Release to Master by adamhathcock · Pull Request #1274 · adamhathcock/sharpcompress

adamhathcock · 2026-04-04T09:54:15Z

This pull request introduces several important improvements to the robustness and security of archive decompression, especially for BZip2, Deflate64, Reduce, Shrink, and ZStandard formats. The changes focus on improved error handling, preventing out-of-memory issues, and ensuring buffer sizes are appropriate for the formats being processed.

Security and Robustness Improvements

Added explicit bounds checking and error handling in BZip2 and Deflate64 decompression routines to prevent out-of-bounds reads and provide clear error messages when encountering invalid or corrupted data. [1] [2] [3] [4] [5] [6] [7] [8] [9]
Improved error handling in ZIP streaming header reading by catching EndOfStreamException and throwing an InvalidFormatException with a descriptive message.
Added checks in Reduce decompression streams to detect when compressed input is exhausted before the expected uncompressed size is reached, throwing an InvalidFormatException in such cases. [1] [2] [3] [4] [5]

Shrink Decompression Hardening

Refactored ShrinkStream to avoid pre-allocating buffers based on declared compressed size, instead reading actual compressed data from the stream. This prevents possible OutOfMemoryException attacks with crafted archives and ensures the stream is safely bounded. [1] [2] [3] [4]
Added validation to ensure the declared uncompressed size for Shrink streams does not exceed int.MaxValue, throwing an exception if it does.

Buffer Size and Format Detection Adjustments

Reduced the default RewindableBufferSize from 160KB to 80KB, clarifying that formats needing larger buffers (e.g., BZip2, ZStandard) specify their own requirements. Updated documentation accordingly. [1] [2]
Optimized TarReader ring buffer allocation strategy: instead of allocating TarWrapper.MaximumRewindBufferSize (~900 KB) for every non-seekable stream regardless of format, the reader now starts with a small default buffer (80 KB) for cheap magic-byte detection, then grows the buffer lazily to the matched wrapper's MinimumRewindBufferSize only when needed (e.g., ~900 KB for BZip2, smaller for GZip/plain tar). This reduces per-reader memory usage significantly in high-concurrency scenarios when most archives are not BZip2-compressed. [1] [2] [3] [4]
Added SharpCompressStream.EnsureMinimumRingBufferCapacity(int) to support lazy ring buffer growth, preserving already-buffered bytes when the buffer is enlarged.
Added ZStandard-specific constants to clarify maximum block size and recommended input buffer size for streaming decompression.

Agent-Logs-Url: https://github.com/adamhathcock/sharpcompress/sessions/84b02876-db79-41ed-875b-f1c7dbe5d8e2 Co-authored-by: adamhathcock <527620+adamhathcock@users.noreply.github.com>

…reams Agent-Logs-Url: https://github.com/adamhathcock/sharpcompress/sessions/b115976a-5d8a-412e-a462-72b4531f2d0a Co-authored-by: adamhathcock <527620+adamhathcock@users.noreply.github.com>

…Async params Agent-Logs-Url: https://github.com/adamhathcock/sharpcompress/sessions/9ed10d73-ebf8-45d3-8d25-d5aa1f4989e7 Co-authored-by: adamhathcock <527620+adamhathcock@users.noreply.github.com>

…ngbuffer-bzip2 Dynamic ring buffer sizing for BZip2 and ZStandard on non-seekable streams

…bomb-and-crash-bugs Fix fuzzer-found decompression bomb and crash bugs

# Conflicts: # src/SharpCompress/packages.lock.json

Copilot

Pull request overview

This PR hardens archive decompression and tar format detection, focusing on safer handling of malformed/crafted inputs (to avoid OOB reads / OOM) and on ensuring non-seekable tar streams have adequate rewind buffering for formats like BZip2 and ZStandard.

