GNU tar + hard link bug; possible security issue!

[Dan Egnor]

This is demonstrated best by example.

rm -rf /tmp/foo /tmp/bar /tmp/tmp # be careful
touch /tmp/foo
ln /tmp/foo /tmp/bar
tar -cf- /tmp/foo /tmp/bar | tar -C /tmp -xf-
ls -l /tmp/tmp

You will find that /tmp/tmp/bar is linked to /tmp/foo (and /tmp/bar), but
that /tmp/tmp/foo is linked to nothing.  This is because leading slashes
("crud" in the parlance of the code) are removed from filenames when
extracting, but *not* removed from link names.

This could even be a security problem, since 'tar' will create files which
could be linked to system files; the user might (reasonably) assume otherwise,
even for untrusted tarballs.

Dan