> Please review this PR which adds validation of the 'total entries' value when > fetched from the 'ZIP64 End of Central Directory' header. > > We should reject this value under the following conditions: > > 1. It is too large to fit within the specified CEN size (considering each CEN > header encodes as at least 46 bytes each) > 2. It is too large to create the `int[] entries` array safely (max value is > `ArraysSupport.SOFT_MAX_ARRAY_LENGTH / 3`) > > I claim that condition 2 here is already implicitly validated by the current > maximum CEN size validation. (A CEN encoding such a large number of entries > would exceed the maximum CEN size a lot and would already be rejected) > > This change aims to protect the integrity of the implementation against > specially crafted ZIP files. No sane ZIP tool will produce such files. > > Testing: > > This PR adds a test `EndOfCenValidation.shouldRejectBadTotalEntries` which > exercises the first condition above. > > ZIP tests run locally. GHA results pending.
Eirik Bjørsnøs has updated the pull request incrementally with two additional commits since the last revision: - Reject "negative" 'total entries' values - Convert EndOfCenValidation to JUnit 5 ------------- Changes: - all: https://git.openjdk.org/jdk/pull/21384/files - new: https://git.openjdk.org/jdk/pull/21384/files/ccfa56e4..0f0801c4 Webrevs: - full: https://webrevs.openjdk.org/?repo=jdk&pr=21384&range=02 - incr: https://webrevs.openjdk.org/?repo=jdk&pr=21384&range=01-02 Stats: 29 lines in 2 files changed: 9 ins; 0 del; 20 mod Patch: https://git.openjdk.org/jdk/pull/21384.diff Fetch: git fetch https://git.openjdk.org/jdk.git pull/21384/head:pull/21384 PR: https://git.openjdk.org/jdk/pull/21384
