GNU cpio 2.4.2 has a long-standing bug in it that
causes infinite loops when unpacking input files
with hard-linked empty files.
It also has a security problem in that it sets the
permissions on symlink targets instead of symlinks
when there is no lchown() system call.
Fixed in cpio-2.4.2-13. Thanks for the patch.