kali834x opened a new pull request, #784: URL: https://github.com/apache/commons-compress/pull/784
getDictionarySize reads the 4-byte lzma dictionary size at offset 1 of coder.properties, but decode and getOptionsFromCoder only reject properties.length < 1. a 7z folder whose lzma coder declares a 1..4 byte property field makes ByteUtils.fromLittleEndian over-read the array and throw ArrayIndexOutOfBoundsException rather than an ArchiveException. the value was also narrowed straight to int, so a size at or above 2^31 went negative and slipped past the DICT_SIZE_MAX cap, surfacing an org.tukaani.xz UnsupportedOptionsException from getMemoryUsage. requiring the full 5 property bytes and comparing the size as an unsigned long before narrowing, both moved into getDictionarySize, closes the over-read and the cap bypass on the decode path and on getOptionsFromCoder which had no cap at all. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