Changes:

Added bounds checks / clearer failures in Deflate64 and BZip2 decoding paths, plus improved ZIP streaming header EOF handling.
Refactored Shrink decompression to avoid allocating based on untrusted “compressed size”, and added malformed-input regression tests (Reduce/Deflate64/BZip2/Shrink).
Reworked tar detection buffering: per-wrapper minimum rewind sizes (BZip2/ZStandard) and a maximum used during tar probing; lowered the global default rewindable buffer size.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/SharpCompress.Test/Tar/TarReaderTests.cs	Adds regression tests for non-seekable tar.bz2 reading and TarWrapper buffer sizing defaults.
tests/SharpCompress.Test/Streams/SharpCompressStreamSeekTest.cs	Adds tests covering StartRecording(minBufferSize) behavior and default buffer usage.
tests/SharpCompress.Test/MalformedInputTests.cs	Adds malformed-input tests covering Reduce “decompression bomb”, Deflate64 invalid Huffman data, BZip2 invalid symbol, and Shrink OOM attempt.
src/SharpCompress/Readers/Tar/TarReader.Factory.cs	Ensures non-seekable tar reader probing allocates a ring buffer sized to TarWrapper.MaximumRewindBufferSize.
src/SharpCompress/Providers/Default/ShrinkCompressionProvider.cs	Updates Shrink provider to use new ShrinkStream API (now only passes output size).
src/SharpCompress/packages.lock.json	Updates locked dependency resolutions for ILLink tasks.
src/SharpCompress/IO/SharpCompressStream.cs	Extends StartRecording to accept an optional minimum ring buffer size and documents the behavior.
src/SharpCompress/IO/SeekableSharpCompressStream.cs	Updates StartRecording override signature to match base (parameter ignored for seekable streams).
src/SharpCompress/Factories/TarWrapper.cs	Adds MinimumRewindBufferSize per wrapper, sets BZip2/ZStandard requirements, and exposes MaximumRewindBufferSize.
src/SharpCompress/Factories/TarFactory.cs	Uses TarWrapper.MaximumRewindBufferSize when starting recording for tar probing.
src/SharpCompress/Compressors/ZStandard/ZstandardConstants.cs	Adds constants for max block size and recommended streaming input buffer size.
src/SharpCompress/Compressors/Shrink/ShrinkStream.cs	Refactors ShrinkStream to avoid prealloc based on declared compressed size; reads actual compressed bytes instead; validates output size <= int.MaxValue.
src/SharpCompress/Compressors/Shrink/ShrinkStream.Async.cs	Mirrors ShrinkStream changes in async path (read actual compressed bytes, then decompress).
src/SharpCompress/Compressors/Reduce/ReduceStream.cs	Detects early exhaustion of compressed input and throws InvalidFormatException instead of producing unbounded output.
src/SharpCompress/Compressors/Reduce/ReduceStream.Async.cs	Async parity for ReduceStream early-exhaustion detection.
src/SharpCompress/Compressors/Deflate64/HuffmanTree.cs	Adds bounds check to prevent out-of-range table writes on malformed Huffman data.
src/SharpCompress/Compressors/BZip2/CBZip2InputStream.cs	Adds bounds checks for selector/symbol indices to prevent OOB on malformed BZip2 streams.
src/SharpCompress/Compressors/BZip2/CBZip2InputStream.Async.cs	Async parity for the new BZip2 bounds checks.
src/SharpCompress/Common/Zip/StreamingZipHeaderFactory.cs	Converts EndOfStreamException into InvalidFormatException with a clearer message during header reads.
src/SharpCompress/Common/Constants.cs	Reduces default RewindableBufferSize to 80KB and updates docs to point to per-format tar wrapper sizing.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-04T10:00:24Z

 /// Shrink requires compressed and uncompressed sizes which must be provided via CompressionContext.
 /// </remarks>
 public sealed class ShrinkCompressionProvider : ContextRequiredDecompressionProviderBase
 {
    public override CompressionType CompressionType => CompressionType.Shrink;
    protected override string CompressionNotSupportedMessage =>
        "Shrink compression is not supported by SharpCompress's internal implementation.";

    protected override string DecompressionContextRequirementDescription =>
        "Shrink decompression requires compressed and uncompressed sizes";

    public override Stream CreateDecompressStream(Stream source, CompressionContext context)
    {
        ValidateRequiredSizes(context, "Shrink");

-        return new ShrinkStream(
-            source,
-            CompressionMode.Decompress,
-            context.InputSize,
-            context.OutputSize
-        );
+        return new ShrinkStream(source, context.OutputSize);


ValidateRequiredSizes enforces that CompressionContext.InputSize is provided, but the updated Shrink implementation no longer uses context.InputSize (only OutputSize) and reads the entire source stream. Either use InputSize to bound the compressed read (and keep the validation/messages accurate), or relax the validation + update the remarks/DecompressionContextRequirementDescription to reflect the real requirements.

