(commons-compress) branch master updated: Reject back-reference offset larger than the window in lz77 decoder (#797)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new cebee156f Reject back-reference offset larger than the window in lz77 
decoder (#797)
cebee156f is described below

commit cebee156fe66578b5142b4176e6c408a76d65c0c
Author: KALI 834X <kali8...@gmail.com>
AuthorDate: Tue Aug 11 16:36:16 2026 +0530

    Reject back-reference offset larger than the window in lz77 decoder (#797)
---
 .../lz77support/AbstractLZ77CompressorInputStream.java        |  9 ++++++---
 .../lz77support/AbstractLZ77CompressorInputStreamTest.java    | 11 +++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git 
a/src/main/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStream.java
 
b/src/main/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStream.java
index 61b7f07f5..21c7ad0ed 100644
--- 
a/src/main/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStream.java
+++ 
b/src/main/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStream.java
@@ -271,11 +271,14 @@ private void slideBuffer() {
      *
      * @param offset The offset of the back-reference.
      * @param length The length of the back-reference.
-     * @throws IllegalArgumentException if offset not bigger than 0 or bigger 
than the number of bytes available for back-references or if length is negative.
+     * @throws IllegalArgumentException if offset not bigger than 0, bigger 
than the window size or bigger than the number of bytes available for 
back-references,
+     *                                  or if length is negative.
      */
     protected final void startBackReference(final int offset, final long 
length) {
-        if (offset <= 0 || offset > writeIndex) {
-            throw new IllegalArgumentException("offset must be bigger than 0 
but not bigger than the number of bytes available for back-references");
+        // An offset larger than windowSize can't be honored: the buffer only 
keeps windowSize bytes of history, so once the buffer is slid mid-copy the 
source
+        // index writeIndex - offset in tryToCopy would turn negative.
+        if (offset <= 0 || offset > writeIndex || offset > windowSize) {
+            throw new IllegalArgumentException("offset must be bigger than 0 
but not bigger than the window size or the number of bytes available for 
back-references");
         }
         if (length < 0) {
             throw new IllegalArgumentException("length must not be negative");
diff --git 
a/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
 
b/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
index e955cfab6..8d530e8f8 100644
--- 
a/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
+++ 
b/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
@@ -77,6 +77,17 @@ void testIfPrefillExceedsWindowSizeTheLastBytesAreUsed() 
throws IOException {
         }
     }
 
+    @Test
+    void testBackReferenceOffsetLargerThanWindowIsRejected() throws 
IOException {
+        // Grow writeIndex past the 1024 window without sliding, so an offset 
in (windowSize, writeIndex] passes the writeIndex bound but not the window.
+        final byte[] data = new byte[2000];
+        try (TestStream s = new TestStream(new ByteArrayInputStream(data))) {
+            s.literal(data.length);
+            assertEquals(data.length, s.read(new byte[data.length]));
+            assertThrows(IllegalArgumentException.class, () -> 
s.startBackReference(1500, 4));
+        }
+    }
+
     @Test
     void testPrefillCanBeUsedForBackReferences() throws IOException {
         final byte[] data = { 1, 2, 3, 4 };