@patrickdk77/archive-defuse 0.0.0-stage → 0.1.1

package/dist/unpack.js

@@ -0,0 +1,194 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArchiveReadError = void 0;
+exports.openArchive = openArchive;
+exports.decompress = decompress;
+// Reading archives and compressed files as a library: list the entries of any format this package reads and read
+// their content, under the same limits the inspection uses. Nothing here applies the rules or writes files; the names
+// are as the archive gives them.
+const engine_1 = require("./engine");
+const errors_1 = require("./errors");
+const formats_1 = require("./formats");
+const io_1 = require("./io");
+/**
+ * Thrown when an archive cannot be read: not a format this package reads, a limit, a missing password, or data that
+ * does not decode. `category` and `detail` name the finding `inspectArchive` would report.
+ */
+class ArchiveReadError extends Error {
+    category;
+    detail;
+    data;
+    constructor(message, category, detail, data) {
+        super(message);
+        this.category = category;
+        this.detail = detail;
+        this.data = data;
+    }
+}
+exports.ArchiveReadError = ArchiveReadError;
+/** The error a reader throws for what stopped it. Time and nesting limits and I/O errors pass as they are. */
+function readError(e) {
+    if ((0, errors_1.stopsTree)(e) || e instanceof ArchiveReadError)
+        return e;
+    if (e instanceof errors_1.StopError)
+        return new ArchiveReadError(e.message, e.category, e.detail, e.data);
+    if (e instanceof errors_1.CheckError)
+        return new ArchiveReadError(e.message, 'CORRUPTED', 'CHECK_FAILED', { check: e.check });
+    if (e instanceof errors_1.DataError)
+        return new ArchiveReadError(e.message, 'CORRUPTED', e.truncated ? 'TRUNCATED' : 'DATA_ERROR');
+    if (e instanceof errors_1.UnsupportedError)
+        return new ArchiveReadError(e.message, 'COMPRESSION', e.method ? 'UNSUPPORTED_METHOD' : 'UNSUPPORTED_FEATURE');
+    return e;
+}
+const hasContent = (e) => e.kind === 'file' || e.kind === 'other';
+/**
+ * Opens an archive or a compressed file for reading. The format comes from the content, as for `inspectArchive`. The
+ * entries are listed at once; content is read only when asked for. The source is closed by `close()`, or at once when
+ * opening fails.
+ */
+async function openArchive(input, options = {}) {
+    const source = input instanceof Uint8Array ? (0, io_1.bufferSource)(input) : input;
+    const limits = (0, engine_1.limitsOf)({ limits: options.limits });
+    const deadline = options.limits?.timeMs !== undefined ? Date.now() + options.limits.timeMs : undefined;
+    const passwords = (0, engine_1.passwordsOf)({ password: options.password });
+    const totals = { decoded: 0 };
+    const temp = new io_1.TempDir(options.tempDir);
+    let archive;
+    try {
+        const size = await source.size();
+        if (limits.fileSize !== undefined && size > limits.fileSize)
+            throw new ArchiveReadError('The file exceeds the file size limit', 'LIMIT', 'FILE_SIZE', { size });
+        archive = await (0, formats_1.openArchive)(source, limits, deadline, passwords, { dir: temp, threshold: options.memoryThreshold ?? 8 * 1024 * 1024 });
+        // ZIP and 7z keep a symbolic link's target as its content.
