[COMPRESS-530] Tar decompression fails with NegativeArraySizeException

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.21
• Assignee: Unassigned
• Reporter: Maksim Zuev
• Created: 25/May/20 08:46
• Updated: 31/May/20 11:14
• Resolved: 31/May/20 11:14

Description

This Kotlin code fails with exception(NegativeArraySizeException.tar is in the attachment)

Exception in thread "main" java.lang.NegativeArraySizeException: -5332783
at org.apache.commons.compress.archivers.tar.TarArchiveInputStream.parsePaxHeaders(TarArchiveInputStream.java:703)
at org.apache.commons.compress.archivers.tar.TarArchiveInputStream.paxHeaders(TarArchiveInputStream.java:555)
at org.apache.commons.compress.archivers.tar.TarArchiveInputStream.getNextTarEntry(TarArchiveInputStream.java:404)
at org.apache.commons.compress.archivers.tar.TarArchiveInputStream.getNextEntry(TarArchiveInputStream.java:799)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt:31)
at ru.example.kotlinfuzzer.tests.MainKt.main(main.kt)

import org.apache.commons.compress.archivers.ArchiveStreamFactory
import java.io.File

fun main() {
    val tar = File("NegativeArraySizeException.tar")
    ArchiveStreamFactory().createArchiveInputStream("tar", tar.inputStream()).use { ais ->
        ais.nextEntry
        ais.readAllBytes()
    }
}

IOException expected