{"record":{"id":"3c9a211098f3fd26","repo":"MuntashirAkon/AppManager","slug":"corrupted-input-name-value-too-big","errorCode":null,"errorMessage":"Corrupted input, \" + name + \" value too big","messagePattern":"Corrupted input, \" \\+ name \\+ \" value too big","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/org/apache/commons/compress/compressors/bzip2/BZip2CompressorInputStream.java","lineNumber":395,"sourceCode":"    private static boolean bsGetBit(final BitInputStream bin) throws IOException {\n        return bsR(bin, 1) != 0;\n    }\n\n    private static char bsGetUByte(final BitInputStream bin) throws IOException {\n        return (char) bsR(bin, 8);\n    }\n\n    private static int bsGetInt(final BitInputStream bin) throws IOException {\n        return bsR(bin, 32);\n    }\n\n    private static void checkBounds(final int checkVal, final int limitExclusive, final String name)\n            throws IOException {\n        if (checkVal < 0) {\n            throw new IOException(\"Corrupted input, \" + name + \" value negative\");\n        }\n        if (checkVal >= limitExclusive) {\n            throw new IOException(\"Corrupted input, \" + name + \" value too big\");\n        }\n    }\n\n    /**\n     * Called by createHuffmanDecodingTables() exclusively.\n     */\n    private static void hbCreateDecodeTables(final int[] limit,\n                                             final int[] base, final int[] perm, final char[] length,\n                                             final int minLen, final int maxLen, final int alphaSize)\n            throws IOException {\n        for (int i = minLen, pp = 0; i <= maxLen; i++) {\n            for (int j = 0; j < alphaSize; j++) {\n                if (length[j] == i) {\n                    perm[pp++] = j;\n                }\n            }\n        }\n","sourceCodeStart":377,"sourceCodeEnd":413,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/org/apache/commons/compress/compressors/bzip2/BZip2CompressorInputStream.java#L377-L413","documentation":"The counterpart of the negative-value check in checkBounds: a field decoded from the bzip2 bitstream exceeded its exclusive limit (e.g. nGroups > 6, alphaSize > MAX_ALPHA_SIZE, tt index beyond table length). Valid bzip2 encoders never emit such values, so this signals corrupted or maliciously crafted input.","triggerScenarios":"BZip2CompressorInputStream.read() while decompressing a block whose decoded field (nGroups, nSelectors, alphaSize, tt index, yy, nextSym, lastShadow) is >= the limit passed to checkBounds.","commonSituations":"Corrupted/truncated archives, crafted 'zip bomb' style inputs, wrong decoder applied to non-bzip2 bytes, disk or network bit errors, fuzzed/security-test inputs.","solutions":["Verify the archive with `bzip2 -t` or re-download; the data is corrupt.","Check you are not feeding the wrong format into BZip2CompressorInputStream.","Wrap decompression in try-catch IOException and fail gracefully; never ignore, as output would be wrong.","If input comes from untrusted users, treat this as an expected rejection path (library is defending against CVE-style overflows)."],"exampleFix":"// before\nbyte[] data = decompress(untrustedBytes); // throws raw IOException\n// after\ntry {\n    data = decompress(untrustedBytes);\n} catch (IOException e) {\n    throw new InvalidArchiveException(\"corrupt bzip2 input: \" + e.getMessage(), e);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    decompress(in);\n} catch (IOException e) {\n    throw new InvalidArchiveException(\"bzip2 bounds violation (corrupt data): \" + e.getMessage(), e);\n}","preventionTips":["Never ignore IOException during decompression — output would silently be wrong","Validate untrusted uploads with `bzip2 -t` in a sandbox before processing","Cap decompressed output size to defend against crafted inputs","Re-download instead of retrying corrupt bytes"],"tags":["io","bzip2","corrupt-input","bounds-check"],"backgroundTag":"value-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}