Merge pull request cthackers#483 from criyle/disk_entries

zipFile: add check for invalid large disk entries

test/large_directory_size/large_directory_size.test.js

@@ -0,0 +1,17 @@
+"use strict";
+
+const assert = require("assert");
+const path = require("path");
+const Zip = require("../../adm-zip");
+
+describe("read zip file header with invalid large number of entries", () => {
+    it("throws too large error", () => {
+        // this zip file reports 2147483648 disk entry count which is impossible
+        const zip = new Zip(path.join(__dirname, "../assets/large_directory_size.zip"));
+        // assert that the following call throws an exception
+        assert.throws(() => {
+            zip.getEntries();
+        }, new Error("Number of disk entries is too large"));
+    });
+});
+

util/errors.js

@@ -25,6 +25,7 @@ module.exports = {
     /* ADM-ZIP error messages */
     CANT_EXTRACT_FILE: "Could not extract the file",
     CANT_OVERRIDE: "Target file already exists",
+    DISK_ENTRY_TOO_LARGE: "Number of disk entries is too large",
     NO_ZIP: "No zip file was loaded",
     NO_ENTRY: "Entry doesn't exist",
     DIRECTORY_CONTENT_ERROR: "A directory cannot have content",

zipFile.js

@@ -43,6 +43,9 @@ module.exports = function (/*Buffer|null*/ inBuffer, /** object */ options) {
     function readEntries() {
         loadedEntries = true;
         entryTable = {};
+        if (mainHeader.diskEntries > (inBuffer.length - mainHeader.offset) / Utils.Constants.CENHDR) {
+            throw new Error(Utils.Errors.DISK_ENTRY_TOO_LARGE);
+        }
         entryList = new Array(mainHeader.diskEntries); // total number of entries
         var index = mainHeader.offset; // offset of first CEN header
         for (var i = 0; i < entryList.length; i++) {