Skip to content

gh-83245: Raise BadZipFile instead of ValueError when reading a corrupt file #32291

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
serhiy-storchaka merged 11 commits into from
May 23, 2022
+15 −0
Merged

gh-83245: Raise BadZipFile instead of ValueError when reading a corrupt file #32291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
eb1935d
bpo-39064: make ZipFile raise BadZipFile instead of ValueError when r…
iritkatriel Jan 24, 2022
dc87047
Test that BadZipFile is raised when central directory offset is negative
dignissimus Apr 3, 2022
f97f327
Add news entry
dignissimus Apr 3, 2022
9fe2e98
Change variable name
dignissimus Apr 3, 2022
f73ebec
Update Lib/zipfile.py
dignissimus Apr 4, 2022
a26de91
Use byte-strings to write malformed zipfile
dignissimus Apr 23, 2022
4e35837
Remove rendundant call to bytes
dignissimus Apr 23, 2022
ab1afb0
Update news entry
dignissimus Apr 23, 2022
bf8d167
Use offset value to determine whether to raise BadZipFile
dignissimus Apr 23, 2022
05d6057
Remove duplicated lines
dignissimus Apr 23, 2022
f0ee1c7
Run BadZipFile test for all 32 bit central directory record sizes
dignissimus May 23, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions Lib/test/test_zipfile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1727,6 +1727,17 @@ def test_empty_file_raises_BadZipFile(self):
fp.write("short file")
self.assertRaises(zipfile.BadZipFile, zipfile.ZipFile, TESTFN)

def test_negative_central_directory_offset_raises_BadZipFile(self):
# Zip file containing an empty EOCD record
buffer = bytearray(b'PK\x05\x06' + b'\0'*18)

# Set the size of the central directory bytes to become 1,
# causing the central directory offset to become negative
for dirsize in 1, 2**32-1:
buffer[12:16] = struct.pack('<L', dirsize)
f = io.BytesIO(buffer)
self.assertRaises(zipfile.BadZipFile, zipfile.ZipFile, f)

def test_closed_zip_raises_ValueError(self):
"""Verify that testzip() doesn't swallow inappropriate exceptions."""
data = io.BytesIO()
Expand Down
2 changes: 2 additions & 0 deletions Lib/zipfile.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1366,6 +1366,8 @@ def _RealGetContents(self):
print("given, inferred, offset", offset_cd, inferred, concat)
# self.start_dir: Position of start of central directory
self.start_dir = offset_cd + concat
if self.start_dir < 0:
raise BadZipFile("Bad offset for central directory")
fp.seek(self.start_dir, 0)
data = fp.read(size_cd)
fp = io.BytesIO(data)
Expand Down
2 changes: 2 additions & 0 deletions Misc/NEWS.d/next/Library/2022-04-03-19-40-09.bpo-39064.76PbIz.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
:class:`zipfile.ZipFile` now raises :exc:`zipfile.BadZipFile` instead of ``ValueError`` when reading a
corrupt zip file in which the central directory offset is negative.