@zip.js/zip.js 2.14.1 → 2.16.0

package/BENCHMARKS.md

@@ -39,8 +39,11 @@ The page answers four questions, each from one or two scripts of the harness:
   about 2 KB each, and the 8 × 8 MB and 256 MB workloads are text.
 - **Isolation.** In `bench.js` and `bench-backends.js`, each (library, operation, workload)
   combination runs in its own freshly spawned Node process under macOS's `/usr/bin/time -l`, so
-  the libraries never share a heap and peak memory is per library. The codec, encryption and
-  runtime scripts run in-process, with one warmup run before the timed ones.
+  the libraries never share a heap and peak memory is per library. Every row of those two
+  scripts includes what a fresh process pays on its first operation: the JIT warm-up of each
+  library and, for the zip.js WebAssembly rows, the module instantiation, about 20 ms. The
+  codec, encryption and runtime scripts run in-process, with one warmup run before the timed
+  ones.
 - **Timing.** `performance.now()` around the measured operation. Each combination runs 3 times
   (5 in the encryption script) and the tables report the median. Differences of a few percent
   are within run-to-run noise. A bold cell is the best number among the alternatives it is
@@ -59,6 +62,11 @@ The page answers four questions, each from one or two scripts of the harness:
   where they exist; the bundled WebAssembly zlib; and the pure-JavaScript zlib port. The last two
   ship with the library, like the codecs of jszip and fflate, so those rows compare the
   libraries without the host's zlib in the picture.
+- **Checks.** No decompression row verifies the CRC-32 of the entries: zip.js and jszip leave
+  the check off by default, and fflate has none on read. Turning it on in zip.js makes the
+  inflater verify the CRC-32 through a gzip trailer: about 7 ms per 20 MB on the WebAssembly
+  codec, within the noise on Node's `DecompressionStream`; the pure-JavaScript port keeps a
+  separate pass over the output, about 15 ms.
 - **Units.** MB in the tables is 10^6 bytes. The workload sizes (20 MB, 8 MB, 256 MB) and the
   MB/s throughputs use 2^20 bytes.
 
@@ -126,15 +134,17 @@ Peak memory for the same runs (Δ over baseline):
 | fflate | fflate (JavaScript) | **92 MB** | **120 MB** |
 
 On the 20 MB stream `DecompressionStream` takes 66 ms and the WebAssembly inflate 78 ms, then
-fflate 116 ms, jszip 137 ms and the pure-JavaScript port 180 ms. On 5,000 small files the order
-reverses: fflate takes 102 ms, jszip 444 ms and the three zip.js rows 476 to 628 ms, with
-`DecompressionStream` the slowest of them, the same per-entry cost as in compression. fflate
-uses the least memory on both workloads, 34 % of the `DecompressionStream` row on the small
-files, and the WebAssembly and pure-JavaScript rows peak higher than `DecompressionStream`. The
-three zip.js rows allocate the same 800 MB of stream objects over the 5,000 entries, about
-160 KB per entry. The WebAssembly and pure-JavaScript codecs run on the JavaScript thread, so
-V8's incremental marking keeps more of that garbage alive between collections, and that is the
-difference between the rows.
+fflate 116 ms, jszip 137 ms and the pure-JavaScript port 180 ms. The WebAssembly row includes
+the module instantiation a fresh process pays once, about 20 ms. Warm, the two inflates are
+within 6 % of each other in the [Codecs](#codecs-at-equal-output-size) table. On 5,000 small
+files the order reverses: fflate takes 102 ms, jszip 444 ms and the three zip.js rows 476 to
+628 ms, with `DecompressionStream` the slowest of them, the same per-entry cost as in
+compression. fflate uses the least memory on both workloads, 34 % of the `DecompressionStream`
+row on the small files, and the WebAssembly and pure-JavaScript rows peak higher than
+`DecompressionStream`. The three zip.js rows allocate the same 800 MB of stream objects over the
+5,000 entries, about 160 KB per entry. The WebAssembly and pure-JavaScript codecs run on the
+JavaScript thread, so V8's incremental marking keeps more of that garbage alive between
+collections, and that is the difference between the rows.
 
