[Git][java-team/xz-java][upstream] New upstream version 1.12+repack
Tony Mancill (@tmancill)
gitlab at salsa.debian.org
Sun Sep 13 06:54:21 BST 2026
Tony Mancill pushed to branch upstream at Debian Java Maintainers / xz-java
Commits:
512d5b06 by tony mancill at 2026-09-12T21:37:45-07:00
New upstream version 1.12+repack
- - - - -
8 changed files:
- NEWS.md
- build.properties
- src/org/tukaani/xz/lz/LZDecoder.java
- src/org/tukaani/xz/lz/LZEncoder.java
- src/org/tukaani/xz/lz/MatchLength.java
- src9/org/tukaani/xz/lz/MatchLength.java
- src9/org/tukaani/xz/lz/MatchLengthFinder.java
- src9/org/tukaani/xz/lz/UnalignedLongLEMatchLengthFinder.java
Changes:
=====================================
NEWS.md
=====================================
@@ -2,6 +2,27 @@
XZ for Java release notes
=========================
+1.12 (2026-03-01)
+-----------------
+
+ * Fix ArrayIndexOutOfBoundsException in the LZMA/LZMA2 encoder on
+ x86-64 and ARM64 when running on Java 9 or newer. The affected
+ code isn't used on Java 8. The bug is present in versions 1.10
+ and 1.11. If one cannot upgrade, one should set the property
+ `org.tukaani.xz.MatchLengthFinder=Basic` to disable the affected
+ code path.
+
+ * Fix ArrayCache usage in LZMAInputStream. If ArrayCache was enabled,
+ decompression was likely to fail quickly when the cache returns a
+ cached array. ArrayCache is disabled by default.
+
+ * The binaries of 1.10 in the Maven Central require Java 8 and
+ contain optimized classes for Java >= 9 as multi-release JAR.
+ They were built with OpenJDK 21.0.10 on GNU/Linux and can be
+ reproduced using the following command:
+
+ SOURCE_DATE_EPOCH=1772370000 TZ=UTC0 ant maven
+
1.11 (2025-11-19)
-----------------
=====================================
build.properties
=====================================
@@ -5,7 +5,7 @@
title = XZ data compression
homepage = https://tukaani.org/xz/java.html
doc_url = https://tukaani.org/xz/xz-javadoc/
-version = 1.11
+version = 1.12
debug = true
# sourcever sets --release for javac 9 (or later) or -source and -target for
=====================================
src/org/tukaani/xz/lz/LZDecoder.java
=====================================
@@ -24,6 +24,15 @@ public final class LZDecoder {
bufSize = dictSize;
buf = arrayCache.getByteArray(bufSize, false);
+ // getByte(0) needs to return 0x00 when no data has been decompressed.
+ // This requires initializing only one byte, so don't pass "true" as
+ // the second argument in the above arrayCache.getByteArray call.
+ //
+ // Note that LZMA2InputStream calls LZDecoder.reset() before decoding
+ // anything, thus it doesn't break even if this initialization was
+ // missing here. But LZMAInputStream has no reason to call reset().
+ buf[bufSize - 1] = 0x00;
+
if (presetDict != null) {
pos = Math.min(presetDict.length, dictSize);
full = pos;
=====================================
src/org/tukaani/xz/lz/LZEncoder.java
=====================================
@@ -139,7 +139,8 @@ public abstract class LZEncoder {
// MatchLength.getLen might read and ignore extra bytes
// at the end of the buffer.
- buf = arrayCache.getByteArray(bufSize + MatchLength.EXTRA_SIZE, false);
+ buf = arrayCache.getByteArray(bufSize + MatchLength.getExtraSize(),
+ false);
keepSizeBefore = extraSizeBefore + dictSize;
keepSizeAfter = extraSizeAfter + matchLenMax;
=====================================
src/org/tukaani/xz/lz/MatchLength.java
=====================================
@@ -6,7 +6,9 @@ package org.tukaani.xz.lz;
// See the version in the src9 directory for documentation.
final class MatchLength {
- static final int EXTRA_SIZE = 0;
+ static int getExtraSize() {
+ return 0;
+ }
static int getLen(byte[] buf, int off, int delta, int len, int lenLimit) {
assert off >= 0;
=====================================
src9/org/tukaani/xz/lz/MatchLength.java
=====================================
@@ -7,13 +7,6 @@ package org.tukaani.xz.lz;
import java.nio.ByteOrder;
final class MatchLength {
- /**
- * Number of additional bytes that {@code getLen} might read even though
- * it doesn't need them. The buffer must have this many bytes of extra
- * space at the end to make it safe to use {@code getLen}.
- */
- static final int EXTRA_SIZE;
-
private static final MatchLengthFinder matchLengthFinder;
static {
@@ -48,8 +41,15 @@ final class MatchLength {
"org.tukaani.xz.MatchLengthFinder. " +
"Supported values: Basic, UnalignedLongLE");
}
+ }
- EXTRA_SIZE = matchLengthFinder.getExtraSize();
+ /**
+ * Returns the number of additional bytes that {@code getLen} might read
+ * even though it doesn't need them. The buffer must have this many bytes
+ * of extra space at the end to make it safe to use {@code getLen}.
+ */
+ static int getExtraSize() {
+ return matchLengthFinder.getExtraSize();
}
/**
=====================================
src9/org/tukaani/xz/lz/MatchLengthFinder.java
=====================================
@@ -5,7 +5,7 @@
package org.tukaani.xz.lz;
interface MatchLengthFinder {
- /** Returns value for {@code MatchLength.EXTRA_SIZE}. */
+ /** See {@code MatchLength.getExtraSize}. */
int getExtraSize();
/** See {@code MatchLength.getLen}. */
=====================================
src9/org/tukaani/xz/lz/UnalignedLongLEMatchLengthFinder.java
=====================================
@@ -10,7 +10,7 @@ import org.tukaani.xz.common.ByteArrayView;
// unaligned access. This is based on XZ Utils' memcmplen.h.
// This may read up to 7 extra bytes past the end of the specified
// end offset (off + lenLimit) so the caller must ensure that
-// there are EXTRA_SIZE bytes available at the end of the buffer.
+// there are getExtraSize() bytes available at the end of the buffer.
//
// In the extreme case of compressing a sequence of zero bytes, this
// can reduce compression time by over 30 % compared to Arrays.mismatch.
View it on GitLab: https://salsa.debian.org/java-team/xz-java/-/commit/512d5b063eee371ae3a5f67994eb010dba026d53
--
View it on GitLab: https://salsa.debian.org/java-team/xz-java/-/commit/512d5b063eee371ae3a5f67994eb010dba026d53
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20260913/39e135ce/attachment.htm>
More information about the pkg-java-commits
mailing list