kali834x opened a new pull request, #797: URL: https://github.com/apache/commons-compress/pull/797
snappy copy elements encode offsets up to 65535 but SnappyCompressorInputStream runs with a 32768-byte window, and startBackReference only rejects an offset past writeIndex, never past windowSize. such an offset is accepted while writeIndex is still near 2*windowSize, then readFromBuffer slides the buffer down by windowSize in the middle of a back-reference and the next tryToCopy uses writeIndex - offset as a negative source index, so System.arraycopy throws ArrayIndexOutOfBoundsException out of read(), which only declares IOException (crafted stream `1F...` reproduced as `arraycopy: source index -32766`). reject offset > windowSize in startBackReference so a crafted stream fails with the CompressorException that the snappy and lz4 callers already translate the IllegalArgumentException into; the window keeps at most windowSize bytes of history and lz4 offsets never exceed its 65536 window, so valid input is unaffected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