 ### Streaming a 256 MB file, disk to disk
 

package/deno.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zip-js/zip-js",
-	"version": "2.14.1",
+	"version": "2.16.0",
 	"exports": {
 		".": "./index.js",
 		"./external": "./lib/zip-fs-external.js",

package/dist/zip-core-external.js

@@ -1889,7 +1889,6 @@ const FORMAT_GZIP$1 = "gzip";
 const GZIP_HEADER_LENGTH = 10;
 const GZIP_TRAILER_LENGTH = 8;
 const GZIP_HEADER_BYTES = [0x1f, 0x8b, 0x08];
-const GZIP_OUTPUT_STALL_TIMEOUT = 5000;
 
 class DeflateStream extends TransformStream {
 
@@ -1900,8 +1899,8 @@ class DeflateStream extends TransformStream {
 		let crc32Stream, encryptionStream, gzipCrc32Stream;
 		let readable = super.readable;
 		const codecStreams = format && getCodecStreams(format);
-		const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) &&
-			Boolean(useCompressionStream && CompressionStream);
+		const GzipCompressionStream = getGzipCodecStream(useCompressionStream, CompressionStream, CompressionStreamFallback);
+		const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) && Boolean(GzipCompressionStream);
 		if ((!encrypted || zipCrypto) && computeCrc32 && !useGzipCrc32) {
 			crc32Stream = new Crc32Stream();
 			readable = pipeThrough(readable, crc32Stream);
@@ -1911,12 +1910,15 @@ class DeflateStream extends TransformStream {
 				readable = pipeThroughBackpressured(readable, createCodecStream(codecStreams.CompressionStream, format, { level, chunkSize, compressionMethod, uncompressedSize: inputSize }));
 			} else if (useGzipCrc32) {
 				gzipCrc32Stream = new GzipToRawDeflateStream();
-				readable = pipeThroughBackpressured(readable, new CompressionStream(FORMAT_GZIP$1));
+				readable = pipeThroughBackpressured(readable, new GzipCompressionStream(FORMAT_GZIP$1, { level, chunkSize }));
 				readable = pipeThrough(readable, gzipCrc32Stream);
 			} else {
 				try {
 					readable = pipeThroughCompressionStream(readable, useCompressionStream, { level, chunkSize }, CompressionStream, CompressionStreamFallback);
 				} catch (error) {
+					if (!useCompressionStream && CompressionStreamFallback) {
+						throw error;
+					}
 					let gzipStream;
 					try {
 						gzipStream = new CompressionStream(FORMAT_GZIP$1);
@@ -1985,82 +1987,144 @@ class GzipToRawDeflateStream extends TransformStream {
 	}
 }
 
