sanity check entry sizes in TarFile
Credit to OSS-Fuzz
@@ -667,8 +667,11 @@ public void close() throws IOException {
private int currentSparseInputStreamIndex;
- BoundedTarEntryInputStream(final TarArchiveEntry entry, final SeekableByteChannel channel) {
+ BoundedTarEntryInputStream(final TarArchiveEntry entry, final SeekableByteChannel channel) throws IOException {
super(entry.getDataOffset(), entry.getRealSize());
+ if (channel.size() - entry.getSize() < entry.getDataOffset()) {
+ throw new IOException("entry size exceeds archive size");
+ }
this.entry = entry;
this.channel = channel;
}
