stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8321802: (zipfs) Add validation of incorrect LOC signature in ZipFileSystem

Browse Source 
Reviewed-by: alanb, lancea
This commit is contained in:
Eirik Bjørsnøs 2023-12-22 16:09:22 +00:00
parent 1230853343
commit 93fedc12db
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/jdk.zipfs/share/classes/jdk/nio/zipfs/ZipFileSystem.java
View File

@ -2573,7 +2573,10 @@ class ZipFileSystem extends FileSystem {
pos = -pos + locpos;
byte[] buf = new byte[LOCHDR];
if (readNBytesAt(buf, 0, buf.length, pos) != LOCHDR) {
throw new ZipException("invalid loc " + pos + " for entry reading");
throw new ZipException("invalid LOC " + pos + " for entry reading");
}
if (LOCSIG(buf) != LOCSIG) {
throw new ZipException("invalid LOC header (bad signature)");
}
pos += LOCHDR + LOCNAM(buf) + LOCEXT(buf);
}

12
test/jdk/jdk/nio/zipfs/CorruptedZipFilesTest.java
View File

@ -22,7 +22,7 @@
*/
/* @test
* @bug 8316141
* @bug 8316141 8321802
* @summary test for correct detection and reporting of corrupted zip files
* @run junit CorruptedZipFilesTest
*/
@ -287,6 +287,16 @@ public class CorruptedZipFilesTest {
assertZipException(".*unsupported compression method.*");
}
/*
* A ZipException is thrown when a LOC header has an unexpected signature
*/
@Test
public void invalidLOCSignature() throws IOException {
int existingSignature = buffer.getInt(locpos);
buffer.putInt(locpos, existingSignature +1);
assertZipException(".*bad signature.*");
}
/*
* Assert that opening a ZIP file and consuming the entry's
* InputStream using the ZipFile API fails with a ZipException