-function pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize) {
-	const crc32 = new Crc32();
+function pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, crc32) {
+	const writer = gzipStream.writable.getWriter();
+	const reader = gzipStream.readable.getReader();
+	const outputCrc32 = crc32 === UNDEFINED_VALUE ? new Crc32() : UNDEFINED_VALUE;
 	let outputLength = 0;
 	let inputDone = false;
-	let watchdogTimeout;
+	let trailerWritten = false;
+	let idleCheckArmed = false;
+	let readCount = 0;
+	let readPending = false;
 	let resolveTrailerReady, rejectTrailerReady;
 	const trailerReady = new Promise((resolve, reject) => {
 		resolveTrailerReady = resolve;
 		rejectTrailerReady = reject;
 	});
 	trailerReady.catch(() => { });
-	if (!outputSize) {
-		resolveTrailerReady();
-	}
-	const gzipWrapStream = new TransformStream({
-		start(controller) {
+	pump();
+	return new ReadableStream({
+		async pull(controller) {
+			let result;
+			try {
+				result = await read();
+			} catch (error) {
+				throw trailerWritten ? getTrailerError(error) : error;
+			}
+			const { value, done } = result;
+			if (done) {
+				controller.close();
+			} else {
+				outputLength += value.length;
+				if (outputLength > outputSize) {
+					const error = new Error(ERR_INVALID_UNCOMPRESSED_SIZE);
+					rejectTrailerReady(error);
+					await cancel(reader, error);
+					throw error;
+				}
+				if (outputCrc32) {
+					outputCrc32.append(value);
+				}
+				controller.enqueue(value);
+			}
+		},
+		cancel(reason) {
+			rejectTrailerReady(reason);
+			return reader.cancel(reason);
+		}
+	});
+
+	async function pump() {
+		const inputReader = readable.getReader();
+		try {
 			const header = new Uint8Array(GZIP_HEADER_LENGTH);
 			header.set(GZIP_HEADER_BYTES);
-			controller.enqueue(header);
-		},
-		transform(chunk, controller) {
-			controller.enqueue(chunk);
-		},
-		async flush(controller) {
+			await writer.write(header);
+			for (; ;) {
+				await writer.ready;
+				const { value, done } = await inputReader.read();
+				if (done) {
+					break;
+				}
+				await writer.write(value);
+			}
 			inputDone = true;
-			startWatchdog();
-			try {
+			if (outputCrc32) {
+				if (readPending) {
+					armIdleCheck();
+				}
 				await trailerReady;
-			} finally {
-				stopWatchdog();
 			}
 			const trailer = new Uint8Array(GZIP_TRAILER_LENGTH);
 			const dataView = getDataView(trailer);
-			dataView.setUint32(0, crc32.get(), true);
+			dataView.setUint32(0, outputCrc32 ? outputCrc32.get() : crc32, true);
 			dataView.setUint32(4, outputSize, true);
-			controller.enqueue(trailer);
-		},
-		cancel(reason) {
-			rejectTrailerReady(reason);
+			trailerWritten = true;
+			await writer.write(trailer);
+			await writer.close();
+		} catch (error) {
+			await abort(writer, error);
+			await cancel(inputReader, error);
 		}
-	});
-	const outputStream = new TransformStream({
-		transform(chunk, controller) {
-			crc32.append(chunk);
-			outputLength += chunk.length;
-			if (outputLength >= outputSize) {
-				resolveTrailerReady();
-			} else if (inputDone) {
-				startWatchdog();
-			}
-			controller.enqueue(chunk);
-		},
-		cancel(reason) {
-			rejectTrailerReady(reason);
+	}
+
+	function read() {
+		readCount++;
+		readPending = true;
+		const result = reader.read();
+		result.then(onReadSettled, onReadSettled);
+		if (inputDone && outputCrc32) {
+			armIdleCheck();
 		}
-	});
-	readable = pipeThrough(readable, gzipWrapStream);
-	readable = pipeThroughBackpressured(readable, gzipStream);
-	return pipeThrough(readable, outputStream);
+		return result;
+	}
 
-	function startWatchdog() {
-		stopWatchdog();
-		watchdogTimeout = setTimeout(() => rejectTrailerReady(new Error(ERR_INVALID_UNCOMPRESSED_SIZE)), GZIP_OUTPUT_STALL_TIMEOUT);
+	function onReadSettled() {
+		readPending = false;
 	}
 
-	function stopWatchdog() {
-		clearTimeout(watchdogTimeout);
+	async function armIdleCheck() {
+		if (!idleCheckArmed) {
+			idleCheckArmed = true;
+			const count = readCount;
+			await nextTask();
+			idleCheckArmed = false;
+			if (readPending) {
+				if (readCount == count) {
+					resolveTrailerReady();
+				} else {
+					armIdleCheck();
+				}
+			}
+		}
+	}
+
+	function getTrailerError(error) {
+		const trailerError = new Error(outputLength == outputSize ? ERR_INVALID_CRC32 : ERR_INVALID_UNCOMPRESSED_SIZE);
+		trailerError.cause = error;
+		return trailerError;
 	}
 }
 
