sanity check for link length in AsiExtraField
Credit to OSS-Fuzz
@@ -289,17 +289,17 @@ public void parseFromLocalFileData(final byte[] data, final int offset, final in
final int newMode = ZipShort.getValue(tmp, 0);
// CheckStyle:MagicNumber OFF
- final byte[] linkArray = new byte[(int) ZipLong.getValue(tmp, 2)];
- final int linkArrayLength = linkArray.length;
+ final int linkArrayLength = (int) ZipLong.getValue(tmp, 2);
+ if (linkArrayLength < 0 || linkArrayLength > tmp.length - 10) {
+ throw new ZipException("Bad symbolic link name length " + linkArrayLength
+ + " in ASI extra field");
+ }
uid = ZipShort.getValue(tmp, 6);
gid = ZipShort.getValue(tmp, 8);
-
if (linkArrayLength == 0) {
link = "";
- } else if (linkArrayLength > tmp.length - 10) {
- throw new ZipException("Bad symbolic link name length " + linkArrayLength
- + " in ASI extra field");
} else {
+ final byte[] linkArray = new byte[linkArrayLength];
System.arraycopy(tmp, 10, linkArray, 0, linkArrayLength);
link = new String(linkArray); // Uses default charset - see class Javadoc
}
