(commons-compress) 08/14: Add a band set parameter check

[gg...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

ggregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git

commit 25a54419d9715a77577e4a31e8303e20fbe34506
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Sat Feb 17 10:54:15 2024 -0500

    Add a band set parameter check
---
 .../java/org/apache/commons/compress/harmony/unpack200/BandSet.java  | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java b/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
index b9eb7389d..67a6b5a3e 100644
--- a/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
+++ b/src/main/java/org/apache/commons/compress/harmony/unpack200/BandSet.java
@@ -64,7 +64,9 @@ public abstract class BandSet {
      * @throws Pack200Exception if there is a problem decoding the value or that the value is invalid
      */
     public int[] decodeBandInt(final String name, final InputStream in, final BHSDCodec codec, final int count) throws IOException, Pack200Exception {
-        int[] band;
+        if (count < 0) {
+            throw new Pack200Exception("count < 0");
+        }
         // Useful for debugging
 //        if (count > 0) {
 //            System.out.println("decoding " + name + " " + count);
@@ -78,6 +80,7 @@ public abstract class BandSet {
             return getFirst;
         }
         final int first = getFirst[0];
+        int[] band;
         if (codec.isSigned() && first >= -256 && first <= -1) {
             // Non-default codec should be used
             codecUsed = CodecEncoding.getCodec(-1 - first, header.getBandHeadersInputStream(), codec);