Fixed the parsing of invalid ZIP64 extended information extra fields

ebourg · Oct 7, 2023 · c88d3ef · c88d3ef
1 parent e0d6b08
commit c88d3ef
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 11 deletions.
diff --git a/jsign-core/src/main/java/net/jsign/appx/Zip64ExtendedInfoExtraField.java b/jsign-core/src/main/java/net/jsign/appx/Zip64ExtendedInfoExtraField.java
@@ -17,6 +17,7 @@
 package net.jsign.appx;
 
 import java.io.IOException;
+import java.nio.BufferUnderflowException;
 import java.nio.ByteBuffer;
 
 import static java.nio.ByteOrder.*;
@@ -62,17 +63,21 @@ public Zip64ExtendedInfoExtraField(long uncompressedSize, long compressedSize, l
     @Override
     protected void parse() throws IOException {
         ByteBuffer buffer = ByteBuffer.wrap(data).order(LITTLE_ENDIAN);
-        if (uncompressedSize != -1) {
-            uncompressedSize = buffer.getLong();
-        }
-        if (compressedSize != -1) {
-            compressedSize = buffer.getLong();
-        }
-        if (localHeaderOffset != -1) {
-            localHeaderOffset = buffer.getLong();
-        }
-        if (diskNumberStart != -1) {
-            diskNumberStart = buffer.getInt();
+        try {
+            if (uncompressedSize != -1) {
+                uncompressedSize = buffer.getLong();
+            }
+            if (compressedSize != -1) {
+                compressedSize = buffer.getLong();
+            }
+            if (localHeaderOffset != -1) {
+                localHeaderOffset = buffer.getLong();
+            }
+            if (diskNumberStart != -1) {
+                diskNumberStart = buffer.getInt();
+            }
+        } catch (BufferUnderflowException e) {
+            throw new IOException("Invalid ZIP64 extended information extra field", e);
         }
     }
 

diff --git a/...es/fuzzer/clusterfuzz-testcase-minimized-AuthenticodeAppxSignerFuzzer-6066122517250048.gz b/...es/fuzzer/clusterfuzz-testcase-minimized-AuthenticodeAppxSignerFuzzer-6066122517250048.gz