thejoshwolfe/yauzl

Directory entry size validation

DmitriyBerezin opened this issue · 2 comments

I use your amaizing module to uncompress zip archives from different sources. Archives may be produced via any compression tools and I don't exactly know which tool was used.

I've found a problem on some archives: readEntry() method fails on directory processing on entry size validation:

      if (entry.compressionMethod === 0) {
        if (entry.compressedSize !== entry.uncompressedSize) {
          var msg = "compressed/uncompressed size mismatch for stored file: " + entry.compressedSize + " != " + entry.uncompressedSize;
          return emitErrorAndAutoClose(self, new Error(msg));
        }
      }

Looks like some zip tool constantly set the following local headers for a directory entry:
compressionMethod: 0
compressedSize: 0
uncompressedSize: 4096

Unfortunatelly, I cannot provide zip example for this case because of sensitive data.

What do you think about some boolean option: validate size or skip validation? Or validate directory size or skip validation? If you accept this proposition I'll create pull request with my pleasure.

Sorry for the delayed response.

That's unfortunate that you have to deal with malformed zipfiles of that nature, but I think you've got a good idea for disabling the validation checks. There's already a similar concept with the decodeStrings option, so I'm pretty comfortable going in that direction.

Please look at 4c0aef8 and let me know if that will solve your problem.

the validateEntySizes option is now published in yauzl version 2.8