@copilot apply changes based on this feedback

Fixed in 765f281. Added ValidateOutputSize to CompressionProviderBase that only checks OutputSize >= 0. ShrinkCompressionProvider now calls ValidateOutputSize instead of ValidateRequiredSizes, and the remarks and DecompressionContextRequirementDescription have been updated to reflect that only OutputSize (uncompressed size) is required — InputSize is not needed since ShrinkStream reads directly from the bounded source stream.

Copilot · 2026-04-04T10:00:25Z

+        // Allocate ring buffer with the requested minimum size (at least the global default).
        if (_ringBuffer is null)
        {
-            _ringBuffer = new RingBuffer(Constants.RewindableBufferSize);
+            var size =
+                minBufferSize.GetValueOrDefault() > Constants.RewindableBufferSize


minBufferSize is ignored when _ringBuffer was preallocated in the constructor (e.g., via SharpCompressStream.Create(stream, bufferSize: ...)). This makes the new StartRecording(minBufferSize) parameter ineffective in those cases; consider ensuring the existing ring buffer capacity is at least minBufferSize (or documenting that minBufferSize only applies when no ring buffer exists yet).

@copilot apply changes based on this feedback

Fixed in 765f281. StartRecording now calls EnsureMinimumRingBufferCapacity(minBufferSize.Value) when the ring buffer was pre-allocated but smaller than the requested minimum, making the minBufferSize parameter effective regardless of how the stream was constructed.

Copilot · 2026-04-04T10:00:25Z

            stream,
-            bufferSize: readerOptions.RewindableBufferSize
+            bufferSize: Math.Max(
+                readerOptions.RewindableBufferSize ?? 0,
+                TarWrapper.MaximumRewindBufferSize
+            )


For non-seekable inputs this forces the ring buffer to TarWrapper.MaximumRewindBufferSize (~900KB due to BZip2) even when the archive is e.g. tar/tar.gz. This can be a noticeable per-reader memory increase in high-concurrency scenarios; consider a strategy that allocates only the matched wrapper’s required size (or a growable ring buffer) after cheap magic detection, while still preserving the ability to rewind the initial probe bytes.

@copilot apply changes based on this feedback

Applied in eb2126e. The fix uses a two-phase approach:

TarReader.OpenReader (both sync and async) now creates the initial SharpCompressStream with only the default 80 KB ring buffer instead of MaximumRewindBufferSize (~900 KB).

After the cheap magic-byte IsMatch check identifies the compression format, EnsureMinimumRingBufferCapacity is called with the matched wrapper's MinimumRewindBufferSize. This copies the small number of already-buffered bytes (at most a few hundred bytes from the None-wrapper probe) into a new, larger ring buffer only when actually needed (i.e., only for BZip2 and ZStandard formats).

A plain tar or tar.gz stream now allocates ~80 KB; only tar.bz2 allocates ~900 KB. The EnsureMinimumRingBufferCapacity method is a no-op for seekable streams (SeekableSharpCompressStream) since they use native seeking with no ring buffer.

Copilot · 2026-04-04T10:00:25Z

        var sharpCompressStream = SharpCompressStream.Create(
            stream,
-            bufferSize: readerOptions.RewindableBufferSize
+            bufferSize: Math.Max(
+                readerOptions.RewindableBufferSize ?? 0,
+                TarWrapper.MaximumRewindBufferSize
+            )


Same concern as the async path: on non-seekable streams this makes every TarReader allocate at least TarWrapper.MaximumRewindBufferSize (~900KB) regardless of actual compression type. If many readers are opened concurrently, this may increase memory usage significantly; consider allocating based on the matched wrapper’s minimum (or making the buffer growable) after initial detection.

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 8 comments.

