zipfile should reject inconsistent disk information in EOCDR
还没有人认领这个 Issue。
- 主要语言
- Python
- 星标
- 77.2k
- 派生
- 35.9k
- PR 合并指标
- PR 指标待抓取
描述
Bug report
Bug description:
zipfile is explicitly documented as not handling multipart (i.e. multi-disk) ZIPs.
However, zipfile also does not check the EOCDR's state for consistency with that invariant.
Two fields are relevant (offsets are relative to the start of the EOCDR):
- "number of this disk" (offset 4, size 2)
- "number of the disk with the start of the central directory" (offset 6, size 2)
In zipfile's model, both of these should always be 0, since there's exactly one "disk."
However, at the moment, zipfile appears to silently ignore these fields and allows a parse even when they're incoherent or inconsistent with each other. For example:
import io
import struct
import zipfile
archive = io.BytesIO()
with zipfile.ZipFile(archive, "w") as zipf:
zipf.writestr("entry.txt", b"payload")
data = bytearray(archive.getvalue())
eocd = data.rfind(zipfile.stringEndArchive)
struct.pack_into("<H", data, eocd + 4, 1)
with zipfile.ZipFile(io.BytesIO(data)) as zipf:
print(zipf.namelist())
This exposes ['entry.txt'], whereas other parsers (Rust's zip and async_zip, Info-ZIP, and 7-ZIP) reject the ZIP as malformed.
CPython versions tested on:
CPython main branch
Operating systems tested on:
No response
Linked PRs
- gh-155814
贡献指南
从这里开始
- 先读完整个 Issue,再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库,在一个分支上完成修改。
- 提交 Pull Request,并在描述里引用这个 Issue 编号。
调研方向
首先重现 issue 中的 BytesIO 示例,并跟踪 zipfile 对 EOCDR 的解析,重点关注偏移量 4 和 6 处的两个磁盘编号字段。当包含非零或不一致磁盘信息的格式错误归档被拒绝,而不是被成功解析时,即表示完成;issue 链接了 PR gh-155814,以跟进正在进行的工作。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- backend
- Issue 类型
- 缺陷
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 35/100