[commons-compress] branch master updated: potential integer overflow in check

[bodewig]

This is an automated email from the ASF dual-hosted git repository.

bodewig pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-compress.git


The following commit(s) were added to refs/heads/master by this push:
     new 7ce1b07  potential integer overflow in check
7ce1b07 is described below

commit 7ce1b0796d6cbe1f41b969583bd49f33ae0efef0
Author: Stefan Bodewig <stefan.bode...@innoq.com>
AuthorDate: Wed Jun 30 22:01:22 2021 +0200

    potential integer overflow in check
---
 .../java/org/apache/commons/compress/archivers/tar/TarUtils.java     | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git 
a/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java 
b/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java
index d809125..ec12f17 100644
--- a/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java
+++ b/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java
@@ -741,13 +741,16 @@ public class TarUtils {
                     while((ch = inputStream.read()) != -1) {
                         read++;
                         totalRead++;
+                        if (totalRead < 0 || (headerSize >= 0 && totalRead >= 
headerSize)) {
+                            break;
+                        }
                         if (ch == '='){ // end of keyword
                             final String keyword = 
coll.toString(CharsetNames.UTF_8);
                             // Get rest of entry
                             final int restLen = len - read;
                             if (restLen <= 1) { // only NL
                                 headers.remove(keyword);
-                            } else if (headerSize >= 0 && totalRead + restLen 
> headerSize) {
+                            } else if (headerSize >= 0 && restLen > headerSize 
- totalRead) {
                                 throw new IOException("Paxheader value size " 
+ restLen
                                     + " exceeds size of header record");
                             } else {