Comments suppressed due to low confidence (1)

src/SharpCompress/Compressors/Shrink/ShrinkStream.cs:45

CanSeek returns true, but Position's setter throws NotImplementedException (and Seek(...) is also unimplemented). This violates the Stream contract and can break callers that branch on CanSeek. Since this stream is fully in-memory after decompression, consider implementing Seek/Position properly (or set CanSeek to false).

    public override bool CanRead => true;

    public override bool CanSeek => true;

    public override bool CanWrite => false;

    public override long Length => _uncompressedSize;

    public override long Position
    {
        get => _position;
        set => throw new NotImplementedException();
    }

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-05T13:24:51Z

        if (_ringBuffer is null)
        {
-            _ringBuffer = new RingBuffer(Constants.RewindableBufferSize);
+            var size =
+                minBufferSize.GetValueOrDefault() > Constants.RewindableBufferSize
+                    ? minBufferSize.GetValueOrDefault()
+                    : Constants.RewindableBufferSize;
+            _ringBuffer = new RingBuffer(size);
+        }
+        else if (minBufferSize.HasValue && minBufferSize.Value > _ringBuffer.Capacity)


StartRecording(minBufferSize) only uses minBufferSize when _ringBuffer is null. If the stream was created via SharpCompressStream.Create(..., bufferSize: ...) (which pre-allocates _ringBuffer), a larger minBufferSize is silently ignored and a later rewind can still overflow. Consider ensuring the existing ring buffer capacity is at least the requested minimum (e.g., call EnsureMinimumRingBufferCapacity(size) here) or throwing when minBufferSize exceeds the current capacity.

Copilot · 2026-04-05T13:24:51Z

+            )
        );
        long pos = sharpCompressStream.Position;
        foreach (var wrapper in TarWrapper.Wrappers)


The initial bufferSize is computed with Math.Max(readerOptions.RewindableBufferSize ?? 0, Constants.RewindableBufferSize), which makes it impossible to set a per-stream rewindable buffer smaller than the global default even though Constants.RewindableBufferSize is documented as overridable per stream. Consider using readerOptions.RewindableBufferSize ?? Constants.RewindableBufferSize for the initial buffer (and keep the later growth to wrapper.MinimumRewindBufferSize for formats that need it).

Suggested change

)

);

long pos = sharpCompressStream.Position;

foreach (var wrapper in TarWrapper.Wrappers)

bufferSize: readerOptions.RewindableBufferSize ?? Common.Constants.RewindableBufferSize

Copilot · 2026-04-05T13:24:51Z

+    /// <c>TarWrapper.MaximumRewindBufferSize</c> is used at stream construction
+    /// to ensure the correct capacity is allocated upfront.


These updated docs state that TarWrapper.MaximumRewindBufferSize is used “at stream construction” to ensure correct capacity is allocated upfront, but TarReader now grows the buffer lazily via EnsureMinimumRingBufferCapacity after wrapper matching (and TarFactory allocates during StartRecording, not construction). Consider adjusting the wording to reflect the actual behavior so consumers aren’t misled about when/where the max size is applied.

Suggested change

/// <c>TarWrapper.MaximumRewindBufferSize</c> is used at stream construction

/// to ensure the correct capacity is allocated upfront.

/// <c>TarWrapper.MaximumRewindBufferSize</c> may be used to grow the rewind

/// buffer as needed during format detection or recording rather than

/// allocating the maximum capacity upfront at stream construction.

Copilot · 2026-04-05T13:24:51Z

        var providers = CompressionProviderRegistry.Default;
        var sharpCompressStream = new SharpCompressStream(stream);
-        sharpCompressStream.StartRecording();
+        sharpCompressStream.StartRecording(TarWrapper.MaximumRewindBufferSize);
        foreach (var wrapper in TarWrapper.Wrappers)


Calling StartRecording(TarWrapper.MaximumRewindBufferSize) here forces allocating the maximum (~900KB due to BZip2) for every stream, even when the wrapper match fails early (e.g., plain tar/gzip) and even for seekable streams (since this path uses new SharpCompressStream(stream) rather than SharpCompressStream.Create). Consider the same two-phase strategy as TarReader.Factory: start with a small buffer, only grow when wrapper.IsMatch(...) succeeds (and/or use SharpCompressStream.Create to avoid ring buffering for seekable streams).

