{"record":{"id":"047a9f2c19c6f9f1","repo":"can1357/oh-my-pi","slug":"invalid-xz-stream-header-crc32-mismatch","errorCode":null,"errorMessage":"Invalid XZ stream: header CRC32 mismatch","messagePattern":"Invalid XZ stream: header CRC32 mismatch","errorType":"exception","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/codecs/xz.ts","lineNumber":145,"sourceCode":"\t\tcheckSize(checkId);\n\t\tconst indexSize = (read32LE(bytes, footerStart + 4) + 1) * 4;\n\t\tif (!Number.isSafeInteger(indexSize) || indexSize > footerStart)\n\t\t\tthrow new ArchiveError(\"Invalid XZ stream: backward index size is invalid\");\n\t\tconst indexStart = footerStart - indexSize;\n\t\tconst records = parseIndex(bytes, indexStart, indexSize);\n\t\tlet blocksSize = 0;\n\t\tfor (const record of records) {\n\t\t\tblocksSize += Math.ceil(record.unpaddedSize / 4) * 4;\n\t\t\tif (!Number.isSafeInteger(blocksSize)) throw new ArchiveError(\"XZ stream uses sizes too large to read safely\");\n\t\t}\n\t\tconst start = indexStart - blocksSize - 12;\n\t\tif (start < 0 || start + 12 > bytes.byteLength || !equalBytes(bytes.subarray(start, start + 6), XZ_MAGIC)) {\n\t\t\tthrow new ArchiveError(\"Invalid XZ stream: header position or magic is invalid\");\n\t\t}\n\t\tif (bytes[start + 6] !== flag0 || bytes[start + 7] !== flag1)\n\t\t\tthrow new ArchiveError(\"Invalid XZ stream: header and footer flags differ\");\n\t\tif (crc32(bytes.subarray(start + 6, start + 8)) !== read32LE(bytes, start + 8))\n\t\t\tthrow new ArchiveError(\"Invalid XZ stream: header CRC32 mismatch\");\n\t\tstreams.unshift({ start, indexStart, footerStart, checkId, records });\n\t\tend = start;\n\t\tvoid padding;\n\t}\n\treturn streams;\n}\n\ninterface XzFilter {\n\tid: number;\n\tproperties: Uint8Array;\n}\n\nfunction deltaDecode(bytes: Uint8Array, distance: number): void {\n\tconst history = new Uint8Array(256);\n\tlet position = 0;\n\tfor (let index = 0; index < bytes.byteLength; index++) {\n\t\tconst value = (bytes[index]! + history[(distance + position) & 0xff]!) & 0xff;\n\t\thistory[position] = value;","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/codecs/xz.ts#L127-L163","documentation":"The XZ stream header ends with a CRC32 of its two flag bytes. discoverStreams() recomputes the CRC over header bytes start+6..start+8 and compares it to the stored value; a mismatch means the header was altered or corrupted after encoding, so the library refuses to register the stream.","triggerScenarios":"Corruption or tampering within the 12-byte stream header (magic, flags, or CRC field), a splice that pairs a header from one file with a body from another while flags coincidentally match, or a fuzzed archive.","commonSituations":"Damaged downloads/storage, files modified by tools that rewrite header bytes without fixing CRC, or maliciously crafted inputs.","solutions":["Verify the file with xz -t / checksum and re-download or restore from backup","Re-compress from original data to regenerate a valid header","Avoid post-compression byte edits; change encoder settings and re-encode instead","If inputs are untrusted, validate archives in a sandbox before processing"],"exampleFix":"// before\nbytes[8] = 0x42; // header edit without CRC fix\nawait xzDecode(bytes);\n// after\n// regenerate: $ xz -c --check=crc64 in > fixed.xz\nconst bytes = new Uint8Array(await Bun.file(\"fixed.xz\").arrayBuffer());\nawait xzDecode(bytes);","handlingStrategy":"try-catch","validationCode":"null","typeGuard":"null","tryCatchPattern":"try {\n  await xzDecode(bytes);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes(\"header CRC32 mismatch\")) {\n    throw new Error(\"XZ stream header corrupted — restore or re-compress the archive\");\n  }\n  throw err;\n}","preventionTips":["Verify checksums after transfer","Avoid post-compression byte edits","Re-encode with xz rather than patching headers"],"tags":["xz","archive","checksum","corrupt-input"],"backgroundTag":"checksum-mismatch","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}