This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/commons-compress.git
commit 5834d77d030780f6f0194b01133d4b8b9a94f1ae Author: Gary Gregory <[email protected]> AuthorDate: Mon Jul 13 13:09:47 2026 -0400 Reject short LZMA properties and oversized dictionary in LZMADecoder (#784). --- src/changes/changes.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/src/changes/changes.xml b/src/changes/changes.xml index 0f5059307..591bcd70c 100644 --- a/src/changes/changes.xml +++ b/src/changes/changes.xml @@ -59,6 +59,7 @@ The <action> type attribute can be add,update,fix,remove. <action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">SevenZFile now enforces the same folder and coder limits as the CPP implementation.</action> <action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">Refactor unsigned number parsing and header validation in SevenZFile.</action> <action type="fix" dev="ggregory" due-to="Gary Gregory">Fix Apache RAT plugin console warnings.</action> + <action type="fix" dev="ggregory" due-to="KALI 834X, Gary Gregory">Reject short LZMA properties and oversized dictionary in LZMADecoder (#784).</action> <!-- FIX bzip2 --> <action type="fix" dev="ggregory" due-to="Tyler Nighswander, Gary Gregory">BZip2CompressorInputStream now throw CompressorException (a subclass of IOException) for invalid or corrupted data, providing more specific error reporting.</action> <action type="fix" dev="pkarwasz" due-to="Tyler Nighswander, Piotr P. Karwasz">BZip2 input streams treat Huffman codes longer than 20 bits as corrupted data, matching the behavior of the reference implementation.</action>
