I received a private bug report from a user who doesn't want to create an account to
file a bug here.
Unfortunately, the bug report has no repro case.
In summary: in readDirectoryHeader, we can read too far into a zip64 Extra block. The
Extra block is a repeated list of (extra tag + size + extra bytes of declared size).
When we see the extra tag of 1 (zip64ExtraId), we then parse the extra block assuming
the buffer is everything remaining in the file, instead of capping it at the declared
size. That matters, because the Extra field is a variably-sized structure:
Value Size Description
----- ---- -----------
(ZIP64) 0x0001 2 bytes Tag for this "extra" block type
Size 2 bytes Size of this "extra" block
Original
Size 8 bytes Original uncompressed file size
Compressed
Size 8 bytes Size of compressed data
Relative Header
Offset 8 bytes Offset of local header record
Disk Start
Number 4 bytes Number of the disk on which
this file starts
This entry in the Local header MUST include BOTH original
and compressed file size fields. If encrypting the
central directory and bit 13 of the general purpose bit
flag is set indicating masking, the value stored in the
Local Header for the original file size will be zero.
I received a private bug report from a user who doesn't want to create an account to file a bug here. Unfortunately, the bug report has no repro case. In summary: in readDirectoryHeader, we can read too far into a zip64 Extra block. The Extra block is a repeated list of (extra tag + size + extra bytes of declared size). When we see the extra tag of 1 (zip64ExtraId), we then parse the extra block assuming the buffer is everything remaining in the file, instead of capping it at the declared size. That matters, because the Extra field is a variably-sized structure: Value Size Description ----- ---- ----------- (ZIP64) 0x0001 2 bytes Tag for this "extra" block type Size 2 bytes Size of this "extra" block Original Size 8 bytes Original uncompressed file size Compressed Size 8 bytes Size of compressed data Relative Header Offset 8 bytes Offset of local header record Disk Start Number 4 bytes Number of the disk on which this file starts This entry in the Local header MUST include BOTH original and compressed file size fields. If encrypting the central directory and bit 13 of the general purpose bit flag is set indicating masking, the value stored in the Local Header for the original file size will be zero.