Loading...

XML

Word

Printable

Type: Bug
Resolution: Fixed
Priority: P4
Fix Version/s: 18
Affects Version/s: 11, 17, 18
Component/s: core-libs
Labels:

Subcomponent:
java.util.jar
Resolved In Build:
b26
CPU:

generic
OS:

generic
Verification:
Verified

Issue	Fix Version	Assignee	Priority	Status	Resolution	Resolved In Build
JDK-8283429	17.0.4	Goetz Lindenmaier	P4	Resolved	Fixed	b01
JDK-8285917	15.0.8	Yuri Nesterenko	P4	Resolved	Fixed	b02
JDK-8285920	13.0.12	Yuri Nesterenko	P4	Resolved	Fixed	b02

The ZipOutputStream class may be used to a bad zip file. The root cause is how the comment field is stored by the ZipOutputStream. According to the zip specification, the comment field should not be longer than 0xFFFF bytes, and we try to validate the length of the comment, but unfortunately, we do this after the comment was assigned already. So if the application saves the comment based on the user's input and then gets an exception from the ZipOutputStream.setComment() it may assume that the comment is too long and it will be ignored, but it will be saved as-is to the file.

backported by

JDK-8283429 ZipException: zip END header not found at ZipFile#Source.findEND

Resolved

JDK-8285917 ZipException: zip END header not found at ZipFile#Source.findEND

Resolved

JDK-8285920 ZipException: zip END header not found at ZipFile#Source.findEND

Resolved

links to

Commit openjdk/jdk13u-dev/6766a704

Commit openjdk/jdk15u-dev/a964b4d5

Commit openjdk/jdk17u-dev/a605a306

Commit openjdk/jdk/e3243ee9

Review openjdk/jdk13u-dev/347

Review openjdk/jdk15u-dev/204

Review openjdk/jdk17u-dev/263

Review openjdk/jdk/6380

(6 links to)

Assignee:: Sergey Bylokhov

Reporter:: Sergey Bylokhov

Votes:: 0 Vote for this issue

Watchers:: 9 Start watching this issue

Created:: 2021-11-12 15:29

Updated:: 2022-04-29 05:43

Resolved:: 2021-11-23 00:59

Details

Backports

Description

Attachments

Issue Links

Activity

People

Dates