+        if (archive.linkTarget) {
+            for (const e of archive.entries) {
+                if (e.kind !== 'symlink' || e.broken || e.linkTarget !== undefined)
+                    continue;
+                try {
+                    e.linkTarget = await archive.linkTarget(e, (0, engine_1.makeMeter)(e, limits, deadline, totals));
+                }
+                catch (err) {
+                    if (!(err instanceof errors_1.DataError))
+                        throw err;
+                }
+            }
+        }
+    }
+    catch (e) {
+        await source.close?.();
+        await temp.cleanup();
+        throw readError(e);
+    }
+    const opened = archive;
+    const listed = opened.entries.map(e => ({
+        index: e.index,
+        name: e.name,
+        kind: e.kind,
+        size: opened.single ? undefined : e.size,
+        mode: e.mode,
+        linkTarget: e.linkTarget,
+        encrypted: e.encryption !== undefined,
+    }));
+    const entryOf = (which) => {
+        const listedEntry = typeof which === 'string' ? listed.find(l => l.name === which) : which;
+        const e = listedEntry === undefined ? undefined : opened.entries[listedEntry.index];
+        if (!e)
+            throw new ArchiveReadError(`No entry ${JSON.stringify(typeof which === 'string' ? which : which.name)}`, 'ENTRY', 'NOT_FOUND');
+        if (!hasContent(e))
+            throw new ArchiveReadError(`Entry ${JSON.stringify(e.name)} is a ${e.kind}, which has no content`, 'ENTRY', 'NO_CONTENT');
+        return e;
+    };
+    /** The passwords that open an encrypted entry, in the order to try them; undefined alone for a plain one. */
+    async function* keys(e) {
+        if (!e.encryption) {
+            yield undefined;
+            return;
+        }
+        if (e.encryption.kind === 'unsupported')
+            throw new ArchiveReadError(`Entry ${JSON.stringify(e.name)} uses ${e.encryption.reason}`, 'ENCRYPTED', 'UNSUPPORTED');
+        let any = false;
+        for (const p of passwords) {
+            if (await opened.unlock(e, p)) {
+                any = true;
+                yield p;
+            }
+        }
+        if (!any)
+            throw new ArchiveReadError(`No password opens entry ${JSON.stringify(e.name)}`, 'ENCRYPTED', 'PASSWORD_REQUIRED');
+    }
+    async function* stream(which) {
+        const e = entryOf(which);
+        if (e.broken)
+            throw new ArchiveReadError(`Entry ${JSON.stringify(e.name)} cannot be read: ${e.broken}`, 'CORRUPTED', 'ENTRY_DATA');
+        try {
+            // A stream cannot take back what it gave, so it reads with the first password that opens the entry.
+            for await (const password of keys(e)) {
+                yield* opened.read(e, (0, engine_1.makeMeter)(e, limits, deadline, totals), password);
+                return;
+            }
+        }
+        catch (err) {
+            throw readError(err);
+        }
+    }
+    async function bytes(which) {
+        const e = entryOf(which);
+        if (e.broken)
+            throw new ArchiveReadError(`Entry ${JSON.stringify(e.name)} cannot be read: ${e.broken}`, 'CORRUPTED', 'ENTRY_DATA');
+        let failure;
+        try {
+            // A ZipCrypto header can pass for a wrong password, so a password whose data fails gives way to the next.
+            for await (const password of keys(e)) {
+                const meter = (0, engine_1.makeMeter)(e, limits, deadline, totals);
+                const parts = [];
+                try {
+                    for await (const c of opened.read(e, meter, password))
+                        parts.push(c);
+                    return Buffer.concat(parts);
+                }
+                catch (err) {
+                    totals.decoded -= meter.total;
+                    if (!(err instanceof errors_1.DataError) || e.encryption === undefined)
+                        throw err;
+                    failure = err;
+                }
+            }
+        }
+        catch (err) {
+            throw readError(err);
+        }
+        throw readError(failure);
+    }
+    return {
+        format: opened.format,
+        entries: listed,
+        find: name => listed.find(l => l.name === name),
+        stream,
+        bytes,
+        text: async (which, encoding = 'utf8') => (await bytes(which)).toString(encoding),
+        close: async () => {
+            try {
+                await source.close?.();
+            }
+            finally {
+                await temp.cleanup();
+            }
+        },
+    };
+}
+/**
+ * Decodes a compressed file, such as gzip, bzip2, zstd, Brotli, xz or .lzma, to its content. An archive of several
+ * entries throws; `openArchive` reads those.
