Home » File Formats » Archive_Tar
Tar file management class
Download latest release 1.6.0 (there might be newer Composer installable version)
License: New BSD License
Description
This class provides handling of tar files in PHP.
It supports creating, listing, extracting and adding to tar files.
Gzip support is available if PHP has the zlib extension built-in or
loaded. Bz2 compression is also supported with the bz2 extension loaded.
Also Lzma2 compressed archives are supported with xz extension.
Documentation
Maintainers
- Vincent Blavet (vblavet) — lead, inactive
- Greg Beaver (cellog) — lead, inactive
- Michiel Rook (mrook) — lead, inactive
- Drew Webber (mcdruid) — lead, active
- Stig Bakken (ssb) — helper, inactive
Dependencies
Required
- PHP (>= 5.6.0)
- PEAR Installer (>= 1.10.0)
Releases
- 1.6.0 (stable, 2025-07-19)
Release notes
License: New BSD License
This release drops support for PHP 5.4 and 5.5.
* PR #51: big file support
* PR #53: Fix return value of _writeBlock
* PR #58: Remove gzopen/gztell/gzseek shim - 1.5.0 (stable, 2024-03-16)
Release notes
License: New BSD License
* PR #42: fix @return true... to @return bool true... on some functions
* PR #46: use 775 default for mkdirs, to avoid world-write - 1.4.14 (stable, 2021-07-20)
Release notes
License: New BSD License
* Properly fix symbolic link path traversal (CVE-2021-32610)
- 1.4.13 (stable, 2021-05-10)
Release notes
License: New BSD License
* Fix Bug #27010: Relative symlinks failing (out-of path file extraction) [mrook]
- 1.4.12 (stable, 2021-01-18)
Release notes
License: New BSD License
* Fix Bug #27008: Symlink out-of-path write vulnerability (CVE-2020-36193) [mrook]
- 1.4.11 (stable, 2020-11-19)
Release notes
License: New BSD License
* Fix Bug #27002: Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949) [mrook]
- 1.4.10 (stable, 2020-09-15)
Release notes
License: New BSD License
* Fix block padding when the file buffer length is a multiple of 512 and smaller than Archive_Tar buffer length
* Don't try to copy username/groupname in chroot jail - 1.4.9 (stable, 2019-12-04)
Release notes
License: New BSD License
* Implement Feature #23861: Add option to disallow symlinks [mrook]
- 1.4.8 (stable, 2019-10-21)
Release notes
License: New BSD License
* Fix Bug #23852: PHP 7.4 - Archive_Tar->_readHeader throws deprecation [mrook]
- 1.4.7 (stable, 2019-04-08)
Release notes
License: New BSD License
* Improved performance by increasing read buffer size
- 1.4.6 (stable, 2019-04-08)
Release notes
License: New BSD License
* Improve path traversal detection for forward and backward slashes
- 1.4.5 (stable, 2019-01-02)
Release notes
License: New BSD License
* Fix Bug #23788: Relative symlinks are broken [mrook]
- 1.4.4 (stable, 2018-12-20)
Release notes
License: New BSD License
* Fix Bug #21058: Long symlinks are not supported [mrook]
* Fix Bug #23782: Prevent phar:// files from being extracted [mrook] - 1.4.3 (stable, 2017-06-11)
Release notes
License: New BSD License
* Fix Bug #21218: Cannot use result of built-in function in write context in PHP
7.2.0alpha1 [mrook] - 1.4.2 (stable, 2016-02-25)
Release notes
License: New BSD License
* Fix reading of archives with files > 8GB
* Performance optimizations
* Do not try to call require_once on PEAR.php if it has already been loaded by the autoloader - 1.4.1 (stable, 2016-02-25)
Release notes
License: New BSD License
* Update composer.json to use pear-core-minimal 1.10.0alpha2
