garydgregory commented on PR #438:
URL: https://github.com/apache/commons-compress/pull/438#issuecomment-1809382916
We are not dealing with ints or longs here though, we are creating a time
object based on a string, so maybe this is not what we need to worry about. It
could be that using a FileTime is just wrong in this case, but this seems like
the best type we have in the JRE. In the meantime, I am considering the
following as more bullet-proof:
```
diff --git
a/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java
b/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java
index 360f940..eba51fc 100644
---
a/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java
+++
b/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java
@@ -30,6 +30,7 @@
import java.nio.file.attribute.DosFileAttributes;
import java.nio.file.attribute.FileTime;
import java.nio.file.attribute.PosixFileAttributes;
+import java.time.DateTimeException;
import java.time.Instant;
import java.util.ArrayList;
import java.util.Collections;
@@ -286,7 +287,13 @@
final BigDecimal epochSeconds = new BigDecimal(value);
final long seconds = epochSeconds.longValue();
final long nanos =
epochSeconds.remainder(BigDecimal.ONE).movePointRight(9).longValue();
- return Instant.ofEpochSecond(seconds, nanos);
+ try {
+ return Instant.ofEpochSecond(seconds, nanos);
+ } catch (DateTimeException | ArithmeticException e) {
+ // DateTimeException if the instant exceeds the maximum or
minimum instant
+ // ArithmeticException if numeric overflow occurs
+ throw new IOException("Corrupted PAX header. Time field value
is invalid '" + value + "'", e);
+ }
}
/** The entry's name. */
```
WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
