Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[3.11] gh-103861: Fix Zip64 extensions not being properly applied in some cases (GH-103863) #104534

Merged
merged 1 commit into from
May 17, 2023

Conversation

gpshead
Copy link
Member

@gpshead gpshead commented May 16, 2023

Fix Zip64 extensions not being properly applied in some cases:

Fixes an issue where adding a small file to a ZipFile object while forcing zip64 extensions causes an extra Zip64 record to be added to the zip, but doesn't update the min_version or file sizes in the primary central directory header.

Also fixed an edge case in checking if zip64 extensions are required:

This fixes an issue where if data requiring zip64 extensions was added to an unseekable stream without specifying force_zip64=True, zip64 extensions would not be used and a RuntimeError would not be raised when closing the file (even though the size would be known at that point). This would result in successfully writing corrupt zip files.

Deciding if zip64 extensions are required outside of the FileHeader function means that both FileHeader and _ZipWriteFile will always be in sync. Previously, the FileHeader function could enable zip64 extensions without propagating that decision to the _ZipWriteFile class, which would then not correctly write the data descriptor record or check for errors on close.

If anyone is actually using ZipInfo.FileHeader as a public API without explicitly passing True or False in for zip64, their own code may still be susceptible to that kind of bug unless they make a similar change to where the zip64 decision happens.

Fixes GH-103861


(cherry picked from commit 798bcaa)

…ed in some cases (pythonGH-103863)

Fix Zip64 extensions not being properly applied in some cases:

Fixes an issue where adding a small file to a `ZipFile`
object while forcing zip64 extensions causes an extra Zip64 record to be
added to the zip, but doesn't update the `min_version` or file sizes in
the primary central directory header.

Also fixed an edge case in checking if zip64 extensions are required:

This fixes an issue where if data requiring zip64 extensions was added
to an unseekable stream without specifying `force_zip64=True`, zip64
extensions would not be used and a RuntimeError would not be raised when
closing the file (even though the size would be known at that point).
This would result in successfully writing corrupt zip files.

Deciding if zip64 extensions are required outside of the `FileHeader`
function means that both `FileHeader` and `_ZipWriteFile` will always be
in sync. Previously, the `FileHeader` function could enable zip64
extensions without propagating that decision to the `_ZipWriteFile`
class, which would then not correctly write the data descriptor record
or check for errors on close.

If anyone is actually using `ZipInfo.FileHeader` as a public API without
explicitly passing True or False in for zip64, their own code may still be
susceptible to that kind of bug unless they make a similar change to
where the zip64 decision happens.

Fixes pythonGH-103861

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>.
(cherry picked from commit 798bcaa)

Co-authored-by: Carey Metcalfe <carey@cmetcalfe.ca>
@gpshead gpshead added the type-bug An unexpected behavior, bug, or error label May 16, 2023
@gpshead gpshead self-assigned this May 16, 2023
@gpshead gpshead changed the title [3.11] gh-103861: Fix Zip64 extensions not being properly applied in some cases [3.11] gh-103861: Fix Zip64 extensions not being properly applied in some cases (GH-103863) May 16, 2023
@gpshead gpshead merged commit 133bf09 into python:3.11 May 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
sprint type-bug An unexpected behavior, bug, or error
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants