diff options
| -rw-r--r-- | libziparchive/testdata/declaredlength.zip | bin | 0 -> 886 bytes | |||
| -rw-r--r-- | libziparchive/zip_archive.cc | 2 | ||||
| -rw-r--r-- | libziparchive/zip_archive_test.cc | 16 |
3 files changed, 17 insertions, 1 deletions
diff --git a/libziparchive/testdata/declaredlength.zip b/libziparchive/testdata/declaredlength.zip Binary files differnew file mode 100644 index 0000000..773380c --- /dev/null +++ b/libziparchive/testdata/declaredlength.zip diff --git a/libziparchive/zip_archive.cc b/libziparchive/zip_archive.cc index e820f2a..6475649 100644 --- a/libziparchive/zip_archive.cc +++ b/libziparchive/zip_archive.cc @@ -824,7 +824,7 @@ static int32_t FindEntry(const ZipArchive* archive, const int ent, // name in the central directory. if (lfh->file_name_length == nameLen) { const off64_t name_offset = local_header_offset + sizeof(LocalFileHeader); - if (name_offset + lfh->file_name_length >= cd_offset) { + if (name_offset + lfh->file_name_length > cd_offset) { ALOGW("Zip: Invalid declared length"); return kInvalidOffset; } diff --git a/libziparchive/zip_archive_test.cc b/libziparchive/zip_archive_test.cc index c8dafa9..64faa6d 100644 --- a/libziparchive/zip_archive_test.cc +++ b/libziparchive/zip_archive_test.cc @@ -171,6 +171,22 @@ TEST(ziparchive, FindEntry) { CloseArchive(handle); } +TEST(ziparchive, TestInvalidDeclaredLength) { + ZipArchiveHandle handle; + ASSERT_EQ(0, OpenArchiveWrapper("declaredlength.zip", &handle)); + + void* iteration_cookie; + ASSERT_EQ(0, StartIteration(handle, &iteration_cookie, NULL)); + + ZipEntryName name; + ZipEntry data; + + ASSERT_EQ(Next(iteration_cookie, &data, &name), 0); + ASSERT_EQ(Next(iteration_cookie, &data, &name), 0); + + CloseArchive(handle); +} + TEST(ziparchive, ExtractToMemory) { ZipArchiveHandle handle; ASSERT_EQ(0, OpenArchiveWrapper(kValidZip, &handle)); |