bodgit / sevenzip / 37243880711

78%

push

github

fix: validate pack streams and folder indices in header (#498)

folderReader indexes the pack sizes, its input and output streams
using values taken straight from the header, so a crafted header could
panic NewReader (when decoding an encoded header) or File.Open:

* unpack info with no pack info (nil pointer dereference)
* pack info without sizes, or fewer pack streams than the folders
  need (index out of range)
* a bind pair output index beyond the folder's outputs (index out of
  range)
* a packed stream index beyond the folder's inputs (index out of
  range)

A bind pair input index beyond the folder's inputs also left too many
inputs unbound, misreading the pack sizes.

Validate bind pairs and packed streams in readFolder, and require the
number of pack streams with sizes to exactly match the packed streams
across all folders in readStreamsInfo, as 7-Zip does. Both the main
and encoded headers are therefore covered before any folder is read.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

26 of 26 new or added lines in 1 file covered. (100.0%)

1929 of 2539 relevant lines covered (75.97%)

0.86 hits per line