simpleqt opened a new pull request, #833:
URL: https://github.com/apache/commons-compress/pull/833
`CpioArchiveOutputStream.write(byte[], int, int)` adds the checksum of a
new-crc entry from the start of the caller's array instead of from the written
slice:
```java
for (int pos = 0; pos < len; pos++) {
this.crc += b[pos] & 0xFF;
```
`off` is ignored, so any write from the middle of a buffer produces a
checksum that does not match the checksum the caller set on the entry, and
`closeArchiveEntry()` (CpioArchiveOutputStream.java:204) fails with
`ArchiveException: CRC Error` although the bytes written to the archive are
correct. Writing the same bytes with `off == 0` works, and the archive is
unusable in the offset case.
Minimal reproduction (also the new regression test):
```java
final byte[] buffer = { 9, 9, 9, 9, 1, 2, 3, 4, 5, 9, 9 }; // the payload
is bytes 4..8, checksum 15
try (CpioArchiveOutputStream out = new CpioArchiveOutputStream(bos,
CpioConstants.FORMAT_NEW_CRC)) {
final CpioArchiveEntry entry = new
CpioArchiveEntry(CpioConstants.FORMAT_NEW_CRC, "test.txt", 5);
entry.setChksum(15);
out.putArchiveEntry(entry);
out.write(buffer, 4, 5); // sums bytes 0..4 (checksum 45)
instead of 4..8
out.closeArchiveEntry(); // ArchiveException: CRC Error
}
```
This is the writer-side counterpart of COMPRESS-711, which fixed the same
defect in `CpioArchiveInputStream.read` (`crc += b[off + pos] & 0xFF`, line
387). The fix changes the loop to `for (int pos = off; pos < off + len;
pos++)`, so the checksum covers exactly the bytes handed to the underlying
stream; the checksum validation itself is unchanged.
Validation:
- The new test
`CpioArchiveOutputStreamTest#testWriteFromBufferOffsetChecksumsTheWrittenSlice`
fails on the pre-fix base (`writing from a buffer offset must not produce a
checksum error ==> Unexpected exception thrown: ArchiveException: CRC Error`)
and passes with the fix, including the entry name, the checksum read back and
the entry content.
- All 38 tests in `org.apache.commons.compress.archivers.cpio` pass,
including `CpioArchiveTest` which round-trips the new-crc format.
- Full `mvn test` passes (4782 tests, 0 failures), checkstyle reports 0
violations.
No `src/changes/changes.xml` entry is included because the entry format
requires a JIRA issue key and I do not have a JIRA account. Happy to add one,
e.g. under `<!-- FIX cpio -->`:
```xml
<action type="fix" issue="COMPRESS-xxx" dev="simpleqt"
due-to="simpleqt">[Cpio] Fix checksum calculation in CpioArchiveOutputStream
when writing with a non-zero offset.</action>
```
AI assistance used to diagnose and fix this defect; the analysis and the
change have been reviewed and verified as described above.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
