[COMPRESS-526] Decompression fails with ArrayIndexOutOfBoundsException

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.20
• Fix Version/s: 1.21
• Assignee: Unassigned
• Reporter: Maksim Zuev
• Created: 24/May/20 09:56
• Updated: 24/May/20 10:19
• Resolved: 24/May/20 10:19

Description

This Kotlin code fails with exception

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 65
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder.getCodes(HuffmanDecoder.java:479)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder.buildTree(HuffmanDecoder.java:453)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder.access$800(HuffmanDecoder.java:31)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder$HuffmanCodes.<init>(HuffmanDecoder.java:293)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder.decode(HuffmanDecoder.java:146)
at org.apache.commons.compress.compressors.deflate64.Deflate64CompressorInputStream.read(Deflate64CompressorInputStream.java:84)
at org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.read(ZipArchiveInputStream.java:493)
at java.base/java.io.InputStream.readNBytes(InputStream.java:396)
at java.base/java.io.InputStream.readAllBytes(InputStream.java:333)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt:44)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt)

import org.apache.commons.compress.archivers.ArchiveStreamFactory
import java.io.ByteArrayInputStream

fun main() {
    val bytes = listOf(
        0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x09, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6f, 0x00, 0x00, 0x00,
        0x61, 0x4a, 0x04, 0x04, 0x00, 0x00, 0xff, 0xff, 0x50, 0x53,
        0x07, 0x08, 0x43, 0xbe, 0xb7, 0xe8, 0x07, 0x00, 0x00, 0x00,
        0x01, 0x00, 0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00,
        0x08, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x01, 0x00, 0x00, 0x00, 0x62, 0x4a, 0x02, 0x04, 0x00, 0x00,
        0xff, 0xff, 0x50, 0x4b, 0x7f, 0x08, 0xf9, 0xef, 0xbe, 0x71,
        0x07, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x50, 0x4b,
        0x03, 0x04, 0x14, 0x00, 0x08, 0x00, 0x08, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
        0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x63, 0x4a,
        0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0x50, 0x4b, 0x07, 0x08,
        0x01, 0xdf, 0xb9, 0x06, 0x07, 0x00, 0x00, 0x00, 0x01, 0x00,
        0x00, 0x00, 0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x08, 0x00,
        0x08
    ).map { it.toByte() }.toByteArray()
    val input = ByteArrayInputStream(bytes)
    ArchiveStreamFactory().createArchiveInputStream("zip", input).use { ais ->
        ais.nextEntry
        ais.readAllBytes()
    }
}

This Kotlin code fails with exception

Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index -1 out of bounds for length 32
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder$HuffmanCodes.decodeNext(HuffmanDecoder.java:328)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder$HuffmanCodes.read(HuffmanDecoder.java:307)
at org.apache.commons.compress.compressors.deflate64.HuffmanDecoder.decode(HuffmanDecoder.java:152)
at org.apache.commons.compress.compressors.deflate64.Deflate64CompressorInputStream.read(Deflate64CompressorInputStream.java:84)
at org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.read(ZipArchiveInputStream.java:493)
at java.base/java.io.InputStream.readNBytes(InputStream.java:396)
at java.base/java.io.InputStream.readAllBytes(InputStream.java:333)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt:35)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt)

import org.apache.commons.compress.archivers.ArchiveStreamFactory
import java.io.ByteArrayInputStream

fun main() {
    val bytes = listOf(
        0x50, 0x4b, 0x03, 0x04, 0x14, 0x00, 0x00, 0x00, 0x09, 0x00,
        0x84, 0xb6, 0xba, 0x46, 0x72, 0xb6, 0xfe, 0x77, 0x4a, 0x00,
        0x00, 0x00, 0x6b, 0x00, 0x00, 0x00, 0x03, 0x00, 0x1c, 0x00,
        0x62, 0x62, 0x62, 0x55, 0x54, 0x09, 0x00, 0x03, 0xe7, 0xce,
        0x64, 0x55, 0xf3, 0xce, 0x64, 0x55, 0x75, 0x78, 0x0b, 0x00,
        0x01, 0x04, 0x5c, 0xf9, 0x01, 0x00, 0x04, 0x88, 0x13, 0x00,
        0x00, 0x1d, 0x8b, 0xc1, 0x0d, 0xc0, 0x30, 0x08, 0x03, 0xff,
        0x99, 0xc2, 0xab, 0x81, 0x50, 0x1a, 0xa8, 0x44, 0x1e, 0x56,
        0x33, 0x7f, 0x21, 0x1f, 0x5b, 0x3e, 0x9d, 0x86, 0x6e, 0xeb,
        0x13
    ).map { it.toByte() }.toByteArray()
    val input = ByteArrayInputStream(bytes)
    ArchiveStreamFactory().createArchiveInputStream("zip", input).use { ais ->
        ais.nextEntry
        ais.readAllBytes()
    }
}

IOException expected

Issue Links

• relates to: COMPRESS-516 Decompression fails with ArrayIndexOutOfBoundsException