Copilot commented on code in PR #785:
URL: https://github.com/apache/commons-compress/pull/785#discussion_r3572400272
##########
src/main/java/org/apache/commons/compress/compressors/deflate64/HuffmanDecoder.java:
##########
@@ -171,14 +172,23 @@ private int decodeNext(final byte[] b, final int off,
final int len) throws IOEx
while (result < len) {
final int symbol = nextSymbol(reader, lengthTree);
if (symbol < 256) {
+ if (symbol < 0) {
+ throw new CompressorException("Invalid Deflate64
literal/length code %,d", symbol);
+ }
b[off + result++] = memory.add((byte) symbol);
} else if (symbol > 256) {
+ if (symbol - 257 >= RUN_LENGTH_TABLE.length) {
+ throw new CompressorException("Invalid Deflate64
literal/length code %,d", symbol);
+ }
final int runMask = RUN_LENGTH_TABLE[symbol - 257];
int run = runMask >>> 5;
final int runXtra = runMask & 0x1F;
run = ExactMath.add(run, readBits(runXtra));
final int distSym = nextSymbol(reader, distanceTree);
+ if (distSym < 0 || distSym >= DISTANCE_TABLE.length) {
+ throw new CompressorException("Invalid Deflate64
distance code %,d", distSym);
+ }
Review Comment:
The new distance-symbol bounds check is important behavior change but
currently isn’t covered by a unit test. Please add a test case that drives
`nextSymbol(reader, distanceTree)` to return an invalid value (e.g., -1 from an
incomplete dynamic distance tree, or an out-of-range symbol) and assert that
decoding fails with `CompressorException` (and ideally verifies the message
contains the distance code).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
