The `phar tar number()` function parses the octal size field of a TAR header into a `uint32 t` without an overflow check. Because the field is 11 octal digits wide and can hold values up to 0x1FFFFFFFF, any size exceeding 0xFFFFFFFF silently wraps. This causes the parser to skip an incorrect number of data blocks and interpret attacker-controlled file content as the subsequent TAR header, allowing a crafted archive to inject entries that PharData reports and extracts as genuine.