(commons-compress) branch master updated: [COMPRESS-723] TAR PAX header parsing: enforce memory bound to mitigate resource exhaustion from oversized headers (#770).

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new 9499ba8ed [COMPRESS-723] TAR PAX header parsing: enforce memory bound 
to mitigate resource exhaustion from oversized headers (#770).
9499ba8ed is described below

commit 9499ba8ed3c6dce1275ac3d0471afa414b23daff
Author: Gary Gregory <garydgreg...@gmail.com>
AuthorDate: Fri Jul 17 17:34:56 2026 -0700

    [COMPRESS-723] TAR PAX header parsing: enforce memory bound to mitigate
    resource exhaustion from oversized headers (#770).
---
 .../apache/commons/compress/archivers/MaxNameEntryLengthTest.java   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git 
a/src/test/java/org/apache/commons/compress/archivers/MaxNameEntryLengthTest.java
 
b/src/test/java/org/apache/commons/compress/archivers/MaxNameEntryLengthTest.java
index 10fef8f14..1eb4aa34c 100644
--- 
a/src/test/java/org/apache/commons/compress/archivers/MaxNameEntryLengthTest.java
+++ 
b/src/test/java/org/apache/commons/compress/archivers/MaxNameEntryLengthTest.java
@@ -99,6 +99,7 @@ static Stream<Arguments> testTruncatedStreams() throws 
IOException {
                         TarArchiveInputStream.builder()
                                 .setMaxEntryNameLength(Integer.MAX_VALUE)
                                 
.setURI(getURI("synthetic/long-name/pax-fail.tar"))
+                                .setMaxPaxHeaderSize(Integer.MAX_VALUE)
                                 .get(),
                         // The PAX entry length is the limiting factor: 
"2147483647 path=...\n"
                         Integer.MAX_VALUE),
@@ -113,7 +114,10 @@ static Stream<Arguments> testTruncatedStreams() throws 
IOException {
     static Stream<Arguments> testTruncatedTarFiles() throws IOException {
         return Stream.of(
                 Arguments.of(
-                        
TarFile.builder().setMaxEntryNameLength(Integer.MAX_VALUE).setURI(getURI("synthetic/long-name/pax-fail.tar")),
+                        TarFile.builder()
+                            .setMaxEntryNameLength(Integer.MAX_VALUE)
+                            .setMaxPaxHeaderSize(Integer.MAX_VALUE)
+                            
.setURI(getURI("synthetic/long-name/pax-fail.tar")),
                         Integer.MAX_VALUE
                 ),
                 Arguments.of(