java.util.zip.ZipFile reading code assumes that the extra data in the LOC and the CEN must be equal, but in fact there is no such requirement. The Zip file spec explicitly allows the LOC extra data size to be different from the CEN extra data size, although the JDK never creates such zip files. Since we cannot trust the CEN extra data size, we need to read the LOC to determine the entry data offset.