+ */
+async function decompress(input, options = {}) {
+    const reader = await openArchive(input, options);
+    try {
+        const formats = ['gzip', 'bzip2', 'zstd', 'brotli', 'xz', 'lzma'];
+        if (!formats.includes(reader.format))
+            throw new ArchiveReadError(`A ${reader.format} archive holds entries; openArchive reads them`, 'FORMAT', 'NOT_SINGLE');
+        return await reader.bytes(reader.entries[0]);
+    }
+    finally {
+        await reader.close();
+    }
+}

package/dist/xz.d.ts

@@ -0,0 +1,25 @@
+import type { Reader } from './io';
+import type { Note } from './model';
+import type { Limits, StreamCounter as Meter } from './stream-meter';
+/** What reading an xz file found out, beyond its content. */
+export interface XzInfo {
+    streams: number;
+    /** The check ID of each stream. */
+    checks: number[];
+    notes: Note[];
+    /** Offset of the first byte that is not part of a stream or its padding, when the file goes on past the last stream. */
+    trailingAt?: number;
+}
+/** What reading an xz file needs from the run. */
+export interface XzEnv {
+    reader: Reader;
+    size: number;
+    limits: Limits;
+    meter: Meter;
+}
+/**
+ * Decodes an xz file and yields its content: every block of every stream, in order. Stream padding, the index and the
+ * footers are checked against what the blocks held. What can be fixed by writing the file again goes to `info.notes`;
+ * what cannot throws.
+ */
+export declare function readXz(env: XzEnv, info: XzInfo): AsyncGenerator<Uint8Array>;

package/dist/xz.js

@@ -0,0 +1,333 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readXz = readXz;
+const checks_1 = require("./checks");
+const coders_1 = require("./coders");
+const crc32_1 = require("./crc32");
+const errors_1 = require("./errors");
+const filters_1 = require("./filters");
+const lzma_sniff_1 = require("./lzma-sniff");
+const lzma1_stream_1 = require("./lzma1-stream");
+const types_1 = require("./types");
+const BRANCH_IDS = { 4: 'x86', 5: 'powerpc', 6: 'ia64', 7: 'arm', 8: 'armthumb', 9: 'sparc', 10: 'arm64', 11: 'riscv' };
+const FILTER_LZMA2 = 0x21;
+const FILTER_DELTA = 0x03;
+/** A variable-length integer of xz: 7 bits per byte, low first, at most 9 bytes and no unneeded zero byte at the end. */
+function vli(b, at) {
+    let value = 0;
+    for (let i = 0; i < 9; i++) {
+        if (at + i >= b.length)
+            throw new errors_1.ParseError('a number runs past its field');
+        const byte = b[at + i];
+        value += (byte & 0x7f) * 2 ** (7 * i);
+        if ((byte & 0x80) === 0) {
+            if (byte === 0 && i > 0)
+                throw new errors_1.ParseError('a number is written with an unneeded zero byte');
+            return { value, next: at + i + 1 };
+        }
+    }
+    throw new errors_1.ParseError('a number is longer than nine bytes');
+}
+/** Reads bytes one at a time from a reader. */
+class ByteStream {
+    reader;
+    pos;
+    buf = new Uint8Array(0);
+    bufAt = 0;
+    constructor(reader, pos) {
+        this.reader = reader;
+        this.pos = pos;
+    }
+    async byte() {
+        if (this.pos >= this.bufAt + this.buf.length) {
+            this.buf = await this.reader.read(this.pos, 65536);
+            this.bufAt = this.pos;
+            if (this.buf.length === 0)
+                throw new errors_1.DataError('the index ends past the end of the file', true);
+        }
+        const b = this.buf[this.pos - this.bufAt];
+        this.pos++;
+        return b;
+    }
+    async vli() {
+        let value = 0;
+        for (let i = 0; i < 9; i++) {
+            const byte = await this.byte();
+            value += (byte & 0x7f) * 2 ** (7 * i);
+            if ((byte & 0x80) === 0) {
+                if (byte === 0 && i > 0)
+                    throw new errors_1.ParseError('a number is written with an unneeded zero byte');
+                return value;
