Insufficient validation of PAX extensions during extraction

tar-rs incorrectly ignores PAX size headers if header size is nonzero

unpack_in can chmod arbitrary directories by following symlinks