- 1.4.0 (stable, 2015-07-20)
Release notes
License: New BSD License
* Add support for PHP 7
* Drop support for PHP 4
* Add visibility declarations to methods and properties - 1.3.16 (stable, 2015-04-14)
Release notes
License: New BSD License
* Fix Bug #20514: invalid package.xml; not installable with pyrus [mrook]
- 1.3.15 (stable, 2015-03-05)
Release notes
License: New BSD License
* Fixes composer.json parse error
- 1.3.14 (stable, 2015-02-26)
Release notes
License: New BSD License
* Fix Bug #18505: Possible incorrect handling of file names in TAR [mrook]
- 1.3.13 (stable, 2014-09-03)
Release notes
License: New BSD License
* Fix Bug #20382: gzopen fix [mrook]
- 1.3.12 (stable, 2014-08-04)
Release notes
License: New BSD License
* Fix Bug #19964: Memory leaking in Archive_Tar [mrook]
* Fix Bug #20246: Broken with php 5.5.9 [mrook]
* Fix Bug #20275: "pax_global_header" looks like a regular file
* [mrook]
* Implement Feature #19827: pass filename to _addFile function - downstream
* patch [mrook]
* Implement Feature #20132: Add custom mode/uid/gid to addString() [mrook] - 1.3.11 (stable, 2013-02-09)
Release notes
License: New BSD License
* Fix Bug #19746: Broken with PHP 5.5 [mrook]
* Implement Feature #11258: Custom date/time in files added on-the-fly
* [mrook] - 1.3.10 (stable, 2012-04-10)
Release notes
License: New BSD License
* Fix Bug #13361: Unable to add() some files (ex. mp3) [mrook]
* Fix Bug #19330: Class creates incorrect (non-readable) tar.gz file
* [mrook] - 1.3.9 (stable, 2012-02-27)
Release notes
License: New BSD License
* Fix Bug #16759: No error thrown from missing PHP zlib functions [mrook]
* Fix Bug #18877: Incorrect handling of backslashes in filenames on Linux [mrook]
* Fix Bug #19085: Error while packaging [mrook]
* Fix Bug #19289: Invalid tar file generated [mrook] - 1.3.8 (stable, 2011-10-14)
Release notes
License: New BSD License
* Fix Bug #17853: Test failure: dirtraversal.phpt [mrook]
* Fix Bug #18512: dead links are not saved in tar file [mrook]
* Fix Bug #18702: Unpacks incorrectly on long file names using header prefix [mrook]
* Implement Feature #10145: Patch to return a Pear Error Object on failure [mrook]
* Implement Feature #17491: Option to preserve permissions [mrook]
* Implement Feature #17813: Prevent PHP notice when extracting corrupted archive [mrook] - 1.3.7 (stable, 2010-04-26)
Release notes
License: New BSD License
PEAR compatibility update
- 1.3.6 (stable, 2010-03-09)
Release notes
License: New BSD License
* Fix Bug #16963: extractList can't extract zipped files from big tar [mrook]
* Implement Feature #4013: Ignoring files and directories on creating an archive. [mrook] - 1.3.5 (stable, 2009-12-31)
Release notes
License: New BSD License
* Fix Bug #16958: Update 'compatible' tag in package.xml [mrook]
- 1.3.4 (stable, 2009-12-30)
Release notes
License: New BSD License
* Fix Bug #11871: wrong result of ::listContent() if filename begins or ends with space [mrook]
* Fix Bug #12462: invalid tar magic [mrook]
* Fix Bug #13918: Long filenames may get up to 511 0x00 bytes appended on read [mrook]
* Fix Bug #16202: Bogus modification times [mrook]
* Implement Feature #16212: Die is not exception [mrook] - 1.3.3 (stable, 2009-03-27)
Release notes
License: New BSD License
Change the license to New BSD license
minor bugfix release
* fix Bug #9921 compression with bzip2 fails [cellog]
* fix Bug #11594 _readLongHeader leaves 0 bytes in filename [jamessas]