+            }
+        }
+        throw new errors_1.ParseError('a number is longer than nine bytes');
+    }
+}
+async function exact(reader, pos, n, what) {
+    const b = await reader.read(pos, n);
+    if (b.length < n)
+        throw new errors_1.DataError(`the ${what} ends past the end of the file`, true);
+    return b;
+}
+const u32 = (b, at) => (b[at] | (b[at + 1] << 8) | (b[at + 2] << 16) | (b[at + 3] << 24)) >>> 0;
+const isMagic = (b) => b.length >= 6 && lzma_sniff_1.XZ_MAGIC.every((x, i) => b[i] === x);
+function parseBlockHeader(h) {
+    const size = h.length;
+    if ((0, crc32_1.crc32)(h.subarray(0, size - 4)) !== u32(h, size - 4))
+        throw new errors_1.CheckError('the block header CRC32 does not match', 'block header CRC32');
+    const flags = h[1];
+    if (flags & 0x3c)
+        throw new errors_1.UnsupportedError('reserved block flags', false, { reason: 'reserved block header flags' });
+    const end = size - 4;
+    let q = 2;
+    let compressed;
+    let uncompressed;
+    const field = (what) => {
+        if (q >= end)
+            throw new errors_1.ParseError(`the block header ends in its ${what}`);
+        const r = vli(h.subarray(0, end), q);
+        q = r.next;
+        return r.value;
+    };
+    if (flags & 0x40) {
+        compressed = field('compressed size');
+        if (compressed === 0)
+            throw new errors_1.ParseError('a block declares a compressed size of zero');
+    }
+    if (flags & 0x80)
+        uncompressed = field('uncompressed size');
+    const raw = [];
+    for (let k = 0; k < (flags & 3) + 1; k++) {
+        const id = field('filter flags');
+        const propsSize = field('filter flags');
+        if (q + propsSize > end)
+            throw new errors_1.ParseError('the block header ends in its filter flags');
+        raw.push({ id, props: h.slice(q, q + propsSize) });
+        q += propsSize;
+    }
+    for (let i = q; i < end; i++) {
+        if (h[i] !== 0)
+            throw new errors_1.UnsupportedError('block header padding that is not zero', false, { reason: 'a block header field this package does not know' });
+    }
+    const last = raw[raw.length - 1];
+    const known = (id) => id === FILTER_LZMA2 || id === FILTER_DELTA || BRANCH_IDS[id] !== undefined;
+    for (const f of raw) {
+        if (!known(f.id))
+            throw new errors_1.UnsupportedError(`xz filter 0x${f.id.toString(16)}`, true, { method: `filter 0x${f.id.toString(16)}` });
+    }
+    if (last.id !== FILTER_LZMA2)
+        throw new errors_1.UnsupportedError('a filter chain that does not end in LZMA2', false, { reason: 'a filter chain that does not end in LZMA2' });
+    if (raw.slice(0, -1).some(f => f.id === FILTER_LZMA2))
+        throw new errors_1.UnsupportedError('LZMA2 before the last filter', false, { reason: 'LZMA2 before the last filter' });
+    const dict = last.props.length === 1 ? (0, coders_1.lzma2DictSize)(last.props[0]) : undefined;
+    if (dict === undefined)
+        throw new errors_1.ParseError('invalid LZMA2 properties');
+    const filters = raw.slice(0, -1).map(f => {
+        if (f.id === FILTER_DELTA) {
+            if (f.props.length !== 1)
+                throw new errors_1.ParseError('invalid delta filter properties');
+            return { kind: 'delta', distance: f.props[0] + 1 };
+        }
+        if (f.props.length !== 0 && f.props.length !== 4)
+            throw new errors_1.ParseError('invalid branch filter properties');
+        return { kind: BRANCH_IDS[f.id], start: f.props.length === 4 ? u32(f.props, 0) : 0 };
+    });
+    return { size, compressed, uncompressed, dict, filters };
+}
+/**
+ * Decodes an xz file and yields its content: every block of every stream, in order. Stream padding, the index and the
+ * footers are checked against what the blocks held. What can be fixed by writing the file again goes to `info.notes`;
+ * what cannot throws.
