add an extra sanity check
Project: http://git-wip-us.apache.org/repos/asf/commons-compress/repo Commit: http://git-wip-us.apache.org/repos/asf/commons-compress/commit/137aa57f Tree: http://git-wip-us.apache.org/repos/asf/commons-compress/tree/137aa57f Diff: http://git-wip-us.apache.org/repos/asf/commons-compress/diff/137aa57f Branch: refs/heads/master Commit: 137aa57f9291b5f390de740266042587cfede7ce Parents: 2c8892a Author: Stefan Bodewig <bode...@apache.org> Authored: Sat Jun 17 21:46:53 2017 +0200 Committer: Stefan Bodewig <bode...@apache.org> Committed: Sat Jun 17 21:46:53 2017 +0200 ---------------------------------------------------------------------- .../java/org/apache/commons/compress/archivers/tar/TarUtils.java | 4 ++++ 1 file changed, 4 insertions(+) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/commons-compress/blob/137aa57f/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java ---------------------------------------------------------------------- diff --git a/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java b/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java index 4e99a20..39ce5c1 100644 --- a/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java +++ b/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java @@ -519,6 +519,10 @@ public class TarUtils { final BigInteger val = BigInteger.valueOf(value); final byte[] b = val.toByteArray(); final int len = b.length; + if (len > length - 1) { + throw new IllegalArgumentException("Value " + value + + " is too large for " + length + " byte field."); + } final int off = offset + length - len; System.arraycopy(b, 0, buf, off, len); final byte fill = (byte) (negative ? 0xff : 0);
