[COMPRESS-548] Decompression fails with NegativeArraySizeException

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.20
• Fix Version/s: 1.21
• Assignee: Peter Lee
• Reporter: Maksim Zuev
• Created: 13/Jul/20 22:33
• Updated: 07/Oct/20 02:30
• Resolved: 07/Oct/20 02:29

Description

This Kotlin code fails with exception(NegativeArraySizeException.zip is in the attachments)

Exception in thread "main" java.lang.NegativeArraySizeException: -3

at org.apache.commons.compress.archivers.zip.AsiExtraField.parseFromLocalFileData(AsiExtraField.java:271) at org.apache.commons.compress.archivers.zip.ExtraFieldUtils.fillExtraField(ExtraFieldUtils.java:324) at org.apache.commons.compress.archivers.zip.ZipArchiveEntry$ExtraFieldParsingMode.fillAndMakeUnrecognizedOnError(ZipArchiveEntry.java:1219) at org.apache.commons.compress.archivers.zip.ZipArchiveEntry$ExtraFieldParsingMode.access$100(ZipArchiveEntry.java:1127) at org.apache.commons.compress.archivers.zip.ZipArchiveEntry$ExtraFieldParsingMode$1.fill(ZipArchiveEntry.java:1142) at org.apache.commons.compress.archivers.zip.ExtraFieldUtils.parse(ExtraFieldUtils.java:214) at org.apache.commons.compress.archivers.zip.ZipArchiveEntry.setExtra(ZipArchiveEntry.java:675) at org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.getNextZipEntry(ZipArchiveInputStream.java:341) at org.apache.commons.compress.archivers.zip.ZipArchiveInputStream.getNextEntry(ZipArchiveInputStream.java:435) at kotlinx.fuzzer.tests.apache.zip.ApacheZipTestKt.main(ApacheZipTest.kt:85) at kotlinx.fuzzer.tests.apache.zip.ApacheZipTestKt.main(ApacheZipTest.kt)

import org.apache.commons.compress.archivers.ArchiveStreamFactory
import java.io.ByteArrayInputStream
import java.io.File

fun main() {
    val bytes = File("NegativeArraySizeException.zip").readBytes()
    val input = ByteArrayInputStream(bytes)
    ArchiveStreamFactory().createArchiveInputStream("zip", input).use { ais ->
        ais.nextEntry
        ais.readAllBytes()
    }
}

Expected some other exception as IOException is the only declared.