The GitHub Actions job "Java CI with Ant" on poi.git/fix-zip-fake-entry-allocation has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 2bbb1e7aa7c133276e6a7a3500d6ccba880c9a86 / PJ Fanning <[email protected]> Avoid large eager allocation from untrusted zip entry size in ZipArchiveFakeEntry The in-memory branch sized its read buffer from ZipArchiveEntry.getSize(), which comes from the (untrusted) zip local file header. A tiny entry could declare a huge uncompressed size and force a ~getMaxEntrySize() (100MB by default) eager allocation before any data was read, without the inflate-ratio guard ever firing. Read the actual bytes present via IOUtils.toByteArrayWithMaxLength, growing the buffer as needed and bounded by getMaxEntrySize() (a stream longer than that fails with RecordFormatException). This matches the existing behaviour of the unknown-size (entrySize == -1) branch. Behaviour change: an entry whose declared size exceeds its actual byte count now reads the actual bytes instead of throwing EOFException. Test updated accordingly. Co-Authored-By: Claude Fable 5 <[email protected]> Report URL: https://github.com/apache/poi/actions/runs/33403260698 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
