kali834x commented on PR #788: URL: https://github.com/apache/commons-compress/pull/788#issuecomment-5033145124
The catch is that decodeBandInt (both the scalar and the int[] counts overload) is the shared decoder for every band, not just reference bands, so it has no idea the values are pool indices or which pool they'll index into. There's no bound in scope there to check against, and signed codecs like DELTA5 legitimately produce values in other bands that would fail such a check. The earliest point the bound exists is where the ints meet the reference array, and at each affected call site that's the line right after decodeBandInt (ClassBands L981/982, CpBands L493-495, IcBands L162/163), so nothing consumes unchecked values in between. It's also the same spot parseReferences and parseCPIntReferences/parseCPLongReferences already guard. If you'd rather fail inside decodeBandInt I could add a variant that takes the pool size as an upper bound, but that looked more invasive for the same effect. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
