🚀 go-pugleaf

In tar-1.11, extract.c, line 343 or thereabouts, we have


			 /*
			  * Kludge alert.  NAME is assigned to header.name
			  * because during the extraction, the space that
			  * contains the header will get scribbled on, and
			  * the name will get munged, so any error messages
			  * that happen to contain the filename will look
			  * REAL interesting unless we do this.
			  */
			 namelen = strlen(skipcrud + current_file_name);
			 name = (char *) malloc((sizeof(char)) * namelen);
			 bcopy(skipcrud+current_file_name, name, namelen);
			 size = hstat.st_size;
			 extract_sparse_file(fd, &size, hstat.st_size, name);

Is it not the case that 'name' is not null-terminated?
Don't we want:

			 namelen = strlen(skipcrud + current_file_name);
			 name = (char *) malloc((sizeof(char)) * (namelen + 1));
			 bcopy(skipcrud+current_file_name, name, namelen);
			name[namelen] = '\0';
			 size = hstat.st_size;
			 extract_sparse_file(fd, &size, hstat.st_size, name);