Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

archive/zip: ignore malformed Zip64 info in Extra field #13367

Closed
ghost opened this issue Nov 23, 2015 · 3 comments
Closed

archive/zip: ignore malformed Zip64 info in Extra field #13367

ghost opened this issue Nov 23, 2015 · 3 comments

Comments

@ghost
Copy link

ghost commented Nov 23, 2015

Some zip packers seem to put bogus value 8 in the Zip64 extended information extra field's size, which results in the reader returning ErrFormat errors for all the archived files after the first 4 GiB. Both zip 3.x and unzip 6.x, on the other hand, see no problem with such archives, because they ignore the specified size of the zip64 extra block and just read the compressed size, uncompressed size and the local header offset if the corresponding values in the local or central directory record are set to 0xffff or 0xffffffff. This is in accordance with the spec:

The order of the fields in the zip64 extended information record is fixed, but the fields MUST only appear if the corresponding Local or Central directory record field is set to 0xFFFF or 0xFFFFFFFF.

archive/zip doesn't check this, assuming that the specified size is correct and reading the UncompressedSize64, CompressedSize64 and headerOffset one by one as though they all must be there. It should instead check if the CompressedSize, UncompressedSize and previously read headerOffset are set to 0xffffffff, and then and only then read the corresponding 64-bit values; the specified size of the zip64 extra block should be ignored.

@bradfitz
Copy link
Contributor

@opennota, I've deleted your comment with a link to your implementation because you don't appear to have signed a CLA yet. See https://golang.org/doc/contribute.html#copyright

Please upload a fix to Gerrit using https://golang.org/doc/contribute.html#Code_review

Thanks!

@rsc rsc changed the title archive/zip: reader should ignore possibly bogus size of a Zip64 extended information extra field archive/zip: ignore malformed Zip64 info in Extra field Dec 28, 2015
@rsc rsc added this to the Go1.6Maybe milestone Dec 28, 2015
@rsc
Copy link
Contributor

rsc commented Dec 28, 2015

See also #13166.

@gopherbot
Copy link

CL https://golang.org/cl/18317 mentions this issue.

@rsc rsc closed this as completed in 4aedbf5 Jan 7, 2016
@golang golang locked and limited conversation to collaborators Jan 7, 2017
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

3 participants