+ */
+async function* readXz(env, info) {
+    const { reader, size, meter } = env;
+    let pos = 0;
+    for (;;) {
+        // Stream header. Bytes after a stream that do not start the magic are trailing data, however few; bytes that do
+        // start it are a stream cut short.
+        const header = await reader.read(pos, 12);
+        const magic = header.length >= 6 ? isMagic(header) : header.every((b, i) => b === lzma_sniff_1.XZ_MAGIC[i]);
+        if (!magic) {
+            if (info.streams === 0)
+                throw new errors_1.ParseError('the file does not start with an xz stream');
+            info.trailingAt = pos;
+            return;
+        }
+        if (header.length < 12)
+            throw new errors_1.DataError('the stream header ends past the end of the file', true);
+        const location = info.streams === 0 ? undefined : `stream ${info.streams + 1}`;
+        if ((0, crc32_1.crc32)(header.subarray(6, 8)) !== u32(header, 8))
+            throw new errors_1.CheckError('the stream header CRC32 does not match', 'stream header CRC32');
+        if (header[6] !== 0 || (header[7] & 0xf0) !== 0)
+            throw new errors_1.UnsupportedError('reserved stream flags', false, { reason: 'reserved stream flags' });
+        const checkId = header[7] & 0x0f;
+        const cSize = (0, checks_1.checkSize)(checkId);
+        if (checkId === checks_1.CHECK_NONE)
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.NoCheck, location });
+        else if (checkId !== checks_1.CHECK_CRC32 && checkId !== checks_1.CHECK_CRC64 && checkId !== checks_1.CHECK_SHA256) {
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.UnknownCheck, location, data: { check: (0, checks_1.checkName)(checkId) } });
+        }
+        info.checks.push(checkId);
+        info.streams++;
+        meter.tick();
+        pos += 12;
+        // Blocks
+        const blocks = [];
+        for (;;) {
+            const first = await exact(reader, pos, 1, 'block header');
+            if (first[0] === 0x00)
+                break;
+            const blockLoc = `${location ? `${location}, ` : ''}block ${blocks.length + 1}`;
+            const headerSize = (first[0] + 1) * 4;
+            const h = await exact(reader, pos, headerSize, 'block header');
+            const bh = parseBlockHeader(h);
+            if (bh.uncompressed !== undefined && bh.uncompressed > env.limits.decompressedBytes) {
+                throw new errors_1.StopError(types_1.ArchiveCategory.Limit, types_1.ArchiveDetail.DecompressedSize, 'Decompressed size limit exceeded', { limit: env.limits.decompressedBytes, declared: bh.uncompressed }, blockLoc);
+            }
+            const dictNeed = (0, lzma1_stream_1.effectiveDictSize)(bh.dict, bh.uncompressed);
+            if (dictNeed > env.limits.dictionaryBytes) {
+                throw new errors_1.StopError(types_1.ArchiveCategory.Limit, types_1.ArchiveDetail.DictionarySize, 'Dictionary size limit exceeded', { limit: env.limits.dictionaryBytes, dictionary: dictNeed }, blockLoc);
+            }
+            const dataStart = pos + headerSize;
+            const dataEnd = bh.compressed !== undefined ? dataStart + bh.compressed : size;
+            if (dataEnd > size)
+                throw new errors_1.DataError('a block declares more compressed data than the file holds', true);
+            // Decoding runs LZMA2 first, then the other filters from the last listed to the first.