Copilot · 2026-04-05T13:24:52Z

        var providers = CompressionProviderRegistry.Default;
        var sharpCompressStream = new SharpCompressStream(stream);
-        sharpCompressStream.StartRecording();
+        sharpCompressStream.StartRecording(TarWrapper.MaximumRewindBufferSize);
        foreach (var wrapper in TarWrapper.Wrappers)


Calling StartRecording(TarWrapper.MaximumRewindBufferSize) here forces allocating the maximum (~900KB due to BZip2) for every stream, even when the wrapper match fails early and even for seekable streams (since this path uses new SharpCompressStream(stream) rather than SharpCompressStream.Create). Consider starting with a small buffer and only growing when IsMatchAsync succeeds (or switching to SharpCompressStream.Create to avoid buffering for seekable streams).

Copilot · 2026-04-05T13:24:52Z

        options ??= new ReaderOptions();
        var sharpCompressStream = new SharpCompressStream(stream);
-        sharpCompressStream.StartRecording();
+        sharpCompressStream.StartRecording(TarWrapper.MaximumRewindBufferSize);
        foreach (var wrapper in TarWrapper.Wrappers)


Calling StartRecording(TarWrapper.MaximumRewindBufferSize) here forces allocating the maximum ring buffer for every stream opened via TarFactory.OpenReader, even when the archive isn’t BZip2/ZStd. Consider a lazy growth approach (small initial buffer, grow only after wrapper.IsMatch(...) succeeds) to preserve the memory savings introduced in TarReader.Factory.

Copilot · 2026-04-05T13:24:52Z

        cancellationToken.ThrowIfCancellationRequested();
        options ??= new ReaderOptions();
        var sharpCompressStream = new SharpCompressStream(stream);
-        sharpCompressStream.StartRecording();
+        sharpCompressStream.StartRecording(TarWrapper.MaximumRewindBufferSize);
        foreach (var wrapper in TarWrapper.Wrappers)


Calling StartRecording(TarWrapper.MaximumRewindBufferSize) here forces allocating the maximum ring buffer for every stream opened via TarFactory.OpenAsyncReader, even when the archive isn’t BZip2/ZStd. Consider a lazy growth approach (small initial buffer, grow only after IsMatchAsync succeeds) to avoid the per-reader ~900KB allocation in the common case.

