(doc) Added safety check to avoid corrupting byte '0' in filename or …

…comment of gzip parameters.

src/main/java/org/apache/commons/compress/compressors/gzip/GzipParameters.java

@@ -298,6 +298,18 @@ public int type() {
     private int bufferSize = 512;
     private int deflateStrategy = Deflater.DEFAULT_STRATEGY;
 
+    private void checkEncodedStringHasNoZero(String text) {
+        if (text != null && text.length() > 0) {
+            byte[] ba = text.getBytes(fileNameCharset);
+            for (int i = 0; i < ba.length; i++) {
+                if (ba[i] == 0) {
+                    throw new IllegalArgumentException(
+                            "String in charset '" + fileNameCharset + "' contains the byte 0 (at encoded position " + i + ") which is not supported in gzip. ");
+                }
+            }
+        }
+    }
+
     /**
      * Gets size of the buffer used to retrieve compressed data.
      *
@@ -448,8 +460,10 @@ public void setBufferSize(final int bufferSize) {
      * Sets an arbitrary user-defined comment.
      *
      * @param comment a user-defined comment.
+     * @throws IllegalArgumentException if the encoded bytes would contain a nul byte '\0' reserved for gzip field termination.
      */
     public void setComment(final String comment) {
+        checkEncodedStringHasNoZero(comment);
         this.comment = comment;
     }
 
@@ -495,19 +509,22 @@ public void setExtraField(final ExtraField extra) {
      * Sets the name of the compressed file.
      *
      * @param fileName the name of the file without the directory path
+     * @throws IllegalArgumentException if the encoded bytes would contain a nul byte '\0' reserved for gzip field termination.
      * @deprecated Use {@link #setFileName(String)}.
      */
     @Deprecated
     public void setFilename(final String fileName) {
-        this.fileName = fileName;
+        setFileName(fileName);
     }
 
     /**
      * Sets the name of the compressed file.
      *
      * @param fileName the name of the file without the directory path
+     * @throws IllegalArgumentException if the encoded bytes would contain a nul byte '\0' reserved for gzip field termination.
      */
     public void setFileName(final String fileName) {
+        checkEncodedStringHasNoZero(fileName);
         this.fileName = fileName;
     }
 

src/test/java/org/apache/commons/compress/compressors/gzip/GzipParametersTest.java

@@ -20,11 +20,15 @@
 package org.apache.commons.compress.compressors.gzip;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.nio.charset.Charset;
 import java.util.zip.Deflater;
 
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
 
 /**
  * Tests {@link GzipParameters}.
@@ -46,4 +50,33 @@ public void testToString() {
         gzipParameters.setOS(GzipParameters.OS.Z_SYSTEM);
         assertTrue(gzipParameters.toString().contains("Z_SYSTEM"));
     }
+
+    @ParameterizedTest
+    @CsvSource({ //@formatter:off
+        "          , helloworld, true",
+        "          , helloéworld, true",
+        "          , hello\0world, false",
+        "ISO-8859-1, helloworld, true",
+        "ISO-8859-1, helloéworld, true",
+        "ISO-8859-1, hello\0world, false",
+        "UTF-8     , helloworld, true",
+        "UTF-8     , helloéworld, true",
+        "UTF-8     , hello\0world, false",
+        "UTF-16BE  , helloworld, false",
+    })//@formatter:on
+    public void testIllegalCommentOrFileName(String charset, String text, boolean shouldPass) {
+        final GzipParameters p = new GzipParameters();
+        if (charset != null) {
+            p.setFileNameCharset(Charset.forName(charset));
+        }
+        if (shouldPass) {
+            p.setComment(text);
+            p.setFilename(text);
+            p.setFileName(text);
+        } else {
+            assertThrows(IllegalArgumentException.class, () -> p.setComment(text));
+            assertThrows(IllegalArgumentException.class, () -> p.setFilename(text));
+            assertThrows(IllegalArgumentException.class, () -> p.setFileName(text));
+        }
+    }
 }