[PR] reject out-of-range cpUTF8Prefix in CpBands.parseCpUtf8 [commons-compress]

["kali834x (via GitHub)" <gi...@apache.org>]

kali834x opened a new pull request, #800:
URL: https://github.com/apache/commons-compress/pull/800

   cpbands.parseCpUtf8 rebuilds each constant pool utf8 string as the first prefix[i-2] characters of the previous string followed by a suffix. the prefix band is decoded with the signed delta5 codec but its value is passed straight into lastString.substring(0, prefix[i-2]) with no range check, so a crafted pack200 archive whose cpUTF8Prefix band decodes larger than the previous string, or negative, makes substring throw a raw StringIndexOutOfBoundsException out of read, which only declares Pack200Exception and IOException. validate the prefix against 0..lastString.length() before both substring sites and reject a bad one with Pack200Exception, matching the guard the reference bands already have. regression test added in CpBandsTest.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Reject out-of-range cpUTF8Prefix in CpBands.parseCpUtf8 [commons-compress]

["garydgregory (via GitHub)" <gi...@apache.org>]

garydgregory merged PR #800:
URL: https://github.com/apache/commons-compress/pull/800


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org