Consider this logic from tip.
|
n, err = r.rc.Read(b) |
|
r.hash.Write(b[:n]) |
|
r.nread += uint64(n) |
|
if err == nil { |
|
return |
|
} |
The reader only checks file size after all the read of compress file is done, however it's possible that a malformed zip file already overflow during the decompress process.
PoC ( you can setup a malformed zip file for sure) :
func TestUnderSize(t *testing.T) {
z, err := OpenReader("testdata/readme.zip")
if err != nil {
t.Fatal(err)
}
defer z.Close()
for _, f := range z.File {
f.UncompressedSize64 = 1
}
for _, f := range z.File {
rd, err := f.Open()
if err != nil {
t.Fatal(err)
}
defer rd.Close()
_, err = io.Copy(io.Discard, rd)
if err == nil || err != nil && err != ErrFileSize {
t.Fatal(err)
}
}
}We need an easy fail-fast while reading the zip file.
Consider this logic from tip.
go/src/archive/zip/reader.go
Lines 229 to 234 in f7e34e7
The reader only checks file size after all the read of compress file is done, however it's possible that a malformed zip file already overflow during the decompress process.
PoC ( you can setup a malformed zip file for sure) :
We need an easy fail-fast while reading the zip file.