+            const transforms = bh.filters.map(f => (f.kind === 'delta' ? new filters_1.DeltaStream(f.distance) : new filters_1.SimpleFilterStream(f.kind, f.start))).reverse();
+            const check = (0, checks_1.makeCheck)(checkId);
+            const feeder = new coders_1.Lzma2Feeder(bh.dict);
+            let uncompressed = 0;
+            const emit = (chunk, from) => {
+                let d = chunk;
+                for (let k = from; k < transforms.length && d.length; k++)
+                    d = transforms[k].push(d);
+                return d;
+            };
+            let p = dataStart;
+            while (!feeder.ended) {
+                if (p >= dataEnd)
+                    throw new errors_1.DataError(bh.compressed !== undefined ? 'the LZMA2 data does not end within the compressed size its block declares' : 'the LZMA2 data ends past the end of the file', true);
+                const chunk = await reader.read(p, Math.min(65536, dataEnd - p));
+                let used = 0;
+                while (used < chunk.length && !feeder.ended) {
+                    const n = feeder.push(chunk.subarray(used, used + 4096));
+                    used += n;
+                    meter.packed(n);
+                    for (const out of feeder.take()) {
+                        const d = emit(out, 0);
+                        if (!d.length)
+                            continue;
+                        check?.update(d);
+                        uncompressed += d.length;
+                        meter.add(d.length);
+                        yield d;
+                    }
+                }
+                p += used;
+            }
+            for (let k = 0; k < transforms.length; k++) {
+                const d = emit(transforms[k].end(), k + 1);
+                if (!d.length)
+                    continue;
+                check?.update(d);
+                uncompressed += d.length;
+                meter.add(d.length);
+                yield d;
+            }
+            const compressed = p - dataStart;
+            if (bh.compressed !== undefined && bh.compressed !== compressed) {
+                info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.SizeMismatch, location: blockLoc, data: { reason: 'compressed size of a block', declared: bh.compressed, actual: compressed } });
+            }
+            if (bh.uncompressed !== undefined && bh.uncompressed !== uncompressed) {
+                info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.SizeMismatch, location: blockLoc, data: { reason: 'uncompressed size of a block', declared: bh.uncompressed, actual: uncompressed } });
+            }
+            const padding = (4 - ((headerSize + compressed) % 4)) % 4;
+            const tail = await exact(reader, p, padding + cSize, 'block');
+            if (tail.subarray(0, padding).some(b => b !== 0))
+                info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.BadPadding, location: blockLoc, data: { reason: 'block padding that is not zero' } });
+            if (check) {
+                const want = check.digest();
+                const got = tail.subarray(padding);
+                if (want.some((b, i) => b !== got[i]))
+                    throw new errors_1.CheckError(`the ${(0, checks_1.checkName)(checkId)} of a block does not match`, (0, checks_1.checkName)(checkId));
+            }
+            blocks.push({ unpadded: headerSize + compressed + cSize, uncompressed });
+            pos = p + padding + cSize;
+        }
+        // Index
+        const index = new ByteStream(reader, pos);
+        await index.byte();
+        const count = await index.vli();
+        if (count * 2 > size - index.pos)
+            throw new errors_1.DataError('the index lists more blocks than the file can hold', true);
+        let mismatch;
+        if (count !== blocks.length)
+            mismatch = 'the number of blocks';
+        for (let i = 0; i < count; i++) {
+            const unpadded = await index.vli();
+            const uncompressed = await index.vli();
+            if (unpadded === 0)
+                mismatch ??= 'an unpadded size of zero';
+            const b = blocks[i];
