archive/zip: treat truncated EOCDR comment as an error

When scanning for an end of central directory record,
treat an EOCDR signature with a record containing a truncated
comment as an error. Previously, we would skip over the invalid
record and look for another one. Other implementations do not
do this (they either consider this a hard error, or just ignore
the truncated comment). This parser misalignment allowed
presenting entirely different archive contents to Go programs
and other zip decoders.

Fixes #66869

Change-Id: I94e5cb028534bb5704588b8af27f1e22ea49c7c6
Reviewed-on: https://go-review.googlesource.com/c/go/+/585397
Reviewed-by: Joseph Tsai <joetsai@digital-static.net>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

diff --git a/src/archive/zip/reader.go b/src/archive/zip/reader.go
index ff6fedf632a09e862fd12271d6529c97b2a6ec67..60b34b76ee63cc78b66607d8804f3202cac6d485 100644 (file)
--- a/src/archive/zip/reader.go
+++ b/src/archive/zip/reader.go
@@ -699,9 +699,13 @@ func findSignatureInBlock(b []byte) int {
                if b[i] == 'P' && b[i+1] == 'K' && b[i+2] == 0x05 && b[i+3] == 0x06 {
                        // n is length of comment
                        n := int(b[i+directoryEndLen-2]) | int(b[i+directoryEndLen-1])<<8
-                       if n+directoryEndLen+i <= len(b) {
-                               return i
+                       if n+directoryEndLen+i > len(b) {
+                               // Truncated comment.
+                               // Some parsers (such as Info-ZIP) ignore the truncated comment
+                               // rather than treating it as a hard error.
+                               return -1
                        }
+                       return i
                }
        }
        return -1

diff --git a/src/archive/zip/reader_test.go b/src/archive/zip/reader_test.go
index 9f651da53070a66876a963c84d60439cceeadcac..00e5ec3e0586103fbb6a1767e00ceb8b20c2033b 100644 (file)
--- a/src/archive/zip/reader_test.go
+++ b/src/archive/zip/reader_test.go
@@ -570,6 +570,14 @@ var tests = []ZipTest{
                        },
                },
        },
+       // Issue 66869: Don't skip over an EOCDR with a truncated comment.
+       // The test file sneakily hides a second EOCDR before the first one;
+       // previously we would extract one file ("file") from this archive,
+       // while most other tools would reject the file or extract a different one ("FILE").
+       {
+               Name:  "comment-truncated.zip",
+               Error: ErrFormat,
+       },
 }
 
 func TestReader(t *testing.T) {

diff --git a/src/archive/zip/testdata/comment-truncated.zip b/src/archive/zip/testdata/comment-truncated.zip
new file mode 100644 (file)
index 0000000..1bc19a8
Binary files /dev/null and b/src/archive/zip/testdata/comment-truncated.zip differ