kali834x commented on code in PR #785:
URL: https://github.com/apache/commons-compress/pull/785#discussion_r3577185881
##########
src/main/java/org/apache/commons/compress/compressors/deflate64/HuffmanDecoder.java:
##########
@@ -171,14 +172,23 @@ private int decodeNext(final byte[] b, final int off,
final int len) throws IOEx
while (result < len) {
final int symbol = nextSymbol(reader, lengthTree);
if (symbol < 256) {
+ if (symbol < 0) {
+ throw new CompressorException("Invalid Deflate64
literal/length code %,d", symbol);
+ }
b[off + result++] = memory.add((byte) symbol);
} else if (symbol > 256) {
+ if (symbol - 257 >= RUN_LENGTH_TABLE.length) {
+ throw new CompressorException("Invalid Deflate64
literal/length code %,d", symbol);
+ }
final int runMask = RUN_LENGTH_TABLE[symbol - 257];
int run = runMask >>> 5;
final int runXtra = runMask & 0x1F;
run = ExactMath.add(run, readBits(runXtra));
final int distSym = nextSymbol(reader, distanceTree);
+ if (distSym < 0 || distSym >= DISTANCE_TABLE.length) {
+ throw new CompressorException("Invalid Deflate64
distance code %,d", distSym);
+ }
Review Comment:
Added testDecodeDynamicHuffmanBlockRejectsInvalidDistanceCode for this. The
fixed distance tree defines all 32 symbols, so the only reachable invalid value
here is -1 from an incomplete dynamic distance tree. The test builds a dynamic
block whose distance tree has a single 1-bit code and then emits the undefined
branch after a length symbol; without the check that indexes DISTANCE_TABLE[-1]
and throws ArrayIndexOutOfBoundsException (verified against the unpatched
code). It asserts the CompressorException message reports the -1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
