This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git
The following commit(s) were added to refs/heads/master by this push:
new c42941c8e [COMPRESS-723] TAR PAX header parsing: enforce memory bound
to mitigate resource exhaustion from oversized headers (#770).
c42941c8e is described below
commit c42941c8e29918447eb0e10d5f1bec527be4b143
Author: Gary Gregory <[email protected]>
AuthorDate: Fri Jul 17 17:02:21 2026 -0700
[COMPRESS-723] TAR PAX header parsing: enforce memory bound to mitigate
resource exhaustion from oversized headers (#770).
---
src/changes/changes.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index aa254278e..5cc8e5239 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -92,6 +92,7 @@ The <action> type attribute can be add,update,fix,remove.
<action type="fix" dev="ggregory" issue="COMPRESS-724" due-to="Ruiqi
Dong, Gary Gregory">TarUtils.parsePAX1XSparseHeaders(InputStream, int) skips an
extra record when sparse headers are already record-aligned.</action>
<action type="fix" dev="ggregory" due-to="Gary Gregory, KALI
834X">Reject tar sparse blocks larger than the entry size (#780).</action>
<action type="fix" dev="ggregory" due-to="OldTruckDriver, Gary Gregory"
issue="COMPRESS-724">Fix TAR PAX 1.x sparse header alignment (#775).</action>
+ <action type="fix" dev="ggregory" due-to="subbudvk, Gary Gregory"
issue="COMPRESS-723">TAR PAX header parsing: enforce memory bound to mitigate
resource exhaustion from oversized headers (#770).</action>
<!-- FIX ar -->
<action type="fix" dev="ggregory" due-to="Gary
Gregory">ArArchiveInputStream.readGNUStringTable(byte[], int, int) now provides
a better exception message, wrapping the underlying exception.</action>
<action type="fix" dev="ggregory" due-to="Gary
Gregory">ArArchiveInputStream.read(byte[], int, int) now throws
ArchiveException instead of ArithmeticException.</action>
