unzip: survive lack of CDF on non-streaming zip files

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>

diff --git a/archival/unzip.c b/archival/unzip.c
index c250d7555ba80ca892dc3e04f22ca3250a5fdbe1..673e5fe08e7d109c8f87779a8541865ddc8f8e28 100644 (file)
--- a/archival/unzip.c
+++ b/archival/unzip.c
@@ -172,6 +172,9 @@ enum { zip_fd = 3 };
  */
 #define PEEK_FROM_END (64*1024)
 
+/* This value means that we failed to find CDF */
+#define BAD_CDF_OFFSET ((uint32_t)0xffffffff)
+
 /* NB: does not preserve file position! */
 static uint32_t find_cdf_offset(void)
 {
@@ -187,6 +190,7 @@ static uint32_t find_cdf_offset(void)
        xlseek(zip_fd, end, SEEK_SET);
        full_read(zip_fd, buf, PEEK_FROM_END);
 
+       cde_header.formatted.cdf_offset = BAD_CDF_OFFSET;
        p = buf;
        while (p <= buf + PEEK_FROM_END - CDE_HEADER_LEN - 4) {
                if (*p != 'P') {
@@ -202,11 +206,17 @@ static uint32_t find_cdf_offset(void)
                /* we found CDE! */
                memcpy(cde_header.raw, p + 1, CDE_HEADER_LEN);
                FIX_ENDIANNESS_CDE(cde_header);
-               free(buf);
-               return cde_header.formatted.cdf_offset;
+               /*
+                * I've seen .ZIP files with seemingly valid CDEs
+                * where cdf_offset points past EOF - ??
+                * Ignore such CDEs:
+                */
+               if (cde_header.formatted.cdf_offset < end + (p - buf))
+                       break;
+               cde_header.formatted.cdf_offset = BAD_CDF_OFFSET;
        }
-       //free(buf);
-       bb_error_msg_and_die("can't find file table");
+       free(buf);
+       return cde_header.formatted.cdf_offset;
 };
 
 static uint32_t read_next_cdf(uint32_t cdf_offset, cdf_header_t *cdf_ptr)
@@ -218,13 +228,15 @@ static uint32_t read_next_cdf(uint32_t cdf_offset, cdf_header_t *cdf_ptr)
        if (!cdf_offset)
                cdf_offset = find_cdf_offset();
 
-       xlseek(zip_fd, cdf_offset + 4, SEEK_SET);
-       xread(zip_fd, cdf_ptr->raw, CDF_HEADER_LEN);
-       FIX_ENDIANNESS_CDF(*cdf_ptr);
-       cdf_offset += 4 + CDF_HEADER_LEN
-               + cdf_ptr->formatted.file_name_length
-               + cdf_ptr->formatted.extra_field_length
-               + cdf_ptr->formatted.file_comment_length;
+       if (cdf_offset != BAD_CDF_OFFSET) {
+               xlseek(zip_fd, cdf_offset + 4, SEEK_SET);
+               xread(zip_fd, cdf_ptr->raw, CDF_HEADER_LEN);
+               FIX_ENDIANNESS_CDF(*cdf_ptr);
+               cdf_offset += 4 + CDF_HEADER_LEN
+                       + cdf_ptr->formatted.file_name_length
+                       + cdf_ptr->formatted.extra_field_length
+                       + cdf_ptr->formatted.file_comment_length;
+       }
 
        xlseek(zip_fd, org, SEEK_SET);
        return cdf_offset;
@@ -233,8 +245,9 @@ static uint32_t read_next_cdf(uint32_t cdf_offset, cdf_header_t *cdf_ptr)
 
 static void unzip_skip(off_t skip)
 {
-       if (lseek(zip_fd, skip, SEEK_CUR) == (off_t)-1)
-               bb_copyfd_exact_size(zip_fd, -1, skip);
+       if (skip != 0)
+               if (lseek(zip_fd, skip, SEEK_CUR) == (off_t)-1)
+                       bb_copyfd_exact_size(zip_fd, -1, skip);
 }
 
 static void unzip_create_leading_dirs(const char *fn)
@@ -535,21 +548,31 @@ int unzip_main(int argc, char **argv)
                        bb_error_msg_and_die("zip flag 1 (encryption) is not supported");
                }
 
-               {
+               if (cdf_offset != BAD_CDF_OFFSET) {
                        cdf_header_t cdf_header;
                        cdf_offset = read_next_cdf(cdf_offset, &cdf_header);
+                       /*
+                        * Note: cdf_offset can become BAD_CDF_OFFSET after the above call.
+                        */
                        if (zip_header.formatted.zip_flags & SWAP_LE16(0x0008)) {
                                /* 0x0008 - streaming. [u]cmpsize can be reliably gotten
-                                * only from Central Directory. See unzip_doc.txt */
+                                * only from Central Directory. See unzip_doc.txt
+                                */
                                zip_header.formatted.crc32    = cdf_header.formatted.crc32;
                                zip_header.formatted.cmpsize  = cdf_header.formatted.cmpsize;
                                zip_header.formatted.ucmpsize = cdf_header.formatted.ucmpsize;
                        }
                        if ((cdf_header.formatted.version_made_by >> 8) == 3) {
-                               /* this archive is created on Unix */
+                               /* This archive is created on Unix */
                                dir_mode = file_mode = (cdf_header.formatted.external_file_attributes >> 16);
                        }
                }
+               if (cdf_offset == BAD_CDF_OFFSET
+                && (zip_header.formatted.zip_flags & SWAP_LE16(0x0008))
+               ) {
+                       /* If it's a streaming zip, we _require_ CDF */
+                       bb_error_msg_and_die("can't find file table");
+               }
 #endif
 
                /* Read filename */