{"record":{"id":"30470efec3f819fc","repo":"affaan-m/ECC","slug":"nasiko-archive-is-truncated","errorCode":null,"errorMessage":"Nasiko archive is truncated.","messagePattern":"Nasiko archive is truncated\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/lib/nasiko-release.js","lineNumber":120,"sourceCode":"      const terminatorEnd = offset + 1024;\n      if (\n        terminatorEnd > tar.length\n        || !tar.subarray(offset + 512, terminatorEnd).every(byte => byte === 0)\n        || !tar.subarray(terminatorEnd).every(byte => byte === 0)\n      ) {\n        throw new Error('Unsafe Nasiko archive: incomplete terminator or nonzero trailing data.');\n      }\n      terminated = true;\n      break;\n    }\n    const name = readTarString(header, 0, 100);\n    const prefix = readTarString(header, 345, 155);\n    const type = String.fromCharCode(header[156] || 48);\n    const size = readTarOctal(header, 124, 12);\n    const start = offset + 512;\n    const end = start + size;\n    const paddedEnd = start + Math.ceil(size / 512) * 512;\n    if (!Number.isSafeInteger(end) || paddedEnd > tar.length) throw new Error('Nasiko archive is truncated.');\n    const payload = tar.subarray(start, end);\n    if (!tar.subarray(end, paddedEnd).every(byte => byte === 0)) {\n      throw new Error('Unsafe Nasiko archive: nonzero tar padding.');\n    }\n    const isBinary = !prefix && name === expectedName && (type === '0' || type === '\\0');\n    const isAppleDouble = !prefix && name === `._${expectedName}` && type === '0' && size <= 1024 * 1024;\n    const isPaxMetadata = !prefix && name === `PaxHeader/${expectedName}` && type === 'x' && size <= 64 * 1024\n      && !/(?:^|\\n)(?:path|linkpath)=/i.test(payload.toString('utf8'));\n    if (isBinary && !binary && size > 0 && size <= MAX_BINARY_BYTES) binary = Buffer.from(payload);\n    else if (!isAppleDouble && !isPaxMetadata) throw new Error('Unsafe Nasiko archive: expected exactly one bounded regular binary file.');\n    offset = paddedEnd;\n  }\n  if (!terminated) throw new Error('Unsafe Nasiko archive: missing complete tar terminator.');\n  if (!binary) throw new Error('Unsafe Nasiko archive: expected exactly one bounded regular binary file.');\n  return binary;\n}\n\nfunction fetchBytes(url, options = {}) {","sourceCodeStart":102,"sourceCodeEnd":138,"githubUrl":"https://github.com/affaan-m/ECC/blob/8321021c54d670126ce3b2969d5deb880b4b0c2a/scripts/lib/nasiko-release.js#L102-L138","documentation":"extractQualifiedTarGzip computes each tar entry's end and padded end from its size field. If the padded end extends past the decompressed archive length (or the computed end is not a safe integer), the entry payload is incomplete and the archive is rejected as truncated. This prevents reading partial file payloads from malformed tars.","triggerScenarios":"Calling extractQualifiedTarGzip with a tar whose bytes end in the middle of a file entry: header size field implies paddedEnd > tar.length, or start+size overflows Number.MAX_SAFE_INTEGER.","commonSituations":"Interrupted download of the release tarball; corrupted gzip decompression; extremely large/corrupted size field in a malicious archive; disk-space truncation when the file was cached.","solutions":["Re-download the Nasiko archive and verify its checksum before extraction.","Retry the gunzip/extract step on a fresh buffer to rule out a truncated read.","Check available disk space if the archive was written to disk first.","If intentional, repack the archive correctly with tar so all entries are complete."],"exampleFix":"// before\nconst tar = extractQualifiedTarGzip(partialBuffer);\n// after\nconst ok = await verifyChecksum(url, sha256);\nif (!ok) throw new Error('Archive checksum mismatch; refusing to extract.');\nconst tar = extractQualifiedTarGzip(await downloadFully(url));","handlingStrategy":"validation","validationCode":"if (Buffer.byteLength(tarBuffer) < 512) throw new Error('Tar too small to be valid.');","typeGuard":null,"tryCatchPattern":"try { return extractQualifiedTarGzip(tar); } catch (err) { if (err.message === 'Nasiko archive is truncated.') return refetchArchive(url); throw err; }","preventionTips":["Confirm download completion against Content-Length before gunzip","Run gunzip with strict trailing-data checks (gzip -t equivalent)","Verify checksums published by the registry for every release","Avoid writing partial downloads to the cache path consumed by the extractor"],"tags":["archive","tar","truncation","validation"],"backgroundTag":"unexpected-response-shape","analyzedSha":"8321021c54d670126ce3b2969d5deb880b4b0c2a","analyzedAt":"2026-09-16T10:08:13.343Z","contentChangedAt":"2026-09-16T10:08:13.343Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}