kali834x opened a new pull request, #802: URL: https://github.com/apache/commons-compress/pull/802
The gzip reader parses the FNAME and FCOMMENT header fields by decoding their raw bytes with the configured file-name charset and handing the result to GzipParameters.setFileName/setComment. Those setters re-encode the string and reject a NUL byte with an IllegalArgumentException, a guard aimed at the write path. When a caller selects a non-default multibyte charset through Builder.setFileNameCharset (UTF-32BE for example), decoding a malformed field yields a replacement character that re-encodes with a NUL byte, so a crafted member makes the reader throw IllegalArgumentException out of the constructor and out of read(), both of which only declare IOException. I hit it while feeding a fuzzed member through a non-Latin-1 charset. This lines up with the recent work moving these readers to CompressorException, so I catch the IllegalArgumentException at the two parse sites and rethrow it there. I kept the change in the reader so the public GzipParameters setters stay as they are. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
