Copilot commented on code in PR #784:
URL: https://github.com/apache/commons-compress/pull/784#discussion_r3572404921
##########
src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java:
##########
@@ -63,8 +60,15 @@ OutputStream encode(final OutputStream out, final Object
opts) throws IOExceptio
return new FlushShieldFilterOutputStream(new LZMAOutputStream(out,
getOptions(opts), false));
}
- private int getDictionarySize(final Coder coder) throws
IllegalArgumentException {
- return (int) ByteUtils.fromLittleEndian(coder.properties, 1, 4);
+ private int getDictionarySize(final Coder coder) throws ArchiveException {
+ if (coder.properties.length < 5) {
+ throw new ArchiveException("LZMA properties too short");
+ }
Review Comment:
The error message for short LZMA properties doesn’t indicate the expected
size. Since the dictionary size is read from 4 bytes at offset 1, callers need
5 bytes total; including that in the message makes failures easier to diagnose
and avoids confusion with the existing <1-byte checks elsewhere in this class.
##########
src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java:
##########
@@ -63,8 +60,15 @@ OutputStream encode(final OutputStream out, final Object
opts) throws IOExceptio
return new FlushShieldFilterOutputStream(new LZMAOutputStream(out,
getOptions(opts), false));
}
- private int getDictionarySize(final Coder coder) throws
IllegalArgumentException {
- return (int) ByteUtils.fromLittleEndian(coder.properties, 1, 4);
+ private int getDictionarySize(final Coder coder) throws ArchiveException {
+ if (coder.properties.length < 5) {
+ throw new ArchiveException("LZMA properties too short");
+ }
+ final long dictionarySize =
ByteUtils.fromLittleEndian(coder.properties, 1, 4);
+ if (dictionarySize > LZMAInputStream.DICT_SIZE_MAX) {
+ throw new ArchiveException("Dictionary larger than 4 GiB maximum
size");
+ }
Review Comment:
This check enforces `dictionarySize > LZMAInputStream.DICT_SIZE_MAX`, but
the message hard-codes “4 GiB”. That can be misleading if `DICT_SIZE_MAX` is
different (and makes future changes riskier). Consider wording the message in
terms of the actual limit being enforced.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
