(commons-compress) branch master updated: Reject back-reference offset larger than the window in lz77 decoder (#797).

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new e27bfa395 Reject back-reference offset larger than the window in lz77 
decoder (#797).
e27bfa395 is described below

commit e27bfa395799c655fb73f1cac6df466dba02a015
Author: Gary Gregory <garydgreg...@gmail.com>
AuthorDate: Tue Aug 11 07:08:38 2026 -0400

    Reject back-reference offset larger than the window in lz77 decoder
    (#797).
    
    Sort members
---
 src/changes/changes.xml                            |  2 ++
 .../AbstractLZ77CompressorInputStreamTest.java     | 22 +++++++++++-----------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/src/changes/changes.xml b/src/changes/changes.xml
index b7ff34a8f..b68cd0de8 100644
--- a/src/changes/changes.xml
+++ b/src/changes/changes.xml
@@ -145,6 +145,8 @@ The <action> type attribute can be add,update,fix,remove.
       <action type="fix" dev="ggregory" due-to="Stanislav Fort, Gary 
Gregory">Fix for when a valid raw Snappy stream with uncompressed size > 2 GiB 
used to decompress and then fail at physical EOF with a “Premature end of 
stream” exception instead of completing cleanly.</action>
       <!-- FIX deflate64 -->
       <action type="fix" dev="ggregory" due-to="KALI 834X, Gary 
Gregory">Reject invalid literal/length and distance codes in Deflate64 decoder 
(#785).</action>
+      <!-- FIX lz77 -->
+      <action type="fix" dev="ggregory" due-to="KALI 834X, Gary 
Gregory">Reject back-reference offset larger than the window in lz77 decoder 
(#797).</action>
       <!-- FIX general -->      
       <action type="fix" dev="ggregory" due-to="Piotr P. Karwasz, Gary 
Gregory">Add missing Javadoc @since tag to 
org.apache.commons.compress.compressors.lz77support.LZ77Compressor.AbstractReference.</action>
       <action type="fix" dev="ggregory" due-to="Gary Gregory">Classes in 
org.apache.commons.compress.archivers now throw a subclass of IOException 
called ArchiveException instead of IOException when a formatting problem is 
found.</action>
diff --git 
a/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
 
b/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
index 8d530e8f8..38d04ca6d 100644
--- 
a/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
+++ 
b/src/test/java/org/apache/commons/compress/compressors/lz77support/AbstractLZ77CompressorInputStreamTest.java
@@ -53,6 +53,17 @@ public int read(final byte[] b, final int off, final int 
len) throws IOException
         }
     }
 
+    @Test
+    void testBackReferenceOffsetLargerThanWindowIsRejected() throws 
IOException {
+        // Grow writeIndex past the 1024 window without sliding, so an offset 
in (windowSize, writeIndex] passes the writeIndex bound but not the window.
+        final byte[] data = new byte[2000];
+        try (TestStream s = new TestStream(new ByteArrayInputStream(data))) {
+            s.literal(data.length);
+            assertEquals(data.length, s.read(new byte[data.length]));
+            assertThrows(IllegalArgumentException.class, () -> 
s.startBackReference(1500, 4));
+        }
+    }
+
     @Test
     void testCantPrefillAfterDataHasBeenRead() throws IOException {
         final byte[] data = { 1, 2, 3, 4 };
@@ -77,17 +88,6 @@ void testIfPrefillExceedsWindowSizeTheLastBytesAreUsed() 
throws IOException {
         }
     }
 
-    @Test
-    void testBackReferenceOffsetLargerThanWindowIsRejected() throws 
IOException {
-        // Grow writeIndex past the 1024 window without sliding, so an offset 
in (windowSize, writeIndex] passes the writeIndex bound but not the window.
-        final byte[] data = new byte[2000];
-        try (TestStream s = new TestStream(new ByteArrayInputStream(data))) {
-            s.literal(data.length);
-            assertEquals(data.length, s.read(new byte[data.length]));
-            assertThrows(IllegalArgumentException.class, () -> 
s.startBackReference(1500, 4));
-        }
-    }
-
     @Test
     void testPrefillCanBeUsedForBackReferences() throws IOException {
         final byte[] data = { 1, 2, 3, 4 };