kali834x commented on PR #790: URL: https://github.com/apache/commons-compress/pull/790#issuecomment-5143666139
Went through CpioArchiveEntry to see what is actually reachable from the three header readers. From archive input it's setMode (any of the seven undefined S_IFMT values, in all three formats) and setSize (the two ASCII formats can parse a negative size via a `-` in the field, and the `getSize() < 0` checks sit after the setter so they never fire). The UOE sites are all checkNewFormat/checkOldFormat guards, and each reader only calls the setters matching the format it constructs, so those can't trigger from input. So agreed, a one-off wasn't the right shape. I dropped the helper and moved the conversion into getNextCPIOEntry instead: a single catch that rethrows IllegalArgumentException from header parsing as ArchiveException with the cause kept, same as ArArchiveInputStream.getNextEntry already does. That covers every setter the readers call, now and in the future, and added a regression test for the negative size case. I do think it's worth addressing since getNextEntry only declares IOException, and byte-mutating the bundled cpio test files reaches the setMode IAE readily. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