* fix Bug #11769 Incorrect symlink handing [fajar99] - 1.3.2 (stable, 2007-01-03)
Release notes
License: PHP License
Correct Bug #4016
Remove duplicate remove error display with '@'
Correct Bug #3909 : Check existence of OS_WINDOWS constant
Correct Bug #5452 fix for "lone zero block" when untarring packages
Change filemode (from pear-core/Archive/Tar.php v.1.21)
Correct Bug #6486 Can not extract symlinks
Correct Bug #6933 Archive_Tar (Tar file management class) Directory traversal
Correct Bug #8114 Files added on-the-fly not storing date
Correct Bug #9352 Bug on _dirCheck function over nfs path - 1.3.1 (stable, 2005-03-17)
Release notes
License: PHP License
Correct Bug #3855
- 1.3.0 (stable, 2005-03-06)
Release notes
License: PHP License
Bugs correction (2475, 2488, 2135, 2176)
- 1.2 (stable, 2004-05-08)
Release notes
License: PHP License
Add support for other separator than the space char and bug
correction - 1.1 (stable, 2003-05-28)
Release notes
License: PHP License
* Add support for BZ2 compression
* Add support for add and extract without using temporary files : methods addString() and extractInString() - 1.0 (stable, 2003-01-24)
Release notes
License: PHP License
Change status to stable
- 0.9 (stable, 2002-05-27)
Release notes
License: PHP License
Auto-detect gzip'ed files
- 0.4 (stable, 2002-05-20)
Release notes
License: PHP License
Windows bugfix: use forward slashes inside archives
- 0.3 (stable, 2002-04-13)
Release notes
License: PHP License
Windows bugfix: used wrong directory separators
Bugs
| ID | Status | Type | Version | Date | Summary |
|---|---|---|---|---|---|
| #948 | Bogus | Bug | 2004-03-04 | pear freezes on install | |
| #1034 | Closed | Bug | 2004-03-19 | gzclose(): suppliead argument is not a valid stream resource | |
| #1130 | Closed | Bug | 2004-04-04 | none working bz2 | |
| #1306 | Bogus | Bug | 2004-04-28 | Freeze on "pear package" | |
| #1364 | Closed | Bug | 2004-05-07 | package.xml contains Archive\Tar. | |
| #1693 | Closed | Bug | 2004-06-21 | Archive_Tar does not allow multiple addString()'s | |
| #1719 | Closed | Req | 2004-06-25 | Report warning on unknown/unneccessary parameters | |
| #2135 | Closed | Bug | 2004-08-16 | Does not handle non-sequential file list indexes | |
| #2176 | Closed | Bug | 2004-08-20 | tar.gz always uncompressed | |
| #2475 | Closed | Bug | 2004-10-07 | BUGFIX of "Cannot add directories into the archive..." | |
| #2488 | Closed | Bug | 2004-10-10 | Syntax error | |
| #2735 | No Feedback | Bug | 2004-11-10 | Had trouble opening archive if I gave it an array of absolute paths | |
| #3619 | Closed | Bug | 2005-02-27 | CRITICAL: non-ISO-8859-1 characters in package.xml must be entitied | |
| #3687 | Bogus | Bug | 2005-03-03 | Cannot create compressed archives on php://output | |
| #3694 | Wont fix | Bug | 2005-03-03 | "lone zero block" when untarring packages | |
| #3772 | Bogus | Bug | 2005-03-11 | hang on doing "pear install xxx" etc | |
| #3855 | Closed | Bug | 2005-03-16 | CRITICAL BC BREAK with 1.2 - pear package fails | |
| #3907 | Closed | Bug | 2005-03-22 | Undefined variable error (v. low priority) | |
| #3909 | Closed | Bug | 2005-03-22 | Undefined constant OS_WINDOWS | |
| #3911 | Wont fix | Req | 2005-03-22 | Easier error reporting, no PEAR overhead if not needed. | |
| #4013 | Closed | Req | 2005-03-31 | Ignoring files and directories on creating an archive. | |
| #4016 | Closed | Bug | 2005-03-31 | owner, permissions and file date after addString() | |
