(commons-compress) branch master updated: Reject missing main header in ArjArchiveInputStream.readMainHeader (#793)

[gg...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new c9f8c4221 Reject missing main header in ArjArchiveInputStream.readMainHeader (#793)
c9f8c4221 is described below

commit c9f8c422142a5f26a49c52ba90ac1d4a518b3609
Author: KALI 834X <ka...@gmail.com>
AuthorDate: Tue Aug 4 17:49:06 2026 +0530

    Reject missing main header in ArjArchiveInputStream.readMainHeader (#793)
    
    readHeader returns null for the zero-length basic header that marks the end of an arj archive. readLocalFileHeader already tests for it, but readMainHeader passed it straight to ByteArrayInputStream, so an archive starting with the terminator threw NullPointerException instead of ArchiveException.
---
 .../compress/archivers/arj/ArjArchiveInputStream.java        |  3 +++
 .../compress/archivers/arj/ArjArchiveInputStreamTest.java    | 12 ++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java b/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
index cc5d886d0..6c6849f2f 100644
--- a/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
+++ b/src/main/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStream.java
@@ -416,6 +416,9 @@ private LocalFileHeader readLocalFileHeader() throws IOException {
 
     private MainHeader readMainHeader(final boolean selfExtracting) throws IOException {
         final byte[] basicHeaderBytes = selfExtracting ? findMainHeader() : readHeader();
+        if (basicHeaderBytes == null) {
+            throw new ArchiveException("Corrupted ARJ archive: Missing main header");
+        }
         final MainHeader header = new MainHeader();
         try (InputStream basicHeader = new ByteArrayInputStream(basicHeaderBytes)) {
             final int firstHeaderSize = readUnsignedByte(basicHeader);
diff --git a/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java b/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
index b021d3de2..73ba8ff99 100644
--- a/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
+++ b/src/test/java/org/apache/commons/compress/archivers/arj/ArjArchiveInputStreamTest.java
@@ -180,6 +180,18 @@ void testGetNextEntry() throws Exception {
         assertEquals(expected.toString(), result.toString());
     }
 
+    /**
+     * A basic header size of zero is the end-of-archive marker, so an archive starting with one carries no main header.
+     *
+     * @param selfExtracting whether to scan for the main header.
+     */
+    @ParameterizedTest
+    @ValueSource(booleans = { false, true })
+    void testMissingMainHeader(final boolean selfExtracting) {
+        final byte[] bytes = { 0x60, (byte) 0xEA, 0x00, 0x00 };
+        assertThrows(ArchiveException.class, () -> ArjArchiveInputStream.builder().setByteArray(bytes).setSelfExtracting(selfExtracting).get());
+    }
+
     @Test
     void testMultiByteReadConsistentlyReturnsMinusOneAtEof() throws Exception {
         final byte[] buf = new byte[2];