A flaw was found in GNU cpio through version 2.15. A stack-based buffer overflow exists in src/tar.c:write_out_tar_header() via set_tar_fname().

When generating archives using the ustar or tar formats (e.g., `cpio -o -H ustar`), set_tar_fname() uses unbounded strcpy() calls to copy user and group names obtained from getpwuid() and getgrgid() into the 32-byte fixed-size tar_hdr->uname and tar_hdr->gname fields within struct tar_header on the stack. If a file being archived is owned by a user or group whose name exceeds 32 characters (common in LDAP, Active Directory, or container environments), strcpy() overflows the destination buffer and corrupts adjacent stack variables.