svn commit: r1619657 - /commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java

[bo...@apache.org]

Author: bodewig
Date: Fri Aug 22 03:54:38 2014
New Revision: 1619657

URL: http://svn.apache.org/r1619657
Log:
deal with some potential int overflows

Modified:
    commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java

Modified: commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java
URL: http://svn.apache.org/viewvc/commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java?rev=1619657&r1=1619656&r2=1619657&view=diff
==============================================================================
--- commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java (original)
+++ commons/proper/compress/trunk/src/main/java/org/apache/commons/compress/compressors/gzip/GzipCompressorInputStream.java Fri Aug 22 03:54:38 2014
@@ -74,7 +74,7 @@ public class GzipCompressorInputStream e
     // CRC32 from uncompressed data
     private final CRC32 crc = new CRC32();
 
-    private int memberSize;
+    private long memberSize;
 
     // True once everything has been decompressed
     private boolean endReached = false;
@@ -245,11 +245,11 @@ public class GzipCompressorInputStream e
         return bos.toByteArray();
     }
 
-    private int readLittleEndianInt(DataInputStream inData) throws IOException {
+    private long readLittleEndianInt(DataInputStream inData) throws IOException {
         return inData.readUnsignedByte()
             | (inData.readUnsignedByte() << 8)
             | (inData.readUnsignedByte() << 16)
-            | (inData.readUnsignedByte() << 24);
+            | (((long) inData.readUnsignedByte()) << 24);
     }
 
     @Override
@@ -316,10 +316,7 @@ public class GzipCompressorInputStream e
                 DataInputStream inData = new DataInputStream(in);
 
                 // CRC32
-                long crcStored = 0;
-                for (int i = 0; i < 4; ++i) {
-                    crcStored |= (long)inData.readUnsignedByte() << (i * 8);
-                }
+                long crcStored = readLittleEndianInt(inData);
 
                 if (crcStored != crc.getValue()) {
                     throw new IOException("Gzip-compressed data is corrupt "
@@ -327,12 +324,9 @@ public class GzipCompressorInputStream e
                 }
 
                 // Uncompressed size modulo 2^32 (ISIZE in the spec)
-                int isize = 0;
-                for (int i = 0; i < 4; ++i) {
-                    isize |= inData.readUnsignedByte() << (i * 8);
-                }
+                long isize = readLittleEndianInt(inData);
 
-                if (isize != memberSize) {
+                if (isize != (memberSize & 0xffffffffl)) {
                     throw new IOException("Gzip-compressed data is corrupt"
                                           + "(uncompressed size mismatch)");
                 }