{"record":{"id":"7b95bdc1782729f6","repo":"MuntashirAkon/AppManager","slug":"at-offset-offset-length-byte-binary-number-exceeds-maximum","errorCode":null,"errorMessage":"At offset ${offset}, ${length} byte binary number exceeds maximum signed long value","messagePattern":"At offset (.+?), (.+?) byte binary number exceeds maximum signed long value","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java","lineNumber":180,"sourceCode":"     */\n    public static long parseOctalOrBinary(final byte[] buffer, final int offset,\n                                          final int length) {\n\n        if ((buffer[offset] & 0x80) == 0) {\n            return parseOctal(buffer, offset, length);\n        }\n        final boolean negative = buffer[offset] == (byte) 0xff;\n        if (length < 9) {\n            return parseBinaryLong(buffer, offset, length, negative);\n        }\n        return parseBinaryBigInteger(buffer, offset, length, negative);\n    }\n\n    private static long parseBinaryLong(final byte[] buffer, final int offset,\n                                        final int length,\n                                        final boolean negative) {\n        if (length >= 9) {\n            throw new IllegalArgumentException(\"At offset \" + offset + \", \"\n                                               + length + \" byte binary number\"\n                                               + \" exceeds maximum signed long\"\n                                               + \" value\");\n        }\n        long val = 0;\n        for (int i = 1; i < length; i++) {\n            val = (val << 8) + (buffer[offset + i] & 0xff);\n        }\n        if (negative) {\n            // 2's complement\n            val--;\n            val ^= (long) Math.pow(2.0, (length - 1) * 8.0) - 1;\n        }\n        return negative ? -val : val;\n    }\n\n    private static long parseBinaryBigInteger(final byte[] buffer,\n                                              final int offset,","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/MuntashirAkon/AppManager/blob/0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5/app/src/main/java/org/apache/commons/compress/archivers/tar/TarUtils.java#L162-L198","documentation":"TarUtils.parseBinaryLong throws this IllegalArgumentException when a GNU base-256 encoded numeric field is 9 or more bytes long, because a 9+ byte binary number cannot fit in a signed 64-bit Java long. The value represented by the header field exceeds Long.MAX_VALUE, so it cannot be returned as a long.","triggerScenarios":"Parsing (via parseOctalOrBinary) a tar header field encoded in base-256 binary with length >= 9 bytes, i.e. a value too large for a signed long (>= 2^63); archives produced on systems with sizes/times beyond long range.","commonSituations":"Extremely large files (>8 exabytes in binary encoding form, or crafted archives); sparse or PAX headers carrying oversized numeric values; adversarial/fuzzed tar inputs.","solutions":["Treat the archive as invalid/unreadable and reject it before processing entries","Catch the IllegalArgumentException and skip or report the offending entry","Use PAX extended headers, which carry such values as decimal strings, and prefer parsing those when present","Pre-check the field's first byte for the base-256 marker and its length before calling parseOctalOrBinary"],"exampleFix":"// before\nlong size = TarUtils.parseOctalOrBinary(header, offset, TarConstants.SIZELEN); // throws for 9-byte binary\n// after\nlong size;\ntry {\n    size = TarUtils.parseOctalOrBinary(header, offset, TarConstants.SIZELEN);\n} catch (IllegalArgumentException e) {\n    throw new ArchiveException(\"Header field too large for long: \" + e.getMessage());\n}","handlingStrategy":"try-catch","validationCode":"static boolean fieldFitsInLong(byte[] buffer, int offset, int length) {\n    return length < 9 || (buffer[offset] & 0x80) == 0; // 9+ byte base-256 cannot fit in long\n}","typeGuard":null,"tryCatchPattern":"try {\n    long value = TarUtils.parseOctalOrBinary(header, offset, length);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"exceeds maximum signed long\")) {\n        throw new ArchiveException(\"Numeric field at offset \" + offset + \" overflows long\");\n    }\n    throw e;\n}","preventionTips":["Treat long-overflowing fields as a sign of malicious/corrupt input and reject the archive","Pre-check field length (< 9 bytes for base-256) before parsing","Use PAX headers for archives that legitimately need large values","Bound-check parsed sizes/offsets before allocating memory or seeking"],"tags":["java","tar","overflow","base-256"],"backgroundTag":"value-out-of-range","analyzedSha":"0152f468fc9463ee02dc2ca83f6fe4989a2c4ca5","analyzedAt":"2026-09-12T14:03:37.243Z","contentChangedAt":"2026-09-12T14:03:37.243Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}