(commons-compress) branch master updated: Reject missing main header in ArjArchiveInputStream.readMainHeader (#793)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new c9f8c4221 Reject missing main header in 
ArjArchiveInputStream.readMainHeader (#793)
c9f8c4221 is described below

commit c9f8c422142a5f26a49c52ba90ac1d4a518b3609
Author: KALI 834X <kali8...@gmail.com>
AuthorDate: Tue Aug 4 17:49:06 2026 +0530

    Reject missing main header in ArjArchiveInputStream.readMainHeader (#793)
    
    readHeader returns null for the zero-length basic header that marks the end 
of an arj archive. readLocalFileHeader already tests for it, but readMainHeader 
passed it straight to ByteArrayInputStream, so an archive starting with the 
terminator threw NullPointerException instead of ArchiveException.
---
 .../compress/archivers/arj/ArjArchiveInputStream.java        |  3 +++
 .../compress/archivers/arj/ArjArchiveInputStreamTest.java    | 12 ++++++++++++
 2 files changed, 15 insertions(+)

diff --git 
a/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
 
b/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
index cc5d886d0..6c6849f2f 100644
--- 
a/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
+++ 
b/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
@@ -416,6 +416,9 @@ private LocalFileHeader readLocalFileHeader() throws 
IOException {
 
     private MainHeader readMainHeader(final boolean selfExtracting) throws 
IOException {
         final byte[] basicHeaderBytes = selfExtracting ? findMainHeader() : 
readHeader();
+        if (basicHeaderBytes == null) {
+            throw new ArchiveException("Corrupted ARJ archive: Missing main 
header");
+        }
         final MainHeader header = new MainHeader();
         try (InputStream basicHeader = new 
ByteArrayInputStream(basicHeaderBytes)) {
             final int firstHeaderSize = readUnsignedByte(basicHeader);
diff --git 
a/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
 
b/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
index b021d3de2..73ba8ff99 100644
--- 
a/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
+++ 
b/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
@@ -180,6 +180,18 @@ void testGetNextEntry() throws Exception {
         assertEquals(expected.toString(), result.toString());
     }
 
+    /**
+     * A basic header size of zero is the end-of-archive marker, so an archive 
starting with one carries no main header.
+     *
+     * @param selfExtracting whether to scan for the main header.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = { false, true })
+    void testMissingMainHeader(final boolean selfExtracting) {
+        final byte[] bytes = { 0x60, (byte) 0xEA, 0x00, 0x00 };
+        assertThrows(ArchiveException.class, () -> 
ArjArchiveInputStream.builder().setByteArray(bytes).setSelfExtracting(selfExtracting).get());
+    }
+
     @Test
     void testMultiByteReadConsistentlyReturnsMinusOneAtEof() throws Exception {
         final byte[] buf = new byte[2];