https://bugs.kde.org/show_bug.cgi?id=450597

Stefan Brüns <stefan.bru...@rwth-aachen.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Latest Commit|                            |https://invent.kde.org/fram
                   |                            |eworks/karchive/-/commit/6d
                   |                            |b83e409131de9f3e00ae18a1cd6
                   |                            |113250f9611
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Stefan Brüns <stefan.bru...@rwth-aachen.de> ---
Git commit 6db83e409131de9f3e00ae18a1cd6113250f9611 by Stefan Brüns.
Committed on 30/03/2025 at 19:03.
Pushed by bruns into branch 'master'.

kzip: Fix misdetection of nested signatures, handle Zip64 data descriptors

In case a zip file entry has an undetermined size in the local header
the end of the binary data is marked by a data descriptor, with
signature 'PK\7\8'.

This will occasionally fail for two different reasons:
1. Compressed data randomly matching the signature
2. Stored, nested ZIP files.

In the first case, almost any sanity check for the following data
will do.

In the second case, the 'compressed size' field of the data descriptor
will not match the current position difference. Only for the data
descriptor of the outer ZIP file (start position + uncompressed size ==
current position) will match.

Also fix the size of the Zip64 data descriptors, and skip to the next
header correctly. Zip64 data descriptors are marked by a "needed version"
of 45 or later in the preceding local header.

The header seeking is mostly rewritten. Instead of seeking backwards
and forwards, and reading one character at a time from the underlying
QIODevice, a larger block is read using peek(). Scanning through
the block for a 'PK' signature is significantly faster than the
one-byte-at-a-time approach.

M  +0    -2    autotests/karchivetest.cpp
M  +92   -79   src/kzip.cpp

https://invent.kde.org/frameworks/karchive/-/commit/6db83e409131de9f3e00ae18a1cd6113250f9611

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to