{"record":{"id":"79d531a01b3c7532","repo":"MuntashirAkon/AppManager","slug":"size-is-out-of-range-size","errorCode":null,"errorMessage":"Size is out of range: + size","messagePattern":"Size is out of range: \\+ size","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java","lineNumber":910,"sourceCode":"    /**\n     * Get if this entry is a sparse file with 1.X PAX Format or not\n     *\n     * @return True if this entry is a sparse file with 1.X PAX Format\n     * @since 1.20\n     */\n    public boolean isPaxGNU1XSparse() {\n        return paxGNU1XSparse;\n    }\n\n    /**\n     * Set this entry's file size.\n     *\n     * @param size This entry's new file size.\n     * @throws IllegalArgumentException if the size is &lt; 0.\n     */\n    public void setSize(final long size) {\n        if (size < 0) {\n            throw new IllegalArgumentException(\"Size is out of range: \" + size);\n        }\n        this.size = size;\n    }\n\n    /**\n     * Get this entry's major device number.\n     *\n     * @return This entry's major device number.\n     * @since 1.4\n     */\n    public int getDevMajor() {\n        return devMajor;\n    }\n\n    /**\n     * Set this entry's major device number.\n     *\n     * @param devNo This entry's major device number.","sourceCodeStart":892,"sourceCodeEnd":928,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/org/apache/commons/compress/archivers/tar/TarArchiveEntry.java#L892-L928","documentation":"TarArchiveEntry.setSize(long) validates that a tar entry's size is non-negative before storing it; tar headers cannot represent negative sizes. IllegalArgumentException(\"Size is out of range: \" + size) is thrown for negative values.","triggerScenarios":"Calling setSize() with a negative long — typically from a corrupted/overflowed length value, a size computed as (end - start) where start > end, or a PaxHeader ('size=' via processPaxHeader) carrying a negative number.","commonSituations":"Backing up files whose reported length underflowed; computing entry size from wrong offsets; malicious/corrupted PAX headers in a crafted archive; long overflow when summing chunk sizes.","solutions":["Clamp or validate the size to >= 0 before calling setSize().","Fix the size computation (e.g. Math.max(0, end - start)) or use Files.size(path) for the true length.","When reading, reject archives whose PAX size header is negative rather than propagating it.","Catch IllegalArgumentException and skip the offending entry with a log."],"exampleFix":"// before\nentry.setSize(file.length() - skipped); // may go negative\n// after\nlong size = Math.max(0, file.length() - skipped);\nentry.setSize(size);","handlingStrategy":"validation","validationCode":"if (size < 0) throw new IllegalArgumentException(\"Entry size must be >= 0, got \" + size);\ntarEntry.setSize(size);","typeGuard":"boolean isValidTarSize(long size) { return size >= 0 && size <= 0x7FFFFFFFFFFFFFFFL; }","tryCatchPattern":"try { tarEntry.setSize(size); } catch (IllegalArgumentException e) { Log.w(TAG, \"Skipping entry with bad size\", e); }","preventionTips":["Compute sizes with Math.max(0, ...)","Use Files.size() instead of manual offset math","Sanitize PAX size headers when reading untrusted archives"],"tags":["tar","archive","argument-out-of-range"],"backgroundTag":"value-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}