Copilot

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Updated [SharpCompress](https://github.com/adamhathcock/sharpcompress) from 0.48.1 to 0.49.1. <details> <summary>Release notes</summary> _Sourced from [SharpCompress's releases](https://github.com/adamhathcock/sharpcompress/releases)._ ## 0.49.1 ## What's Changed * Close writable entry streams during async archive disposal by @Copilot in adamhathcock/sharpcompress#1338 * Restore `WriteToDirectoryAsync` progress callbacks for solid 7z archives by @Copilot in adamhathcock/sharpcompress#1340 * Try to fix global.json to avoid churn in locks by @adamhathcock in adamhathcock/sharpcompress#1341 * Fix tar archive enumeration after fully reading entry streams by @adamhathcock in adamhathcock/sharpcompress#1342 **Full Changelog**: adamhathcock/sharpcompress@0.49.0...0.49.1 ## 0.49.0 This should contain a lot of write async fixes and some breaking API changes that fix previous broke `net48` usage ## What's Changed * Rename IWriteableArchiveFactory.cs to IWritableArchiveFactory.cs by @Copilot in adamhathcock/sharpcompress#1244 * Some API clean up from GPT 5.4 by @adamhathcock in adamhathcock/sharpcompress#1243 * Release to master by @adamhathcock in adamhathcock/sharpcompress#1267 * Fix three BLAKE2sp correctness bugs and eliminate allocations in hot path by @coderb in adamhathcock/sharpcompress#1266 * Corrected async examples. by @dlemstra in adamhathcock/sharpcompress#1277 * Fix setting invalid access time fails extraction by @aromaa in adamhathcock/sharpcompress#1279 * Fix incorrect code examples in docs for sync/async usage by @Copilot in adamhathcock/sharpcompress#1280 * Replace APPNOTE.TXT contents with reference link note by @puk06 in adamhathcock/sharpcompress#1286 * Release to Master by @adamhathcock in adamhathcock/sharpcompress#1274 * update docs for tar gap analysis and XZ usage by @adamhathcock in adamhathcock/sharpcompress#1288 * Add a PooledMemoryStream to avoid allocating by @adamhathcock in adamhathcock/sharpcompress#1275 * fix: Change LeaveStreamOpen default from true to false by @puk06 in adamhathcock/sharpcompress#1293 * Fix usage of ReaderOptions and pre-defined values by @adamhathcock in adamhathcock/sharpcompress#1295 * Enforce seekable, readable and writable on streams by @adamhathcock in adamhathcock/sharpcompress#1297 * Add ArchiveInformation record for consolidated archive detection and capability inspection by @Copilot in adamhathcock/sharpcompress#1299 * merge release to master by @adamhathcock in adamhathcock/sharpcompress#1314 * Some clean up and test clean up by @adamhathcock in adamhathcock/sharpcompress#1321 * Finish Write Async by @adamhathcock in adamhathcock/sharpcompress#1323 * More complete Tar implementation: USTAR, PAX, etc. by @adamhathcock in adamhathcock/sharpcompress#1289 * Add Polysharp and adjustments that do not break legacy frameworks by @adamhathcock in adamhathcock/sharpcompress#1330 * Fix null `IVolume.FileName` for single-volume file-based archives by @Copilot in adamhathcock/sharpcompress#1333 * Add skills by @adamhathcock in adamhathcock/sharpcompress#1332 * add AOT smoke and missing tests by @adamhathcock in adamhathcock/sharpcompress#1334 ## New Contributors * @dlemstra made their first contribution in adamhathcock/sharpcompress#1277 * @aromaa made their first contribution in adamhathcock/sharpcompress#1279 * @puk06 made their first contribution in adamhathcock/sharpcompress#1286 **Full Changelog**: adamhathcock/sharpcompress@0.48.1...0.49.0 ## 0.49.0-beta.140 ## What's Changed * Add Polysharp and adjustments that do not break legacy frameworks by @adamhathcock in adamhathcock/sharpcompress#1330 **Full Changelog**: adamhathcock/sharpcompress@0.49.0-beta.136...0.49.0-beta.140 ## 0.49.0-beta.136 ## What's Changed * Rename IWriteableArchiveFactory.cs to IWritableArchiveFactory.cs by @Copilot in adamhathcock/sharpcompress#1244 * Some API clean up from GPT 5.4 by @adamhathcock in adamhathcock/sharpcompress#1243 * Release to master by @adamhathcock in adamhathcock/sharpcompress#1267 * Fix three BLAKE2sp correctness bugs and eliminate allocations in hot path by @coderb in adamhathcock/sharpcompress#1266 * Corrected async examples. by @dlemstra in adamhathcock/sharpcompress#1277 * Fix setting invalid access time fails extraction by @aromaa in adamhathcock/sharpcompress#1279 * Fix incorrect code examples in docs for sync/async usage by @Copilot in adamhathcock/sharpcompress#1280 * Replace APPNOTE.TXT contents with reference link note by @puk06 in adamhathcock/sharpcompress#1286 * Release to Master by @adamhathcock in adamhathcock/sharpcompress#1274 * update docs for tar gap analysis and XZ usage by @adamhathcock in adamhathcock/sharpcompress#1288 * Add a PooledMemoryStream to avoid allocating by @adamhathcock in adamhathcock/sharpcompress#1275 * fix: Change LeaveStreamOpen default from true to false by @puk06 in adamhathcock/sharpcompress#1293 * Fix usage of ReaderOptions and pre-defined values by @adamhathcock in adamhathcock/sharpcompress#1295 * Enforce seekable, readable and writable on streams by @adamhathcock in adamhathcock/sharpcompress#1297 * Add ArchiveInformation record for consolidated archive detection and capability inspection by @Copilot in adamhathcock/sharpcompress#1299 * merge release to master by @adamhathcock in adamhathcock/sharpcompress#1314 * Some clean up and test clean up by @adamhathcock in adamhathcock/sharpcompress#1321 * Finish Write Async by @adamhathcock in adamhathcock/sharpcompress#1323 * More complete Tar implementation: USTAR, PAX, etc. by @adamhathcock in adamhathcock/sharpcompress#1289 ## New Contributors * @dlemstra made their first contribution in adamhathcock/sharpcompress#1277 * @aromaa made their first contribution in adamhathcock/sharpcompress#1279 * @puk06 made their first contribution in adamhathcock/sharpcompress#1286 **Full Changelog**: adamhathcock/sharpcompress@0.48.1...0.49.0-beta1 Commits viewable in [compare view](adamhathcock/sharpcompress@0.48.1...0.49.1). </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=SharpCompress&package-manager=nuget&previous-version=0.48.1&new-version=0.49.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Copilot AI and others added 12 commits April 2, 2026 09:33

