java.lang.IndexOutOfBoundsException in net.lingala.zip4j.util.Zip4jUtil.readUntilBufferIsFull::Zip4jUtil.java:187 zip4j 2.9.0

[ZanderHuang]

This vulnerability is of java.lang.IndexOutOfBoundsException, and can be triggered in latest version zip4j (2.9.0).
It is caused by getting an index of an array which is out of the range. and can be used for attackers to launch DoS (Denial of Service) attack for any java program that uses this library (since the user of zip4j doesn't know they need to catch this kind of exception) ( CWE-248: Uncaught exception).
Likely, the root cause of this crash is in net.lingala.zip4j.util.Zip4jUtil.readUntilBufferIsFull::Zip4jUtil.java:187.
See more detail from the following crash stack.

zip4j/src/main/java/net/lingala/zip4j/util/Zip4jUtil.java

Line 187 in ce1cff6

loopReadLength = inputStream.read(bufferToReadInto, readLength, remainingLength);

Either variable "remainingLength" is index out of bounds for array "bufferToReadInto" or both variables "remainingLength" and "readLength" are index out of bounds.

Crash stack:

The crash thread's stack is as follows:

java.base/java.io.PushbackInputStream.read::PushbackInputStream.java:167
net.lingala.zip4j.util.Zip4jUtil.readUntilBufferIsFull::Zip4jUtil.java:187
net.lingala.zip4j.util.Zip4jUtil.readFully::Zip4jUtil.java:132
net.lingala.zip4j.headers.HeaderReader.readExtraDataRecords::HeaderReader.java:298
net.lingala.zip4j.headers.HeaderReader.readExtraDataRecords::HeaderReader.java:260
net.lingala.zip4j.headers.HeaderReader.readLocalFileHeader::HeaderReader.java:574
net.lingala.zip4j.io.inputstream.ZipInputStream.getNextEntry::ZipInputStream.java:91
net.lingala.zip4j.io.inputstream.ZipInputStream.getNextEntry::ZipInputStream.java:83
com.test.Entry.main::Entry.java:37

Steps to reproduce:

1. Build the following java code with the corresponding zip4j library (version 2.9.0).

## Download zip4j_env_reproduce.tar.gz from https://drive.google.com/file/d/1MekCBIghKxIW4j-TLjZkm8ovvLb_grm5/view?usp=sharing
tar -xf zip4j_env_reproduce.tar.gz
cd zip4j_env_reproduce
bash build.sh

2. Run the built program to see the crash by feeding one of the poc file contained in the pocs.tar.gz, e.g. :
   (poc file can be downloaded from https://drive.google.com/file/d/1b6pg15vvtYWXoaJHdIjO8CUHVkkTlmPm/view?usp=sharing)

java -jar target/Entry-1.0-SNAPSHOT-jar-with-dependencies.jar pocs/crash-f4d920d202a2f3d4d305f8eda683e2aa164955a7

Any further discussion for this vulnerability including fix is welcomed!

[srikanth-lingala]

Fixed in v2.10.0 released today