[commons-compress] branch master updated: COMPRESS-531 it is an error if a PAX header is not followed by an entry

[bo...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

bodewig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new e4eccde  COMPRESS-531 it is an error if a PAX header is not followed by an entry
e4eccde is described below

commit e4eccde3c67483a22523be8a90d188e5416de921
Author: Stefan Bodewig <bo...@apache.org>
AuthorDate: Sun May 31 13:36:55 2020 +0200

    COMPRESS-531 it is an error if a PAX header is not followed by an entry
---
 src/changes/changes.xml                                               | 4 ++++
 .../apache/commons/compress/archivers/tar/TarArchiveInputStream.java  | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 6eb4141..22da036 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -99,6 +99,10 @@ The <action> type attribute can be add,update,fix,remove.
       <action issue="COMPRESS-530" type="fix" date="2020-05-26">
         Throw IOException when it encounters a non-number while parsing pax header.
       </action>
+      <action issue="COMPRESS-531" type="fix" date="2020-05-31">
+        Throw IOException when a a tar archive contains a PAX header
+        without any normal entry follwoing it.
+      </action>
     </release>
     <release version="1.20" date="2020-02-08"
              description="Release 1.20">
diff --git a/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveInputStream.java b/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveInputStream.java
index 5a9874a..c112ac7 100644
--- a/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveInputStream.java
+++ b/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveInputStream.java
@@ -565,6 +565,9 @@ public class TarArchiveInputStream extends ArchiveInputStream {
             sparseHeaders = parsePAX01SparseHeaders(headers.get("GNU.sparse.map"));
         }
         getNextEntry(); // Get the actual file entry
+        if (currEntry == null) {
+            throw new IOException("premature end of tar archive. Didn't find any entry after PAX header.");
+        }
         applyPaxHeadersToCurrentEntry(headers, sparseHeaders);
 
         // for 1.0 PAX Format, the sparse map is stored in the file data block