8314891: Additional Zip64 extra header validation #15650

LanceAndersen · 2023-09-09T14:33:53Z

Please review this PR which improves the Zip64 extra header validation:

Throw a ZipException If the extra len field is 0 and :
-- size, csize, or loc offset are set to 0xFFFFFFFF
-- disk starting number is set to 0xFFFF
We have a valid size for the Zip64 extra header but we are missing the csize or loc fields if they are expected to be part of the header

Mach5 tiers 1-3 are clean

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8314891: Additional Zip64 extra header validation (Bug - P4)

Reviewers

Sean Coffey (@coffeys - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/15650/head:pull/15650
$ git checkout pull/15650

Update a local copy of the PR:
$ git checkout pull/15650
$ git pull https://git.openjdk.org/jdk.git pull/15650/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 15650

View PR using the GUI difftool:
$ git pr show -t 15650

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/15650.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2023-09-09T14:34:51Z

👋 Welcome back lancea! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-09-09T14:36:48Z

@LanceAndersen The following labels will be automatically applied to this pull request:

core-libs
nio

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing lists. If you would like to change these labels, use the /label pull request command.

mlbridge · 2023-09-09T14:41:11Z

Webrevs

mrserb · 2023-09-11T23:42:37Z

test/jdk/java/util/zip/ZipFile/MissingZIP64EntriesTest.java

+ * and the CEN size, csize,LOC offset fields are set to 0xFFFFFFFF, the disk
+ * starting number is set to 0xFFFF or when we have a valid Zip64 Extra header
+ * size but missing the corresponding field.
+ * @run junit MissingZIP64EntriesTest


Is this comment accurate? I think we should check 3 cases when the header extra len == 0, len == 8 and len ==16, but still do not contain all required information.

Clarified the comment to make it a bit clearer and also added additional tests

turbanoff · 2023-09-12T08:47:03Z

test/jdk/java/util/zip/ZipFile/MissingZIP64EntriesTest.java

+     * Value to set the Disk Start number offset CEN field to when the
+     * actual value is stored in the Zip64 Extra Header
+     */
+    private static final int  ZIP64_MAGICCOUNT = 0xFFFF;


Suggested change

private static final int ZIP64_MAGICCOUNT = 0xFFFF;

private static final int ZIP64_MAGICCOUNT = 0xFFFF;

Removed the extra space. thank you for pointing it out

bridgekeeper · 2023-10-16T19:21:18Z

@LanceAndersen This pull request has been inactive for more than 4 weeks and will be automatically closed if another 4 weeks passes without any activity. To avoid this, simply add a new comment to the pull request. Feel free to ask for assistance if you need help with progressing this pull request towards integration!

coffeys

Looks good to me Lance. I note that the extra checks aren't reversed via any sort of system property but given that this fix isn't planned for JDK update releases, that seems fine to me.

early testing by frameworks which create/modify custom zip files will be important.

openjdk · 2023-10-18T15:35:24Z

@LanceAndersen This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8314891: Additional Zip64 extra header validation

Reviewed-by: coffeys

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been no new commits pushed to the master branch. If another commit should be pushed before you perform the /integrate command, your PR will be automatically rebased. If you prefer to avoid any potential automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

LanceAndersen · 2023-11-07T16:50:16Z

/integrate

openjdk · 2023-11-07T16:52:24Z

Going to push as commit 8274713.
Since your change was applied there have been 197 commits pushed to the master branch:

0dcd730: 8318594: NMT: VM.native_memory crashes on assert if functionality isn't supported by OS
45e68ae: 8319532: jshell - Non-sealed declarations sometimes break a snippet evaluation
4a0ad46: 8317937: @sealedGraph: Links to inner classes fails in links
134c382: 8319560: Reformat method parameters in the FFM API
ef8c840: 8319607: FFM: Review the language in the FFM documentation
bf9a93d: 8319204: G1: Change G1CMTask::_termination_time_ms to wallclock time
b2504a0: 8319525: RISC-V: Rename *_riscv64.ad files to *_riscv.ad under riscv/gc
bfafb27: 8319615: IGV incomplete gitignore
c760097: 8319541: G1: Inline G1RemoveSelfForwardsTask into RestoreRetainedRegionsTask
85e4cde: 8319620: Parallel: Remove unused PSPromotionManager::*_is_full getters and setters
... and 187 more: https://git.openjdk.org/jdk/compare/8d9a4b43f4fff30fd217dab2c224e641cb913c18...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-11-07T16:52:30Z

@LanceAndersen Pushed as commit 8274713.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

eirbjo · 2023-11-08T16:27:56Z

@LanceAndersen

I noticed that this PR did not update ZipInputStream.readLOC to perform consistency validation between expected and actual extra field size and values. Any particular reason why processing of LOC headers was not made consistent with CEN?

