{"record":{"id":"7dcccb97aaa5c72d","repo":"can1357/oh-my-pi","slug":"tar-archive-is-too-large-to-encode-safely","errorCode":null,"errorMessage":"Tar archive is too large to encode safely","messagePattern":"Tar archive is too large to encode safely","errorType":"exception","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/tar.ts","lineNumber":653,"sourceCode":"\tlet length = body.byteLength + 2;\n\tfor (;;) {\n\t\tconst digits = String(length).length;\n\t\tconst next = digits + 1 + body.byteLength;\n\t\tif (next === length) break;\n\t\tlength = next;\n\t}\n\tconst prefix = TEXT_ENCODER.encode(`${length} `);\n\tconst record = new Uint8Array(length);\n\trecord.set(prefix);\n\trecord.set(body, prefix.byteLength);\n\treturn record;\n}\n\nfunction concatBytes(parts: readonly Uint8Array[]): Uint8Array {\n\tlet length = 0;\n\tfor (const part of parts) {\n\t\tlength += part.byteLength;\n\t\tif (!Number.isSafeInteger(length)) throw new ArchiveError(\"Tar archive is too large to encode safely\");\n\t}\n\tconst output = new Uint8Array(length);\n\tlet offset = 0;\n\tfor (const part of parts) {\n\t\toutput.set(part, offset);\n\t\toffset += part.byteLength;\n\t}\n\treturn output;\n}\n\nfunction makeHeader(\n\tname: Uint8Array,\n\tprefix: Uint8Array,\n\tsize: number,\n\tmtime: number,\n\tmode: number,\n\ttypeFlag: number,\n): Uint8Array {","sourceCodeStart":635,"sourceCodeEnd":671,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/tar.ts#L635-L671","documentation":"concatBytes accumulates the total byte length of all tar parts and allocates one output buffer. If the running total exceeds Number.MAX_SAFE_INTEGER the library refuses to build an archive whose size cannot be represented safely in JavaScript numbers, rather than producing a corrupt buffer.","triggerScenarios":"Encoding a tar from a members map whose combined (padded) entry and header bytes exceed Number.MAX_SAFE_INTEGER (~9 PB). Practically unreachable with real files; requires absurd input sizes or an arithmetic bug upstream.","commonSituations":"Feeding computed/attacker-controlled sizes that overflow; a bug multiplying padding or block counts; fuzzing the encoder.","solutions":["Audit the sizes passed into createTar; real archives are far below the limit","Cap total archive size before encoding and split into multiple archives","Check for arithmetic errors producing inflated part sizes"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"let total = 0;\nfor (const [p, bytes] of members) total += bytes.byteLength + 512;\nif (!Number.isSafeInteger(total)) throw new Error(\"Archive too large\");","typeGuard":null,"tryCatchPattern":"try {\n\treturn await createTar(members);\n} catch (err) {\n\tif (err instanceof ArchiveError && err.message.includes(\"too large\")) {\n\t\t// split members into multiple archives\n\t}\n\tthrow err;\n}","preventionTips":["Cap total archive size well below Number.MAX_SAFE_INTEGER in your pipeline","Split very large member sets into multiple archives"],"tags":["archive","tar","overflow"],"backgroundTag":"tar-header-numeric-overflow","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}