGS -fsanitize=address -c "$f" -o "build/$(basename "${f%.c}").o"
done
ar rcs build/liblibtar_asan.a build/*.o
gcc $CFLAGS -fsanitize=address poc/poc_crash.c build/liblibtar_asan.a -o build/poc_crash

# 4. Craft the triggering archive and run the PoC
python3 poc/make_archive.py longname.tar
ASAN_OPTIONS=halt_on_error=1:detect_leaks=0 ./build/poc_crash longname.tar

(detect_leaks=0 suppresses an unrelated, pre-existing leak-detector finding — tar_close() doesn't free th_buf.gnu_longname — that has nothing to do with this vulnerability; omit it if you want to see that leak too.)

Expected result

Unpatched: AddressSanitizer aborts with a heap-buffer-overflow READ:

==ERROR: AddressSanitizer: heap-buffer-overflow ... READ of size 1
    #0 safer_name_suffix   lib/decode.c:39
    #1 th_get_pathname     lib/decode.c:60
0x... is located 0 bytes after 512-byte region [...]
  allocated by thread T0 here:
    #0 malloc
    #1 th_read             lib/block.c:192

Patched (after applying patches/0001-...patch): no overflow; th_get_pathname() returns exactly the 512-byte attacker-controlled string with a terminator at the correct offset.

What the archive looks like

A 3-block tar archive:

1. A GNU long-name extension header (typeflag='L') declaring size 512.
2. One 512-byte data block of "pwn" + "A"*509 — no NUL byte anywhere.
3. A normal short-named member header (plus its own data block and the standard two zero blocks for EOF), so the archive as a whole is a well-formed, valid-checksum ustar file.

th_read() allocates gnu_longname as exactly 512 bytes (blocks * T_BLOCKSIZE, with blocks == 1) and fills every byte from the archive. Since the data contains no NUL, the buffer has no string terminator. Any code that treats it as a C string — safer_name_suffix(), th_get_pathname(), th_get_linkname(), libtar's own verbose/debug printing — reads past the end of the allocation.