LanceAndersen · 2023-11-08T17:27:19Z

@LanceAndersen

I noticed that this PR did not update ZipInputStream.readLOC to perform consistency validation between expected and actual extra field size and values. Any particular reason why processing of LOC headers was not made consistent with CEN?

Intentional, as this was a follow on to the updates which were done previously to the CEN work in August, this is follow on cleanup.

Updates to ZipInputStream would be done separately under a separate PR or could be done via your work on 8303866

Foorcee · 2024-05-13T15:10:39Z

Hey @LanceAndersen,

It was a common practice in obfuscation, to create zips with invalid headers. This change leads to a behavioral change that affects existing work processes. Would it be possible to add an system property to restore the old behavior?

LanceAndersen added 2 commits September 9, 2023 09:56

Additional Zip64 extra header validation

ad0af7c

Clean up some minor formatting issues

bb962fc

LanceAndersen marked this pull request as ready for review September 9, 2023 14:34

openjdk bot added the rfr Pull request is ready for review label Sep 9, 2023

openjdk bot added nio nio-dev@openjdk.org core-libs core-libs-dev@openjdk.org labels Sep 9, 2023

mrserb reviewed Sep 11, 2023

View reviewed changes

turbanoff reviewed Sep 12, 2023

View reviewed changes

Added additional tests, along with additional cleanup and refactoring

40504b2

openjdk bot removed the rfr Pull request is ready for review label Sep 14, 2023

Remove tab(s) from comment

24b159d

openjdk bot added the rfr Pull request is ready for review label Sep 14, 2023

LanceAndersen added 4 commits September 17, 2023 07:11

Merge branch 'master' into JDK-8314891

afc9d7d

Merge branch 'master' into JDK-8314891

f64a70c

Revamp isZip64ExtBlockSizeValid

bbc5325

Add missing space

208a5ec

coffeys approved these changes Oct 18, 2023

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Oct 18, 2023

Merge branch 'master' into JDK-8314891

255aec8

LanceAndersen mentioned this pull request Oct 28, 2023

8303866: Allow ZipInputStream.readEnd to parse small Zip64 ZIP files #12524

Closed

4 tasks

openjdk bot added the integrated Pull request has been integrated label Nov 7, 2023

openjdk bot closed this Nov 7, 2023

openjdk bot removed the ready Pull request is ready to be integrated label Nov 7, 2023

openjdk bot removed the rfr Pull request is ready for review label Nov 7, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8314891: Additional Zip64 extra header validation #15650

8314891: Additional Zip64 extra header validation #15650

LanceAndersen commented Sep 9, 2023 •

edited by openjdk bot

Loading

bridgekeeper bot commented Sep 9, 2023

openjdk bot commented Sep 9, 2023

mlbridge bot commented Sep 9, 2023 •

edited

Loading

mrserb Sep 11, 2023

LanceAndersen Sep 14, 2023

turbanoff Sep 12, 2023

LanceAndersen Sep 14, 2023

bridgekeeper bot commented Oct 16, 2023

coffeys left a comment

openjdk bot commented Oct 18, 2023 •

edited

Loading

LanceAndersen commented Nov 7, 2023

openjdk bot commented Nov 7, 2023

openjdk bot commented Nov 7, 2023

eirbjo commented Nov 8, 2023

LanceAndersen commented Nov 8, 2023

Foorcee commented May 13, 2024 •

edited by bridgekeeper bot

Loading

	private static final int ZIP64_MAGICCOUNT = 0xFFFF;
	private static final int ZIP64_MAGICCOUNT = 0xFFFF;

8314891: Additional Zip64 extra header validation #15650

8314891: Additional Zip64 extra header validation #15650

Conversation

LanceAndersen commented Sep 9, 2023 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

Webrev

bridgekeeper bot commented Sep 9, 2023

openjdk bot commented Sep 9, 2023

mlbridge bot commented Sep 9, 2023 • edited Loading

Webrevs

mrserb Sep 11, 2023

Choose a reason for hiding this comment

LanceAndersen Sep 14, 2023

Choose a reason for hiding this comment

turbanoff Sep 12, 2023

Choose a reason for hiding this comment

LanceAndersen Sep 14, 2023

Choose a reason for hiding this comment

bridgekeeper bot commented Oct 16, 2023

coffeys left a comment

Choose a reason for hiding this comment

openjdk bot commented Oct 18, 2023 • edited Loading

LanceAndersen commented Nov 7, 2023

openjdk bot commented Nov 7, 2023

openjdk bot commented Nov 7, 2023

eirbjo commented Nov 8, 2023

LanceAndersen commented Nov 8, 2023

Foorcee commented May 13, 2024 • edited by bridgekeeper bot Loading

LanceAndersen commented Sep 9, 2023 •

edited by openjdk bot

Loading

mlbridge bot commented Sep 9, 2023 •

edited

Loading

openjdk bot commented Oct 18, 2023 •

edited

Loading

Foorcee commented May 13, 2024 •

edited by bridgekeeper bot

Loading