kali834x opened a new pull request, #800: URL: https://github.com/apache/commons-compress/pull/800
cpbands.parseCpUtf8 rebuilds each constant pool utf8 string as the first prefix[i-2] characters of the previous string followed by a suffix. the prefix band is decoded with the signed delta5 codec but its value is passed straight into lastString.substring(0, prefix[i-2]) with no range check, so a crafted pack200 archive whose cpUTF8Prefix band decodes larger than the previous string, or negative, makes substring throw a raw StringIndexOutOfBoundsException out of read, which only declares Pack200Exception and IOException. validate the prefix against 0..lastString.length() before both substring sites and reject a bad one with Pack200Exception, matching the guard the reference bands already have. regression test added in CpBandsTest. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
