This is an automated email from the ASF dual-hosted git repository. garydgregory pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/commons-compress.git
commit 11966f2bea2fbcfe6fc5deede5398f5b821b3e0e Author: Gary Gregory <[email protected]> AuthorDate: Sun Aug 9 08:07:43 2026 -0400 Reject negative ZIP64 offsets in positionAtCentralDirectory64 (#794). Reduce copy-pasta. --- .../commons/compress/archivers/zip/ZipFile.java | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java b/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java index 01273063a..e43267b69 100644 --- a/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java +++ b/src/main/java/org/apache/commons/compress/archivers/zip/ZipFile.java @@ -585,6 +585,12 @@ private static boolean positionAtEndOfCentralDirectoryRecord(final SeekableByteC return found64; } + private static void requireNonNegative(final long value, final String message) throws ArchiveException { + if (value < 0) { + throw new ArchiveException(message); + } + } + /** * Converts a raw version made by int to a <a href="https://pkwaredownloads.blob.core.windows.net/pkware-general/Documentation/APPNOTE_6.2.0.TXT";>platform * code</a>. @@ -1417,18 +1423,14 @@ private void positionAtCentralDirectory64() throws IOException { dwordBbuf.rewind(); IOUtils.readFully(archive, dwordBbuf); final long relativeOffsetOfEOCD = ZipEightByteInteger.getLongValue(dwordBuf); - if (relativeOffsetOfEOCD < 0) { - throw new ArchiveException("Broken archive, ZIP64 end of central directory locator with negative offset"); - } + requireNonNegative(relativeOffsetOfEOCD, "Broken archive, ZIP64 end of central directory locator with negative offset"); ((ZipSplitReadOnlySeekableByteChannel) archive).position(diskNumberOfEOCD, relativeOffsetOfEOCD); } else { skipBytes(ZIP64_EOCDL_LOCATOR_OFFSET - ZipConstants.WORD /* signature has already been read */); dwordBbuf.rewind(); IOUtils.readFully(archive, dwordBbuf); final long relativeOffsetOfEOCD = ZipEightByteInteger.getLongValue(dwordBuf); - if (relativeOffsetOfEOCD < 0) { - throw new ArchiveException("Broken archive, ZIP64 end of central directory locator with negative offset"); - } + requireNonNegative(relativeOffsetOfEOCD, "Broken archive, ZIP64 end of central directory locator with negative offset"); archive.position(relativeOffsetOfEOCD); } @@ -1449,9 +1451,7 @@ private void positionAtCentralDirectory64() throws IOException { dwordBbuf.rewind(); IOUtils.readFully(archive, dwordBbuf); centralDirectoryStartRelativeOffset = ZipEightByteInteger.getLongValue(dwordBuf); - if (centralDirectoryStartRelativeOffset < 0) { - throw new ArchiveException("Broken archive, ZIP64 end of central directory record with negative central directory offset"); - } + requireNonNegative(centralDirectoryStartRelativeOffset, "Broken archive, ZIP64 end of central directory record with negative central directory offset"); ((ZipSplitReadOnlySeekableByteChannel) archive).position(centralDirectoryStartDiskNumber, centralDirectoryStartRelativeOffset); } else { skipBytes(ZIP64_EOCD_CFD_LOCATOR_OFFSET - ZipConstants.WORD /* signature has already been read */); @@ -1459,9 +1459,7 @@ private void positionAtCentralDirectory64() throws IOException { IOUtils.readFully(archive, dwordBbuf); centralDirectoryStartDiskNumber = 0; centralDirectoryStartRelativeOffset = ZipEightByteInteger.getLongValue(dwordBuf); - if (centralDirectoryStartRelativeOffset < 0) { - throw new ArchiveException("Broken archive, ZIP64 end of central directory record with negative central directory offset"); - } + requireNonNegative(centralDirectoryStartRelativeOffset, "Broken archive, ZIP64 end of central directory record with negative central directory offset"); archive.position(centralDirectoryStartRelativeOffset); } }
