kali834x opened a new pull request, #805:
URL: https://github.com/apache/commons-compress/pull/805
ReferenceForm.setByteCodeOperands and NewClassRefForm.setByteCodeOperands
catch the Pack200Exception raised by setNestedEntries and rethrow it as a bare
java.lang.Error("Got a pack200 exception. What to do?"), dropping the cause,
even though both methods already declare throws Pack200Exception.
bc_imethodref, bc_fieldref, bc_methodref and the other reference bands are
DELTA5 (bc_classref is UNSIGNED5 narrowed to int), so a crafted .pack can hand
a negative operand to SegmentConstantPool.toIndex; the resulting Error is
neither Pack200Exception nor RuntimeException, so Pack200UnpackerAdapter.unpack
does not wrap it and it escapes the Pack200CompressorInputStream constructor,
which declares only IOException. a mutated pack200-e1.pack from the test
resources reproduces it. drop the two catch blocks so the declared exception
propagates and the adapter reports it as a normal Pack200Exception ("Cannot
have a negative index"), in line with the 1.29 change that already replaced the
other E
rror throws in unpack200. regression test added to CodeAttributeTest for
invokeinterface (ReferenceForm) and new (NewClassRefForm).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