Initial plan

24e812c

Fix decompression bomb and crash bugs (fuzzer-found)

58bec11

Agent-Logs-Url: https://github.com/adamhathcock/sharpcompress/sessions/84b02876-db79-41ed-875b-f1c7dbe5d8e2 Co-authored-by: adamhathcock <527620+adamhathcock@users.noreply.github.com>

clean up shrink stream to ensure correctness

16903bd

Initial plan

c4c646c

remove more extra stuff

bd0d1cf

Merge pull request #1273 from adamhathcock/copilot/dynamic-default-ri…

d532204

…ngbuffer-bzip2 Dynamic ring buffer sizing for BZip2 and ZStandard on non-seekable streams

Merge pull request #1272 from adamhathcock/copilot/fix-decompression-…

5758b08

…bomb-and-crash-bugs Fix fuzzer-found decompression bomb and crash bugs

Merge branch 'release' into adam/master-release

b326b71

# Conflicts: # src/SharpCompress/packages.lock.json

fix build

9db27df

Copilot AI review requested due to automatic review settings April 4, 2026 09:54

Copilot started reviewing on behalf of adamhathcock April 4, 2026 09:54 View session

Copilot AI reviewed Apr 4, 2026

View reviewed changes

Copilot started work on behalf of adamhathcock April 4, 2026 10:06 View session

Copilot finished work on behalf of adamhathcock April 4, 2026 10:21

Copilot started work on behalf of adamhathcock April 5, 2026 13:18 View session

Copilot AI review requested due to automatic review settings April 5, 2026 13:18

Copilot started reviewing on behalf of adamhathcock April 5, 2026 13:19 View session

Copilot finished work on behalf of adamhathcock April 5, 2026 13:24

Copilot AI reviewed Apr 5, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings April 5, 2026 13:26

Copilot started reviewing on behalf of adamhathcock April 5, 2026 13:27 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

Comment thread src/SharpCompress/IO/SharpCompressStream.cs Outdated

Comment thread src/SharpCompress/packages.lock.json

Comment thread src/SharpCompress/packages.lock.json

don't resize ring buffer

e7cacdd

adamhathcock force-pushed the adam/master-release branch from 01c2067 to e7cacdd Compare April 5, 2026 14:20

Copilot AI review requested due to automatic review settings April 5, 2026 14:20

Copilot started reviewing on behalf of adamhathcock April 5, 2026 14:20 View session

Copilot AI reviewed Apr 5, 2026

View reviewed changes

This was referenced Jun 1, 2026

Bump the packages group with 1 update tonycknight/discorss#36

Merged

Bump the dotnet-dependencies group with 6 updates velvet-lab/xsdk#88

Closed

Bump SharpCompress from 0.48.1 to 0.49.1 ShelarAtharva404/TaskManger#23

Open

		/// <c>TarWrapper.MaximumRewindBufferSize</c> is used at stream construction
		/// to ensure the correct capacity is allocated upfront.

-    /// <c>TarWrapper.MaximumRewindBufferSize</c> is used at stream construction
-    /// to ensure the correct capacity is allocated upfront.
+    /// <c>TarWrapper.MaximumRewindBufferSize</c> may be used to grow the rewind
+    /// buffer as needed during format detection or recording rather than
+    /// allocating the maximum capacity upfront at stream construction.

Conversation

adamhathcock commented Apr 4, 2026 • edited by Copilot AI Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

adamhathcock Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

adamhathcock Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

adamhathcock Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adamhathcock commented Apr 4, 2026 •

edited by Copilot AI

Loading