Allow more trailing null bytes in zip files (#15452)

## Summary

There isn't any risk here, and we have reports of at least one zip file
with more than one (but fewer than, e.g., 10) null bytes.

Closes https://github.com/astral-sh/uv/issues/15451.
This commit is contained in:
Charlie Marsh 2025-08-22 14:50:07 +01:00 committed by GitHub
parent 3e34aee63e
commit 088c908cda
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -532,22 +532,28 @@ pub async fn unzip<R: tokio::io::AsyncRead + Unpin>(
} }
} }
// Determine whether the reader is exhausted. // Determine whether the reader is exhausted, but allow trailing null bytes, which some zip
// implementations incorrectly include.
if !skip_validation { if !skip_validation {
let mut buffer = [0; 1]; let mut has_trailing_bytes = false;
if reader.read(&mut buffer).await.map_err(Error::Io)? > 0 { let mut buf = [0u8; 256];
// If the buffer contains a single null byte, ignore it. loop {
if buffer[0] == 0 { let n = reader.read(&mut buf).await.map_err(Error::Io)?;
if reader.read(&mut buffer).await.map_err(Error::Io)? > 0 { if n == 0 {
return Err(Error::TrailingContents); if has_trailing_bytes {
warn!("Ignoring trailing null bytes in ZIP archive");
} }
break;
warn!("Ignoring trailing null byte in ZIP archive"); }
for &b in &buf[..n] {
if b == 0 {
has_trailing_bytes = true;
} else { } else {
return Err(Error::TrailingContents); return Err(Error::TrailingContents);
} }
} }
} }
}
Ok(()) Ok(())
} }