sanity check for link length in AsiExtraField

Credit to OSS-Fuzz
apache · Jun 30, 2021 · ef5d70b · ef5d70b
1 parent 7ce1b07
commit ef5d70b
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/src/main/java/org/apache/commons/compress/archivers/zip/AsiExtraField.java b/src/main/java/org/apache/commons/compress/archivers/zip/AsiExtraField.java
@@ -289,17 +289,17 @@ public void parseFromLocalFileData(final byte[] data, final int offset, final in
 
         final int newMode = ZipShort.getValue(tmp, 0);
         // CheckStyle:MagicNumber OFF
-        final byte[] linkArray = new byte[(int) ZipLong.getValue(tmp, 2)];
-        final int linkArrayLength = linkArray.length;
+        final int linkArrayLength = (int) ZipLong.getValue(tmp, 2);
+        if (linkArrayLength < 0 || linkArrayLength > tmp.length - 10) {
+            throw new ZipException("Bad symbolic link name length " + linkArrayLength
+                + " in ASI extra field");
+        }
         uid = ZipShort.getValue(tmp, 6);
         gid = ZipShort.getValue(tmp, 8);
-
         if (linkArrayLength == 0) {
             link = "";
-        } else if (linkArrayLength > tmp.length - 10) {
-            throw new ZipException("Bad symbolic link name length " + linkArrayLength
-                + " in ASI extra field");
         } else {
+            final byte[] linkArray = new byte[linkArrayLength];
             System.arraycopy(tmp, 10, linkArray, 0, linkArrayLength);
             link = new String(linkArray); // Uses default charset - see class Javadoc
         }