CVE-2024-26308: Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

The vulnerability is an OutOfMemoryError caused by improper handling of malformed Pack200 attributes. The identified commit (90a4d8b3e6bc261af0196ea356f974111001fd15) directly addresses this by adding end-of-stream checks in several methods within the NewAttributeBands class, in both the pack200 and unpack200 harmony packages. These methods are responsible for parsing attribute layouts from a StringReader. Without these checks, malformed input could cause these methods to loop indefinitely or read excessive amounts of data, leading to the OutOfMemoryError. The patch ensures that reading stops when the end of the input stream is encountered, mitigating the vulnerability. The test case Compress626Test.java was also modified to assert that these operations do not throw an exception with a crafted input, confirming the fix.