This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git
The following commit(s) were added to refs/heads/master by this push:
new ab221c74c Reject out-of-range indices in pack200 BandSet.getReferences
(#788)
ab221c74c is described below
commit ab221c74cf128f1372df7a9cbbf11f7dcf2c6702
Author: KALI 834X <[email protected]>
AuthorDate: Tue Jul 21 20:59:05 2026 +0530
Reject out-of-range indices in pack200 BandSet.getReferences (#788)
* reject out-of-range reference indices in BandSet getReferences
* Improve error message for invalid reference index
---------
Co-authored-by: Gary Gregory <[email protected]>
---
.../compress/harmony/unpack200/BandSet.java | 22 ++++++++++++++++++----
.../compress/harmony/unpack200/BandSetTest.java | 14 ++++++++++++++
2 files changed, 32 insertions(+), 4 deletions(-)
diff --git
a/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
b/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
index 856a17d2e..eeceeb9f2 100644
--- a/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
+++ b/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
@@ -184,9 +184,18 @@ public int[][] decodeBandInt(final String name, final
InputStream in, final BHSD
* @param ints The indices into the {@code reference} array.
* @param reference The source array.
* @return A new array.
+ * @throws Pack200Exception if an index falls outside the range
[0..reference.length-1].
*/
- protected String[] getReferences(final int[] ints, final String[]
reference) {
- return ArrayUtils.setAll(new String[ints.length], i ->
reference[ints[i]]);
+ protected String[] getReferences(final int[] ints, final String[]
reference) throws Pack200Exception {
+ final String[] result = new String[ints.length];
+ for (int i = 0; i < ints.length; i++) {
+ final int index = ints[i];
+ if (index < 0 || index >= reference.length) {
+ throw new Pack200Exception("Invalid reference index = %,d,
array length = %,d", index, reference.length);
+ }
+ result[i] = reference[index];
+ }
+ return result;
}
/**
@@ -195,13 +204,18 @@ protected String[] getReferences(final int[] ints, final
String[] reference) {
* @param ints The indices into the {@code reference} array.
* @param reference The source array.
* @return A new array.
+ * @throws Pack200Exception if an index falls outside the range
[0..reference.length-1].
*/
- protected String[][] getReferences(final int[][] ints, final String[]
reference) {
+ protected String[][] getReferences(final int[][] ints, final String[]
reference) throws Pack200Exception {
final String[][] result = new String[ints.length][];
for (int i = 0; i < result.length; i++) {
result[i] = new String[ints[i].length];
for (int j = 0; j < result[i].length; j++) {
- result[i][j] = reference[ints[i][j]];
+ final int index = ints[i][j];
+ if (index < 0 || index >= reference.length) {
+ throw new Pack200Exception("Invalid reference index = %,d,
array length = %,d", index, reference.length);
+ }
+ result[i][j] = reference[index];
}
}
return result;
diff --git
a/src/test/java/org/apache/commons/compress/harmony/unpack200/BandSetTest.java
b/src/test/java/org/apache/commons/compress/harmony/unpack200/BandSetTest.java
index 48e0b8393..a96e21f52 100644
---
a/src/test/java/org/apache/commons/compress/harmony/unpack200/BandSetTest.java
+++
b/src/test/java/org/apache/commons/compress/harmony/unpack200/BandSetTest.java
@@ -78,6 +78,20 @@ void testDecodeBandIntRejectsNegativeCount() {
() -> bandSet.parseReferences("Test", new
ByteArrayInputStream(new byte[0]), codec, new int[] { -1, 1 }, new String[] {
"a" }));
}
+ @Test
+ void testGetReferencesRejectsOutOfRangeIndex() throws Exception {
+ // getReferences resolves band-decoded indices into a constant-pool
array. An index at or past the
+ // end of that array must be rejected the same way the sibling
parseReferences rejects it, instead of
+ // reaching reference[index] and surfacing an
ArrayIndexOutOfBoundsException that escapes the declared
+ // Pack200Exception contract.
+ final String[] reference = { "a", "b" };
+ assertThrows(Pack200Exception.class, () -> bandSet.getReferences(new
int[] { 2 }, reference));
+ assertThrows(Pack200Exception.class, () -> bandSet.getReferences(new
int[] { -1 }, reference));
+ assertThrows(Pack200Exception.class, () -> bandSet.getReferences(new
int[][] { { 2 } }, reference));
+ // A valid index still resolves.
+ assertEquals("b", bandSet.getReferences(new int[] { 1 },
reference)[0]);
+ }
+
@Test
@Disabled("TODO: Implement")
void testParseFlags1() {
