Description:
------------
There is a off-by-one overflow in phar_is_tar function in ext/phar/tar.c.

>>>
	char save[sizeof(header->checksum)], *bname;

	/* assume that the first filename in a tar won't begin with <?php */
	if (!strncmp(buf, "<?php", sizeof("<?php")-1)) {
		return 0;
	}

	memcpy(save, header->checksum, sizeof(header->checksum));
	memset(header->checksum, ' ', sizeof(header->checksum));
>>>
As code show above, the length of save should be sizeof(header->checksum)+1. Because, the char array should be terminated by the NULL character.

Test script:
---------------
No

Expected result:
----------------
No

Actual result:
--------------
No