{"record":{"id":"4aca4a80ad51a6bd","repo":"MuntashirAkon/AppManager","slug":"stream-corrupted","errorCode":null,"errorMessage":"Stream corrupted","messagePattern":"Stream corrupted","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/org/apache/commons/compress/compressors/bzip2/BZip2CompressorInputStream.java","lineNumber":755,"sourceCode":"        final int ttLen = this.last + 1;\n        final int[] tt = this.data.initTT(ttLen);\n        final byte[] ll8 = this.data.ll8;\n        cftab[0] = 0;\n        System.arraycopy(this.data.unzftab, 0, cftab, 1, 256);\n\n        for (int i = 1, c = cftab[0]; i <= 256; i++) {\n            c += cftab[i];\n            cftab[i] = c;\n        }\n\n        for (int i = 0, lastShadow = this.last; i <= lastShadow; i++) {\n            final int tmp = cftab[ll8[i] & 0xff]++;\n            checkBounds(tmp, ttLen, \"tt index\");\n            tt[tmp] = i;\n        }\n\n        if ((this.origPtr < 0) || (this.origPtr >= tt.length)) {\n            throw new IOException(\"Stream corrupted\");\n        }\n\n        this.su_tPos = tt[this.origPtr];\n        this.su_count = 0;\n        this.su_i2 = 0;\n        this.su_ch2 = 256; /* not a char and not EOF */\n\n        if (this.blockRandomised) {\n            this.su_rNToGo = 0;\n            this.su_rTPos = 0;\n            return setupRandPartA();\n        }\n        return setupNoRandPartA();\n    }\n\n    private int setupRandPartA() throws IOException {\n        if (this.su_i2 <= this.last) {\n            this.su_chPrev = this.su_ch2;","sourceCodeStart":737,"sourceCodeEnd":773,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/org/apache/commons/compress/compressors/bzip2/BZip2CompressorInputStream.java#L737-L773","documentation":"After building the inverse-BWT 'tt' table, the decoder validates origPtr (the starting pointer stored in the block header) against the table bounds. If origPtr is negative or beyond tt.length, the block header is inconsistent with the decoded data — the stream is corrupt and cannot be inverted.","triggerScenarios":"BZip2CompressorInputStream.read() during final BWT inversion in setupBlock/getAndMoveToFrontDecode: origPtr from the block header falls outside tt.length.","commonSituations":"Corrupted block headers from truncated/flipped-bit files, crafted malicious archives, feeding non-bzip2 bytes to the decompressor.","solutions":["Validate the source with `bzip2 -t` and replace the corrupt file.","Confirm you decompress the complete stream from byte 0 (no offsets/resume).","Catch IOException and convert to a domain-specific 'corrupt archive' error for callers.","Keep commons-compress updated — these checks are additions from hardening fixes; older versions may crash instead."],"exampleFix":"// before\nnew BZip2CompressorInputStream(raw); // may throw 'Stream corrupted' mid-read\n// after\ntry (BZip2CompressorInputStream bz = new BZip2CompressorInputStream(raw)) {\n    // read\n} catch (IOException e) {\n    throw new CorruptArchiveException(\"invalid bzip2 stream: \" + e.getMessage(), e);\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try (BZip2CompressorInputStream bz = new BZip2CompressorInputStream(raw)) {\n    // read\n} catch (IOException e) {\n    if (\"Stream corrupted\".equals(e.getMessage()))\n        throw new CorruptArchiveException(\"bad origPtr / corrupt block\", e);\n    throw e;\n}","preventionTips":["Use the latest commons-compress (pre-hardening versions could misbehave on such input)","Verify archive integrity before decompression","Isolate untrusted decompression in a guarded step (limits + catch)","Never treat decoded output as valid if any IOException occurred"],"tags":["io","bzip2","corrupt-input","bwt"],"backgroundTag":"index-out-of-bounds","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}