archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 06:45:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8316141: Improve CEN header validation checking

Browse source 
Reviewed-by: alanb
This commit is contained in:
Lance Andersen 2023-12-08 16:37:53 +00:00
parent b893a2b2f7
commit 0eb299af79
4 changed files with 331 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/java.base/share/classes/java/util/zip/ZipFile.java
View file

@ -1222,16 +1222,17 @@ public class ZipFile implements ZipConstants, Closeable {
int nlen = CENNAM(cen, pos);
int elen = CENEXT(cen, pos);
int clen = CENCOM(cen, pos);
if (entryPos + nlen > cen.length - ENDHDR) {
long headerSize = (long)CENHDR + nlen + clen + elen;
// CEN header size + name length + comment length + extra length
// should not exceed 65,535 bytes per the PKWare APP.NOTE
// 4.4.10, 4.4.11, & 4.4.12. Also check that current CEN header will
// not exceed the length of the CEN array
if (headerSize > 0xFFFF || pos + headerSize > cen.length - ENDHDR) {
zerror("invalid CEN header (bad header size)");
}
if (elen > 0 && !DISABLE_ZIP64_EXTRA_VALIDATION) {
long extraStartingOffset = pos + CENHDR + nlen;
if ((int)extraStartingOffset != extraStartingOffset) {
zerror("invalid CEN header (bad extra offset)");
}
checkExtraFields(pos, (int)extraStartingOffset, elen);
checkExtraFields(pos, entryPos + nlen, elen);
} else if (elen == 0 && (CENSIZ(cen, pos) == ZIP64_MAGICVAL
|| CENLEN(cen, pos) == ZIP64_MAGICVAL
|| CENOFF(cen, pos) == ZIP64_MAGICVAL
@ -1292,7 +1293,7 @@ public class ZipFile implements ZipConstants, Closeable {
int tagBlockSize = get16(cen, currentOffset);
currentOffset += Short.BYTES;
int tagBlockEndingOffset = currentOffset + tagBlockSize;
long tagBlockEndingOffset = (long)currentOffset + tagBlockSize;
// The ending offset for this tag block should not go past the
// offset for the end of the extra field