CVE-2019-9923

An attacker crafts a malformed archive whose extended headers trigger a code path in `pax_decode_header` where `find_next_block()` returns NULL, causing a NULL pointer dereference [ref_id=1]. The issue arises in two locations within the function: one via the `COPY_BUF` macro loop and another in the direct call for decoding, both lacking a NULL check after seeking the next block [CWE-476]. No authentication or special privileges are needed; the attacker only needs to supply the crafted archive to GNU Tar's extraction routine. The crash occurs during parsing of the sparse header data, before any payload data is processed, making it a simple denial-of-service vector.

The patch adds two `if (!blk) FATAL_ERROR(...)` checks in `src/sparse.c` `pax_decode_header` after calls to `find_next_block()` [ref_id=1]. The first check guards the `b = find_next_block()` inside the `COPY_BUF` macro loop; the second guards the direct `blk = find_next_block()` call. Without these checks, when `find_next_block()` returns NULL at end-of-archive, the subsequent dereference `b->buffer` or `blk->buffer` triggers a NULL pointer dereference. The fix converts this undefined behavior into a controlled fatal error with a diagnostic message.