| { | |
| "item_id": "ker-tar_pax", | |
| "kernel": "tar_pax", | |
| "advisory": "RUSTSEC-2026-0145", | |
| "crate": "astral-tokio-tar", | |
| "pre_version": "0.6.1", | |
| "post_version": "0.6.2", | |
| "advisory_url": "https://github.com/astral-sh/tokio-tar/pull/82", | |
| "title": "PAX Header Desynchronization in astral-tokio-tar", | |
| "source_file": "src/archive.rs", | |
| "function": "apply_pax", | |
| "signature": "pub fn apply_pax(entry_type: u8, has_pax: bool) -> bool", | |
| "spec_doc": "PAX extended-header data describes the next file entry. Returns whether pending PAX data must be applied to a header of the given type byte: only for real entries, never for GNU long-name 'L', long-link 'K', PAX local 'x' or global 'g' headers.", | |
| "bug_class": "logic", | |
| "fidelity": "verbatim_logic", | |
| "extraction_note": "src/archive.rs: PAX data applied to extension headers (desynchronisation)", | |
| "witness_args": "b'L', true", | |
| "labels": { | |
| "buggy": "astral-tokio-tar@0.6.1", | |
| "reference": "astral-tokio-tar@0.6.2" | |
| } | |
| } |