[COMPRESS-490] [lz4] Multiple unchecked exceptions when decompressing malformed input

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.18
• Fix Version/s: 1.19
• Component/s: Compressors
• Labels: lz4

Environment

MacOS Mojave

openjdk version "1.8.0_212"
OpenJDK Runtime Environment (AdoptOpenJDK)(build 1.8.0_212-b03)
OpenJDK 64-Bit Server VM (AdoptOpenJDK)(build 25.212-b03, mixed mode)

• Assignee: Unassigned
• Reporter: Alex Rebert
• Created: 24/Jul/19 14:20
• Updated: 09/Aug/19 15:42
• Resolved: 08/Aug/19 16:33

Description

Encountered multiple unchecked exceptions thrown from FramedLZ4CompressorInputStream.read when parsing malformed files.

ArrayIndexOutOfBoundsException and ArithmeticException are unchecked exceptions that are not documented in this API; therefore, such exceptions can cause stability issues in applications that are not expecting them. Instead, an IOException should be thrown indicating that the input stream contains malformed data.

Stack traces for three distinct (but possibly related) sources of exceptions follow:

java.lang.ArithmeticException: / by zero
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.tryToCopy(AbstractLZ77CompressorInputStream.java:314)
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.readBackReference(AbstractLZ77CompressorInputStream.java:291)
        at org.apache.commons.compress.compressors.lz4.BlockLZ4CompressorInputStream.read(BlockLZ4CompressorInputStream.java:83)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.readOnce(FramedLZ4CompressorInputStream.java:328)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.read(FramedLZ4CompressorInputStream.java:145)
        at java.io.InputStream.read(InputStream.java:101)

java.lang.ArrayIndexOutOfBoundsException
        at java.lang.System.arraycopy(Native Method)
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.tryToCopy(AbstractLZ77CompressorInputStream.java:308)
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.readBackReference(AbstractLZ77CompressorInputStream.java:291)
        at org.apache.commons.compress.compressors.lz4.BlockLZ4CompressorInputStream.read(BlockLZ4CompressorInputStream.java:83)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.readOnce(FramedLZ4CompressorInputStream.java:328)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.read(FramedLZ4CompressorInputStream.java:145)
        at java.io.InputStream.read(InputStream.java:101)

java.lang.ArrayIndexOutOfBoundsException: -1
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.tryToCopy(AbstractLZ77CompressorInputStream.java:304)
        at org.apache.commons.compress.compressors.lz77support.AbstractLZ77CompressorInputStream.readBackReference(AbstractLZ77CompressorInputStream.java:291)
        at org.apache.commons.compress.compressors.lz4.BlockLZ4CompressorInputStream.read(BlockLZ4CompressorInputStream.java:83)
        at org.apache.commons.compress.compressors.lz4.BlockLZ4CompressorInputStream.read(BlockLZ4CompressorInputStream.java:75)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.readOnce(FramedLZ4CompressorInputStream.java:328)
        at org.apache.commons.compress.compressors.lz4.FramedLZ4CompressorInputStream.read(FramedLZ4CompressorInputStream.java:145)
        at java.io.InputStream.read(InputStream.java:101)

The inputs were automatically generated by fuzzing, by repeatedly mutating random bytes in a well-formed file.