Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

weak encryption + streaming does not set local CRC value to zero #20

Closed
pmqs opened this issue Apr 29, 2024 · 0 comments
Closed

weak encryption + streaming does not set local CRC value to zero #20

pmqs opened this issue Apr 29, 2024 · 0 comments
Assignees
Labels
bug Something isn't working

Comments

@pmqs
Copy link
Owner

pmqs commented Apr 29, 2024

appnote section 4.4.4 says this about the CRC value when streaming is enabled

    Bit 3: If this bit is set, the fields crc-32, compressed 
           size and uncompressed size are set to zero in the 
           local header.  The correct values are put in the 
           data descriptor immediately following the compressed
           data.  (Note: PKZIP version 2.04g for DOS only 
           recognizes this bit for method 8 compression, newer 
           versions of PKZIP recognize this bit for any 
           compression method.)

In practice, if weak encryption is enabled along with streaming, the CRC value is not set to set to zero. Below is from Info-ZIP source code where it sets the CRC value when weak encryption is enabled

        /* Traditional encryption with an extended header implies that
          * we use (the low 16 bits of) the MS-DOS modification time
          * instead of the real (unknown) CRC as the "CRC" for the
          * pseudo-random seed datum.  (The high 16 bits of the "CRC"
          * are used in the Traditional encryption header.)
          *
          * This use of file time as the CRC and then use of a data
          * descriptor to hold the CRC is not standard, but is readable
          * by various utilities out there.  We do it this way to avoid
          * reading a file more than once and to support streaming.

The zipdetails code currently expects the appnote behaviour. That needs to change so that it uses the de-facto standard that is used by the implementations.

@pmqs pmqs added the bug Something isn't working label Apr 29, 2024
@pmqs pmqs self-assigned this Apr 29, 2024
@pmqs pmqs closed this as completed Apr 30, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant