Thank you Sergey for your quick fix.
This has been assigned ID CVE-2021-20193.

---
Carlos

An issue was discovered in GNU Tar 1.33 and earlier. There is a memory leak in read_header() in list.c in the tar application.

Occasionally, ASAN detects an out of bounds memory read, but always reports the memory leak. Valgrind confirms the memory leak in the standard tar tool installed by default. This degrades the availability of the tar tool, and could potentially result in other memory-related issues (some fuzzed binaries stay in a loop for over 7 seconds before return).

Common Weakness Enumeration IDs for reference:
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-125: Out-of-bounds Read

Attached to this report is a PoC malcrafted file "1311745-out-bounds.tar"

VALGRIND OUTPUT:
...
==3776== LEAK SUMMARY:
==3776== definitely lost: 1,311,745 bytes in 1 blocks
...

NOTE: Version 1.30, 1.32, 1.33 were downloaded/tested and confirmed to be vulnerable. Standard installs in Ubuntu, Kali and Fedora also were tested and have the same issue.

NOTE 2: The issue seems to be the "written" variable that holds the number of written bytes. During fuzzing, the application behaves differently under different inputs, but the memory leak / out of bounds report is the common issue seen.

I will update the ticket if I can manage to find out more.

---
Carlos