apache / commons-compress / 795

87%

master: 86%

Pull #91

travis-ci

Make bz2 decompressor robust to selector overflow

As explained in https://gnu.wildebeest.org/blog/mjw/2019/08/02/bzip2-and-the-cve-that-wasnt/
bz2 has historically been able to decompress wrongly formatted compressed
files, more precisely files stating more selectors that the algorithm
actually uses.
This patch replicates https://sourceware.org/ml/bzip2-devel/2019-q3/msg00007.html
and provides a test file extracted from 20191201 German Xikipedia XML dump:
https://dumps.wikimedia.org/dewiki/20191201/dewiki-20191201-pages-meta-history5.xml-p8161946p8319641.bz2
(the link will disappear soon, as new dumps are generated).

9 of 9 new or added lines in 1 file covered. (100.0%)

12073 of 13871 relevant lines covered (87.04%)

2.61 hits per line