[COMPRESS-585] ZipFile fails to read a zipfile with a comment or extra data longer than 8024 bytes

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.21
• Component/s: Archivers
• Assignee: Unassigned
• Reporter: Matthijs Laan
• Created: 03/Aug/21 11:01
• Updated: 13/Sep/21 11:46
• Resolved: 13/Sep/21 11:46

Description

See the attached patch for a unit test demonstrating the issue with a long comment.

The cause is that ZipFile.readCentralDirectoryEntry() calls IOUtils.readRange() and assumes if it returns less than the length it asked for that the EOF is reached, however this is not how that method works: it returns max COPY_BUF_SIZE bytes (8024), even if EOF has not been reached.

Besides comments and extra data (in the central directory or local file header) longer than 8024 bytes the only other place readRange() is called is reading filenames, but that seems like a remote edge case and an EOF exception is fine.

The IOUtils.readRange() JavaDoc does not specify how it communicates EOF. With a blocking channel this would be when it returns a zero length array. It could throw an exception when Channel.read() returns 0 bytes, because that only happens on non-blocking channels.