| #5452 | Closed | Bug | 2005-09-19 | fix for "lone zero block" when untarring packages | |
| #5632 | Closed | Bug | 2005-10-08 | use of two @ unnecessary in single line | |
| #6027 | Duplicate | Bug | 2005-11-21 | 1.3.2 generates invalid .tar files | |
| #6103 | Closed | Bug | 2005-11-29 | significant performance problem with large archives | |
| #6486 | Closed | Bug | 2006-01-13 | Can not extract symlinks | |
| #6933 | Closed | Bug | 1.3.1 | 2006-02-24 | Archive_Tar (Tar file management class) Directory traversal |
| #8114 | Closed | Bug | 1.3.1 | 2006-07-04 | Files added on-the-fly not storing date |
| #8702 | Bogus | Bug | 1.3.1 | 2006-09-14 | Directory case not obeyed / preserved |
| #9352 | Closed | Bug | 1.3.1 | 2006-11-16 | Bug on _dirCheck function over nfs path |
| #9520 | Suspended | Req | 1.3.1 | 2006-12-01 | Doesn't allow in-memory manipulation of tar files |
| #9921 | Closed | Bug | CVS | 2007-01-22 | compression with bzip2 fails |
| #10145 | Closed | Req | 1.3.2 | 2007-02-21 | Patch to return a Pear Error Object on failure |
| #10159 | Bogus | Bug | 1.3.2 | 2007-02-22 | png/gif problem |
| #10589 | Bogus | Req | 1.3.2 | 2007-04-02 | Patch: allows to exclude files/directories when an archive is created |
| #11171 | Duplicate | Bug | 1.3.2 | 2007-05-28 | Creating a bz2 archive is impossible |
| #11258 | Closed | Req | 1.3.2 | 2007-06-09 | Custom date/time in files added on-the-fly |
| #11594 | Closed | Bug | 1.3.2 | 2007-07-12 | _readLongHeader leaves 0 bytes in filename |
| #11769 | Closed | Bug | 1.3.2 | 2007-08-06 | Incorrect symlink handing |
| #11871 | Closed | Bug | 1.3.2 | 2007-08-20 | wrong result of ::listContent() if filename begins or ends with space |
| #12462 | Closed | Bug | 1.3.2 | 2007-11-16 | invalid tar magic |
| #13322 | No Feedback | Bug | 1.3.2 | 2008-03-06 | Extracting of archive containing symlinks fails |
| #13361 | Closed | Bug | 1.3.2 | 2008-03-10 | Unable to add() some files (ex. mp3) |
| #14318 | Closed | Bug | 1.3.2 | 2008-07-09 | listContent() doesn't work under certain conditions |
| #14523 | Closed | Bug | 1.3.2 | 2008-08-18 | results are consistently corrupted |
| #15114 | Duplicate | Bug | 1.3.2 | 2008-11-21 | Bz2 compression does not work |
| #15972 | Closed | Bug | 2009-03-03 | Bz2 compression does not work on linux | |
| #16202 | Closed | Bug | 1.3.3 | 2009-05-07 | Bogus modification times |
| #16212 | Closed | Req | 1.3.3 | 2009-05-10 | Die is not exception |
| #16759 | Closed | Bug | 1.3.3 | 2009-11-02 | No error thrown from missing PHP zlib functions |
| #16761 | Duplicate | Bug | 1.3.3 | 2009-11-02 | Archive_Tar->create() and ->extract() fail silently after upgrading to Karmic |
| #16860 | Bogus | Bug | 1.3.3 | 2009-12-01 | Wrong archive file dates |
| #16958 | Closed | Bug | 1.3.4 | 2009-12-31 | Update 'compatible' tag in package.xml |
| #16963 | Closed | Bug | 1.3.5 | 2009-12-31 | extractList can't extract zipped files from big tar |
| #17093 | No Feedback | Bug | 1.3.5 | 2010-02-12 | Tar file more 2Gb dont unpack |
| #17436 | Bogus | Req | Unknown | 2010-05-25 | Handling xz and lzma archive |
| #17466 | Wont fix | Req | 1.3.7 | 2010-06-04 | Perfomance improvement request in the call of fread at _jumpblock |
| #17491 | Closed | Req | 1.3.7 | 2010-06-14 | Option to preserve permissions |
| #17578 | No Feedback | Bug | 1.3.7 | 2010-07-11 | Fail to read some POSIX tar files |
| #17809 | Bogus | Doc | SVN | 2010-08-24 | (Please close, not a bug) |
