Byambadalai Sumiya

A stack-based buffer overflow occurs in the `raw to header()` function within src/microtar.c. This issue allows attackers to corrupt adjacent stack memory by providing a specially crafted TAR archive containing `name` or `linkname` fields that are not null-terminated. The function utilizes `strcpy()` to copy 100-byte ustar format fields; when these fields lack null terminators, it can result in writes of up to 355 bytes into a 100-byte destination buffer. This happens when the `mtar open()`, `mtar find()`, or `mtar read header()` functions process the malicious archive.

A denial of service occurs when a multipart/form-data request is sent with a field name that collides with an inherited Object.prototype property, such as ` proto `, `constructor`, or `toString`. This causes the parser to invoke the `.push()` function on the inherited prototype value instead of an array, resulting in a TypeError that triggers an uncaught exception and crashes the process. This issue affects any service that accepts multipart uploads via multiparty.

A denial of service occurs due to an uncaught exception during the parsing of `multipart/form-data` requests. When a request contains a `Content-Disposition` header with a `filename*` parameter featuring malformed percent-encoding, the parser calls the `decodeURI()` function without a try/catch block. This results in a `URIError` that crashes the process, affecting any service that accepts multipart uploads via this library.