+            if (b && b.unpadded !== unpadded)
+                mismatch ??= 'the unpadded size of a block';
+            if (b && b.uncompressed !== uncompressed)
+                mismatch ??= 'the uncompressed size of a block';
+        }
+        let padBad = false;
+        while ((index.pos - pos) % 4 !== 0)
+            if ((await index.byte()) !== 0)
+                padBad = true;
+        let indexCrc = 0;
+        for (let at = pos; at < index.pos; at += 65536)
+            indexCrc = (0, crc32_1.crc32)(await exact(reader, at, Math.min(65536, index.pos - at), 'index'), indexCrc);
+        const stored = await exact(reader, index.pos, 4, 'index');
+        if (u32(stored, 0) !== indexCrc)
+            throw new errors_1.CheckError('the index CRC32 does not match', 'index CRC32');
+        if (padBad)
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.BadPadding, location, data: { reason: 'index padding that is not zero' } });
+        if (mismatch)
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.IndexMismatch, location, data: { reason: mismatch } });
+        const indexSize = index.pos + 4 - pos;
+        pos += indexSize;
+        // Stream footer
+        const footer = await exact(reader, pos, 12, 'stream footer');
+        if (footer[10] !== 0x59 || footer[11] !== 0x5a)
+            throw new errors_1.ParseError('the stream footer has no magic bytes');
+        if ((0, crc32_1.crc32)(footer.subarray(4, 10)) !== u32(footer, 0))
+            throw new errors_1.CheckError('the stream footer CRC32 does not match', 'stream footer CRC32');
+        if ((u32(footer, 4) + 1) * 4 !== indexSize)
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.IndexMismatch, location, data: { reason: 'the index size in the stream footer' } });
+        if (footer[8] !== header[6] || footer[9] !== header[7])
+            info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.HeaderMismatch, location });
+        pos += 12;
+        // Stream padding, then the next stream or the end.
+        let zeros = 0;
+        for (;;) {
+            const b = await reader.read(pos + zeros, 4096);
+            let k = 0;
+            while (k < b.length && b[k] === 0)
+                k++;
+            zeros += k;
+            if (k < b.length || b.length === 0)
+                break;
+        }
+        if (zeros > 0) {
+            const next = await reader.read(pos + zeros, 6);
+            const atEnd = pos + zeros === size;
+            if (atEnd || isMagic(next)) {
+                if (zeros % 4 === 0)
+                    info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.StreamPadding, data: { bytes: zeros } });
+                else
+                    info.notes.push({ category: types_1.ArchiveCategory.Structure, detail: types_1.ArchiveDetail.BadPadding, data: { reason: 'stream padding that is not a multiple of four bytes', bytes: zeros } });
+            }
+            else {
+                info.trailingAt = pos;
+                return;
+            }
+        }
+        pos += zeros;
+        if (pos >= size)
+            return;
+    }
+}

package/dist/zip-lzma.d.ts

@@ -0,0 +1,15 @@
+import type { Consumed } from './codecs';
+import { type TempDir } from './io';
+import type { Meter } from './model';
+import type { Limits } from './stream-meter';
+/**
+ * Decodes a method 14 entry: the LZMA header APPNOTE 5.8.8 gives, then raw LZMA data of the entry's size, which may
+ * end with an end marker. `consumed.bytes` follows the input the data took, so the caller can see bytes after it.
+ */
+export declare function zipLzma(chunks: AsyncIterable<Uint8Array>, size: number, consumed: Consumed, dictionaryBytes: number): AsyncGenerator<Uint8Array>;
+/**
+ * Decodes a method 95 entry, which holds a whole xz file. The xz reader reads by offset, so the entry's compressed
+ * bytes go to memory or a temporary file first. A file that goes on past its streams, or that has notes the xz reader
+ * makes, such as bad padding, does not decode: an entry is one xz file and nothing else.
+ */
+export declare function zipXz(chunks: AsyncIterable<Uint8Array>, consumed: Consumed, meter: Meter, temp: TempDir, threshold: number, limits: Limits): AsyncGenerator<Uint8Array>;