| #17813 | Closed | Req | SVN | 2010-08-24 | Prevent PHP notice when extracting corrupted archive |
| #17853 | Closed | Bug | SVN | 2010-09-09 | Test failure: dirtraversal.phpt |
| #18505 | Closed | Bug | SVN | 2011-05-05 | Possible incorrect handling of file names in TAR |
| #18512 | Closed | Bug | 1.3.7 | 2011-05-09 | dead links are not saved in tar file |
| #18702 | Closed | Bug | 1.3.7 | 2011-08-02 | Unpacks incorrectly on long file names using header prefix |
| #18822 | Bogus | Bug | SVN | 2011-09-10 | undefined variable |
| #18823 | Bogus | Bug | SVN | 2011-09-10 | undefined variable |
| #18877 | Closed | Bug | 1.3.7 | 2011-09-27 | Incorrect handling of backslashes in filenames on Linux |
| #18895 | Bogus | Bug | 1.3.7 | 2011-10-08 | ->extract() fails without throwing exception; ->listContent() returns int(0) |
| #19054 | Bogus | Bug | Unknown | 2011-11-18 | Junk Values |
| #19085 | Closed | Bug | SVN | 2011-11-27 | Error while packaging |
| #19289 | Closed | Bug | 1.3.8 | 2012-02-13 | Invalid tar file generated |
| #19330 | Closed | Bug | 1.3.9 | 2012-03-12 | Class creates incorrect (non-readable) tar.gz file |
| #19661 | Bogus | Bug | 1.3.10 | 2012-10-21 | addModify is very slow in a loop |
| #19662 | Duplicate | Bug | 1.3.10 | 2012-10-21 | addModify is very slow in a loop |
| #19746 | Closed | Bug | 1.3.10 | 2012-12-11 | Broken with PHP 5.5 |
| #19827 | Closed | Req | SVN | 2013-02-19 | pass filename to _addFile function - downstream patch |
| #19889 | Bogus | Bug | 1.3.11 | 2013-04-09 | On I/O error methods should be throwing exceptions |
| #19964 | Closed | Bug | 1.3.11 | 2013-05-29 | Memory leaking in Archive_Tar |
| #20132 | Closed | Req | 1.3.11 | 2013-11-21 | Add custom mode/uid/gid to addString() |
| #20246 | Closed | Bug | 1.3.11 | 2014-04-19 | Broken with php 5.5.9 |
| #20275 | Closed | Bug | 1.3.11 | 2014-05-19 | "pax_global_header" looks like a regular file |
| #20366 | Bogus | Bug | 1.3.12 | 2014-08-10 | windows8.1_x64 failure |
| #20382 | Closed | Bug | 1.3.12 | 2014-08-31 | gzopen fix |
| #20393 | Spam | Req | 1.3.13 | 2014-09-06 | Watch// The Amazing Spider-Man 2 [ONLINE FOR FREE] |
| #20511 | No Feedback | Bug | 1.3.15 | 2015-03-05 | Error Installing New Package |
| #20514 | Closed | Bug | 2015-03-11 | invalid package.xml; not installable with pyrus | |
| #21058 | Closed | Bug | 1.4.2 | 2016-04-28 | Long symlinks are not supported |
| #21143 | Spam | Bug | Unknown | 2016-11-02 | jogi-1844-722-6675-Quickbooks support phone number |
| #21218 | Closed | Bug | 2017-06-10 | Cannot use result of built-in function in write context in PHP 7.2.0alpha1 | |
| #23769 | Feedback | Bug | 1.4.3 | 2018-09-19 | Archive_Tar in Tar::extractList fails to get file |
| #23782 | Closed | Bug | 1.4.3 | 2018-12-20 | Prevent phar:// files from being extracted |
| #23788 | Closed | Bug | 1.4.4 | 2018-12-26 | Relative symlinks are broken |
| #23861 | Closed | Req | 2019-12-04 | Add option to disallow symlinks | |
| #23862 | Bogus | Req | 1.4.8 | 2019-12-04 | Add option to disallow symlinks |
| #27002 | Closed | Bug | 1.4.10 | 2020-11-19 | Filename manipulation vulnerabilities (CVE-2020-28948 / CVE-2020-28949) |
| #27008 | Closed | Bug | 1.4.11 | 2021-01-18 | Symlink out-of-path write vulnerability (CVE-2020-36193) |
| #27010 | Closed | Bug | 1.4.12 | 2021-02-16 | Relative symlinks failing (out-of path file extraction) |
| #29033 | Open | Bug | 1.5.0 | 2025-04-01 | test |