See attached bad.tar.

$ less bad.tar | cat
drwxr-xr-x 0/0               0 2012-09-05 20:04 foo/
-rw-rw-r-- uname/gname       0 2012-09-05 20:04 foo/a
$ python -c 'import tarfile; print(tarfile.open("bad.tar").getnames())'
['foo']
$ python -c 'import tarfile, patch; patch.patch_tarfile(); print (tarfile.open("bad.tar").getnames())'
['foo', 'foo/a']

I'm only allowed to attach one file via the tracker web UI, so patch.py will follow.

Creation code for bad.tar, largely for my benefit:

import java.io.FileOutputStream;
import java.io.IOException;
import org.codehaus.plexus.archiver.tar.TarOutputStream;
import org.codehaus.plexus.archiver.tar.TarEntry;

class TarTest {
    public static void main(String[] args) throws IOException {
        FileOutputStream fos = new FileOutputStream("bad.tar");
        TarOutputStream tos = new TarOutputStream(fos);

        TarEntry entry = new TarEntry("foo/");
        entry.setMode(16877); // 0o40755
        entry.setUserId(0);
        entry.setGroupId(0);
        entry.setUserName("");
        entry.setGroupName("");
        tos.putNextEntry(entry);

        TarEntry entry2 = new TarEntry("foo/a");
        entry2.setMode(33204); // 0o100664
        entry2.setUserId(-1);  // XXX: dodgy
        entry2.setGroupId(-1); // XXX: dodgy
        entry2.setUserName("uname");
        entry2.setGroupName("gname");
        tos.putNextEntry(entry2);

        tos.close();
        fos.close();
    }
}