1 /*-
2 * Copyright (c) 2026 Tim Kientzle
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include "test.h"
27
28 /*
29 * ZIP stores the filename length in a 16-bit field, so the maximum is
30 * 65535 bytes. A pathname of 65536 bytes or more must be rejected
31 * (ARCHIVE_FAILED) rather than silently truncated in the header and
32 * written past the end of the central-directory segment buffer.
33 */
DEFINE_TEST(test_write_format_zip_long_pathname)34 DEFINE_TEST(test_write_format_zip_long_pathname)
35 {
36 struct archive *a;
37 struct archive_entry *ae;
38 char *pathname;
39 char *buf;
40 size_t used;
41 /* Enough room for a valid ZIP with a 65535-byte filename. */
42 const size_t bufsize = 256 * 1024;
43
44 buf = malloc(bufsize);
45 assert(buf != NULL);
46
47 /* 65535-byte pathname: exactly the ZIP maximum — must succeed. */
48 pathname = malloc(65536);
49 assert(pathname != NULL);
50 memset(pathname, 'a', 65535);
51 pathname[65535] = '\0';
52
53 assert((a = archive_write_new()) != NULL);
54 assertEqualInt(ARCHIVE_OK, archive_write_set_format_zip(a));
55 assertEqualInt(ARCHIVE_OK,
56 archive_write_open_memory(a, buf, bufsize, &used));
57
58 assert((ae = archive_entry_new()) != NULL);
59 archive_entry_copy_pathname(ae, pathname);
60 archive_entry_set_mode(ae, AE_IFREG | 0644);
61 archive_entry_set_size(ae, 0);
62 assertEqualInt(ARCHIVE_OK, archive_write_header(a, ae));
63 archive_entry_free(ae);
64
65 assertEqualIntA(a, ARCHIVE_OK, archive_write_close(a));
66 assertEqualInt(ARCHIVE_OK, archive_write_free(a));
67 free(pathname);
68
69 /* 65536-byte pathname: one byte over the ZIP limit — must be rejected. */
70 pathname = malloc(65537);
71 assert(pathname != NULL);
72 memset(pathname, 'a', 65536);
73 pathname[65536] = '\0';
74
75 assert((a = archive_write_new()) != NULL);
76 assertEqualInt(ARCHIVE_OK, archive_write_set_format_zip(a));
77 assertEqualInt(ARCHIVE_OK,
78 archive_write_open_memory(a, buf, bufsize, &used));
79
80 assert((ae = archive_entry_new()) != NULL);
81 archive_entry_copy_pathname(ae, pathname);
82 archive_entry_set_mode(ae, AE_IFREG | 0644);
83 archive_entry_set_size(ae, 0);
84 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
85 archive_entry_free(ae);
86
87 assertEqualIntA(a, ARCHIVE_OK, archive_write_close(a));
88 assertEqualInt(ARCHIVE_OK, archive_write_free(a));
89 free(pathname);
90
91 /* 131072-byte pathname: the OOB-write size from the bug report. */
92 pathname = malloc(131073);
93 assert(pathname != NULL);
94 memset(pathname, 'a', 131072);
95 pathname[131072] = '\0';
96
97 assert((a = archive_write_new()) != NULL);
98 assertEqualInt(ARCHIVE_OK, archive_write_set_format_zip(a));
99 assertEqualInt(ARCHIVE_OK,
100 archive_write_open_memory(a, buf, bufsize, &used));
101
102 assert((ae = archive_entry_new()) != NULL);
103 archive_entry_copy_pathname(ae, pathname);
104 archive_entry_set_mode(ae, AE_IFREG | 0644);
105 archive_entry_set_size(ae, 0);
106 assertEqualInt(ARCHIVE_FAILED, archive_write_header(a, ae));
107 archive_entry_free(ae);
108
109 assertEqualIntA(a, ARCHIVE_OK, archive_write_close(a));
110 assertEqualInt(ARCHIVE_OK, archive_write_free(a));
111 free(pathname);
112
113 free(buf);
114 }
115