overlooked a RuntimeException in BoundedArchiveInputStream
unfortunately I cannot change the signature of
BoundedArchiveInputStream's constructor as the way it is used in
ZipFile doesn't allow it to throw an IOException without breaking
backwards compatibility of ZipFile#getRawInputStream
@@ -359,6 +359,10 @@ private void buildSparseInputStreams() throws IOException {
if (sparseHeader.getNumbytes() > 0) {
final long start =
currEntry.getDataOffset() + sparseHeader.getOffset() - numberOfZeroBytesInSparseEntry;
+ if (start + sparseHeader.getNumbytes() < start) {
+ // possible integer overflow
+ throw new IOException("Unreadable TAR archive, sparse block offset or length too big");
+ }
streams.add(new BoundedSeekableByteChannelInputStream(start, sparseHeader.getNumbytes(), archive));
}
