You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by gg...@apache.org on 2026/07/13 17:19:06 UTC
(commons-compress) branch master updated (3c50b8226 -> fc9ae9fb6)
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git
from 3c50b8226 Reject short LZMA properties and oversized dictionary in LZMADecoder (#784)
new 5834d77d0 Reject short LZMA properties and oversized dictionary in LZMADecoder (#784).
new fc9ae9fb6 Refactor magic numbers.
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
src/changes/changes.xml | 1 +
.../apache/commons/compress/archivers/sevenz/LZMADecoder.java | 10 +++++++---
2 files changed, 8 insertions(+), 3 deletions(-)
(commons-compress) 02/02: Refactor magic numbers.
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git
commit fc9ae9fb6482fba9bbef923aaf6e578f170ae26a
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Mon Jul 13 13:19:01 2026 -0400
Refactor magic numbers.
---
.../apache/commons/compress/archivers/sevenz/LZMADecoder.java | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java b/src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java
index d56cc5176..6c00f931e 100644
--- a/src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java
+++ b/src/main/java/org/apache/commons/compress/archivers/sevenz/LZMADecoder.java
@@ -32,6 +32,10 @@
final class LZMADecoder extends AbstractCoder {
+ private static final int LZMA_DICT_IDX = 1;
+ private static final int LZMA_DICT_LEN = 4;
+ private static final int LZMA_PROP_LEN = LZMA_DICT_IDX + LZMA_DICT_LEN;
+
LZMADecoder() {
super(LZMA2Options.class, Number.class);
}
@@ -61,10 +65,10 @@ OutputStream encode(final OutputStream out, final Object opts) throws IOExceptio
}
private int getDictionarySize(final Coder coder) throws ArchiveException {
- if (coder.properties.length < 5) {
- throw new ArchiveException("LZMA properties too short (expected 5 bytes)");
+ if (coder.properties.length < LZMA_DICT_LEN + LZMA_DICT_IDX) {
+ throw new ArchiveException("LZMA properties too short (expected " + LZMA_PROP_LEN + " bytes)");
}
- final long dictionarySize = ByteUtils.fromLittleEndian(coder.properties, 1, 4);
+ final long dictionarySize = ByteUtils.fromLittleEndian(coder.properties, LZMA_DICT_IDX, LZMA_DICT_LEN);
if (dictionarySize > LZMAInputStream.DICT_SIZE_MAX) {
throw new ArchiveException("Dictionary larger than 4 GiB maximum size");
}
(commons-compress) 01/02: Reject short LZMA properties and oversized dictionary in LZMADecoder (#784).
Posted by gg...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git
commit 5834d77d030780f6f0194b01133d4b8b9a94f1ae
Author: Gary Gregory <ga...@gmail.com>
AuthorDate: Mon Jul 13 13:09:47 2026 -0400
Reject short LZMA properties and oversized dictionary in LZMADecoder
(#784).
---
src/changes/changes.xml | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index 0f5059307..591bcd70c 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -59,6 +59,7 @@ The <action> type attribute can be add,update,fix,remove.
<action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">SevenZFile now enforces the same folder and coder limits as the CPP implementation.</action>
<action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">Refactor unsigned number parsing and header validation in SevenZFile.</action>
<action type="fix" dev="ggregory" due-to="Gary Gregory">Fix Apache RAT plugin console warnings.</action>
+ <action type="fix" dev="ggregory" due-to="KALI 834X, Gary Gregory">Reject short LZMA properties and oversized dictionary in LZMADecoder (#784).</action>
<!-- FIX bzip2 -->
<action type="fix" dev="ggregory" due-to="Tyler Nighswander, Gary Gregory">BZip2CompressorInputStream now throw CompressorException (a subclass of IOException) for invalid or corrupted data, providing more specific error reporting.</action>
<action type="fix" dev="pkarwasz" due-to="Tyler Nighswander, Piotr P. Karwasz">BZip2 input streams treat Huffman codes longer than 20 bits as corrupted data, matching the behavior of the reference implementation.</action>