Copilot commented on code in PR #801:
URL: https://github.com/apache/commons-compress/pull/801#discussion_r3762211398
##########
src/main/java/org/apache/commons/compress/compressors/snappy/SnappyCompressorInputStream.java:
##########
@@ -244,7 +244,11 @@ private int readLiteralLength(final int b) throws
IOException {
length = (int) ByteUtils.fromLittleEndian(supplier, 3);
break;
case 63:
- length = (int) ByteUtils.fromLittleEndian(supplier, 4);
+ final long fourByteLength = ByteUtils.fromLittleEndian(supplier,
4);
+ if (fourByteLength + 1 > Integer.MAX_VALUE) {
+ throw new CompressorException("Illegal literal length %,d in
Snappy stream", fourByteLength);
+ }
Review Comment:
The exception message reports the stored (len-1) value (`fourByteLength`),
but the "literal length" used by the decoder is `fourByteLength + 1`. For the
problematic 0xFFFFFFFF case this prints 4,294,967,295 even though the actual
literal length would be 4,294,967,296, which is misleading when diagnosing
malformed input.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
