do not read past end of extra fields when reading extra field

Author: Erik Hetzner

src/main/java/org/archive/format/gzip/GZIPFExtraRecord.java

@@ -98,12 +98,17 @@ public void writeTo(OutputStream os) throws IOException {
 			os.write(value);
 		}
 	}
-	public int read(InputStream is) throws IOException {
+	public int read(InputStream is, int maxRead) throws IOException {
 		byte tmpName[] = null;
 		byte tmpVal[] = null;
 		int valLen = 0;
 		tmpName = ByteOp.readNBytes(is, GZIP_FEXTRA_NAME_BYTES);
 		valLen = ByteOp.readShort(is);
+		if (valLen > (maxRead - BYTES_IN_SHORT - GZIP_FEXTRA_NAME_BYTES)) {
+			/* read in what's left, but throw an exception */
+			tmpVal = ByteOp.readNBytes(is, maxRead - BYTES_IN_SHORT - GZIP_FEXTRA_NAME_BYTES);
+			throw new GZIPFormatException.GZIPExtraFieldShortException(maxRead);
+		}
 		if(valLen > 0) {
 			tmpVal = ByteOp.readNBytes(is, valLen);
 		}

src/main/java/org/archive/format/gzip/GZIPFExtraRecords.java

@@ -53,12 +53,17 @@ public void readRecords(InputStream is)
 		ArrayList<GZIPFExtraRecord> tmpList = new ArrayList<GZIPFExtraRecord>();
 		while(bytesRemaining > 0) {
 			GZIPFExtraRecord tmpRecord = new GZIPFExtraRecord();
-			int bytesRead = tmpRecord.read(is);
-			bytesRemaining -= bytesRead;
+			try {
+				int bytesRead = tmpRecord.read(is, bytesRemaining);
+				bytesRemaining -= bytesRead;
+				tmpList.add(tmpRecord);
+			} catch (GZIPFormatException.GZIPExtraFieldShortException ex) {
+				/* not enough bytes for the extra field; move on */
+				bytesRemaining -= ex.bytesRead;
+			}
 			if(bytesRemaining < 0) {
 				throw new GZIPFormatException("Invalid FExtra length/records");
 			}
-			tmpList.add(tmpRecord);
 		}
 		this.addAll(tmpList);
 	}

src/main/java/org/archive/format/gzip/GZIPFormatException.java

@@ -21,4 +21,11 @@ public GZIPFormatException(Exception e) {
 	public GZIPFormatException(String message, IOException e) {
 		super(message,e);
 	}
+	public static class GZIPExtraFieldShortException extends GZIPFormatException {
+		int bytesRead;
+		public GZIPExtraFieldShortException(int bytesRead) {
+			super("Extra Field short.");
+			this.bytesRead = bytesRead;
+		}
+	}
 }

src/test/java/org/archive/format/gzip/GZIPMemberSeriesTest.java

@@ -374,6 +374,9 @@ public void testAutoSkip() throws IOException {
 		assertNull(m);
 		assertTrue(s.gotEOF());
 	}
-	
 
+	public void testWgetProblem() throws IndexOutOfBoundsException, FileNotFoundException, IOException {
+		InputStream is = getClass().getResourceAsStream("IAH-urls-wget.warc.gz");
+		new GZIPDecoder().parseHeader(is);
+	}
 }