subbudvk opened a new pull request, #770:
URL: https://github.com/apache/commons-compress/pull/770

   Enforce a configurable memory bound on PAX header parsing via a new 
`maxPaxHeaderSize` builder option on `TarArchiveInputStream` and `TarFile`. The 
default is 10 MB (`TarConstants.DEFAULT_MAX_PAX_HEADER_SIZE`), enforced through 
the existing `MemoryLimitException.checkBytes()` mechanism. This closes the 
last unbounded allocation surface in the TAR parsing pipeline and follows the 
same defense-in-depth pattern already established for entry names and 7z 
headers.
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to