archive/zip: invalid zip64 extra fields as per strict interpretation of APPNOTE.TXT

[ghost]

What version of Go are you using (go version)?

Looking at git master (currently d85a353 of writer.go)

Description

There seems to be an error in archive/zip/writer.go when creating a zip64 extra field when the local header offset is less than UINT32_MAX (e.g. for the first file in the central directory).

https://github.com/golang/go/blob/master/src/archive/zip/writer.go#L114 writes the 64-bit offset of the local header to the zip64 extra field even if the 32-bit offset written at https://github.com/golang/go/blob/master/src/archive/zip/writer.go#L129 isn't equal to 0xFFFFFFFF.

According to APPNOTE.TXT, this isn't allowed as per:

      The order of the fields in the zip64 extended 
      information record is fixed, but the fields MUST
      only appear if the corresponding Local or Central
      directory record field is set to 0xFFFF or 0xFFFFFFFF.

While Info-ZIP and other implementations may not care about extraneous fields, Microsoft's implementation explodes accordingly at https://referencesource.microsoft.com/#WindowsBase/Base/MS/Internal/IO/Zip/ZipIOExtraFieldZip64Element.cs,120 because it won't expect the field by this logic https://referencesource.microsoft.com/#WindowsBase/Base/MS/Internal/IO/Zip/ZipIOCentralDirectoryFileHeader.cs,92

Proposed solution

Change https://github.com/golang/go/blob/master/src/archive/zip/writer.go#L126 to say:

	if h.isZip64() || h.offset > uint32max {

instead of

	if h.offset > uint32max {

to mimic the logic some lines above that decides when to write the zip64 extra field at all.

This seems to be the minimal change to fix the issue, otherwise the extra field might need to vary in size.

P.S. thanks to archive/zip authors for providing a readable reference

[bradfitz]

Is this a regression from Go 1.9?

Do you have sample code / test demonstrating the problem, or is this just from reading the code? Please provide a repo to double check there's a problem.

/cc @dsnet

[ghost]

This is probably not a regression and has always been slightly wrong.

I am only judging from reading the code of archive/zip and MS.Internal.IO.Zip in parallel.
I'm sorry, I'm not quite willing to spend more time on this. This is a heads-up.

[dsnet]

Thanks for the heads up, I'll take a look in the Go1.11 cycle.

[ianlancetaylor]

@dsnet Please update milestone. Thanks.

[dsnet]

Possibility of bug, but not a regression. Bumping to Go1.12.