Verify length is positive

airlift · Feb 13, 2024 · 2cea90a · 2cea90a
1 parent 15e68df
commit 2cea90a
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 0 deletions.
diff --git a/src/main/java/io/airlift/compress/snappy/SnappyRawDecompressor.java b/src/main/java/io/airlift/compress/snappy/SnappyRawDecompressor.java
@@ -306,6 +306,9 @@ static int[] readUncompressedLength(Object compressed, long compressedAddress, l
                 }
             }
         }
+        if (result < 0) {
+            throw new MalformedInputException(compressedAddress, "negative compressed length");
+        }
         return new int[] {result, bytesRead};
     }
 

diff --git a/src/test/java/io/airlift/compress/snappy/TestSnappy.java b/src/test/java/io/airlift/compress/snappy/TestSnappy.java
@@ -67,4 +67,14 @@ public void testInvalidLiteralLength()
         assertThatThrownBy(() -> new SnappyDecompressor().decompress(data, 0, data.length, new byte[1024], 0, 1024))
                 .isInstanceOf(MalformedInputException.class);
     }
+
+    @Test
+    public void testNegativeLength()
+    {
+        byte[] data = {(byte) 255, (byte) 255, (byte) 255, (byte) 255, 0b0000_1000};
+
+        assertThatThrownBy(() -> SnappyDecompressor.getUncompressedLength(data, 0))
+                .isInstanceOf(MalformedInputException.class)
+                .hasMessageStartingWith("negative compressed length");
+    }
 }