+function nextTask() {
+	return new Promise(resolve => {
+		const { port1, port2 } = new MessageChannel();
+		port2.onmessage = () => {
+			port1.close();
+			port2.close();
+			resolve();
+		};
+		port1.postMessage(UNDEFINED_VALUE);
+	});
+}
+
 class InflateStream extends TransformStream {
 
 	constructor(options, { chunkSize, DecompressionStreamFallback, DecompressionStream }) {
 		super({});
 		const { zipCrypto, encrypted, checkCrc32, crc32, compressed, useCompressionStream, deflate64, format, compressionMethod, rawBitFlag, outputSize } = options;
-		let crc32Stream, decryptionStream;
+		let crc32Stream, decryptionStream, gzipCrc32;
 		let readable = super.readable;
 		if (encrypted) {
 			if (zipCrypto) {
@@ -2075,31 +2139,44 @@ class InflateStream extends TransformStream {
 			if (codecStreams) {
 				readable = pipeThroughBackpressured(readable, createCodecStream(codecStreams.DecompressionStream, format, { chunkSize, compressionMethod, rawBitFlag, uncompressedSize: outputSize }));
 			} else {
-				try {
-					readable = pipeThroughCompressionStream(readable, useCompressionStream, { chunkSize, deflate64 }, DecompressionStream, DecompressionStreamFallback);
-				} catch (error) {
-					if (deflate64 || outputSize === UNDEFINED_VALUE) {
-						throw error;
-					}
-					let gzipStream;
+				let gzipStream;
+				const GzipDecompressionStream = getGzipCodecStream(useCompressionStream, DecompressionStream, DecompressionStreamFallback);
+				if (checkCrc32 && !deflate64 && crc32 !== UNDEFINED_VALUE && outputSize !== UNDEFINED_VALUE && GzipDecompressionStream) {
 					try {
-						gzipStream = new DecompressionStream(FORMAT_GZIP$1);
+						gzipStream = new GzipDecompressionStream(FORMAT_GZIP$1, { chunkSize });
 					} catch {
-						throw error;
+						gzipStream = UNDEFINED_VALUE;
+					}
+				}
+				if (!gzipStream) {
+					try {
+						readable = pipeThroughCompressionStream(readable, useCompressionStream, { chunkSize, deflate64 }, DecompressionStream, DecompressionStreamFallback);
+					} catch (error) {
+						if (deflate64 || outputSize === UNDEFINED_VALUE || (!useCompressionStream && DecompressionStreamFallback)) {
+							throw error;
+						}
+						try {
+							gzipStream = new DecompressionStream(FORMAT_GZIP$1);
+						} catch {
+							throw error;
+						}
 					}
-					readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize);
+				}
+				if (gzipStream) {
+					gzipCrc32 = true;
+					readable = pipeThroughGzipDecompressionStream(readable, gzipStream, outputSize, crc32);
 				}
 			}
 			readable = mapInflateStreamError(readable);
 		}
-		if (checkCrc32) {
+		if (checkCrc32 && !gzipCrc32) {
 			crc32Stream = new Crc32Stream();
 			readable = pipeThrough(readable, crc32Stream);
 		}
 		setReadable(this, readable, () => {
-			if (checkCrc32) {
-				const computedCrc32View = new DataView(crc32Stream.value.buffer);
-				if (crc32 != computedCrc32View.getUint32(0, false)) {
+			if (crc32Stream) {
+				const computedCrc32 = new DataView(crc32Stream.value.buffer).getUint32(0, false);
+				if (crc32 != computedCrc32) {
 					throw new Error(ERR_INVALID_CRC32);
 				}
 			}
@@ -2155,6 +2232,14 @@ function createCodecStream(CodecStreamClass, format, options) {
 	return new CodecStreamClass(format, options);
 }
 
+function getGzipCodecStream(useCompressionStream, CodecStreamNative, CodecStreamFallback) {
+	if (useCompressionStream && CodecStreamNative) {
+		return CodecStreamNative;
+	} else if (CodecStreamFallback && CodecStreamFallback.requiresModule) {
+		return CodecStreamFallback;
+	}
+}
+
 function pipeThroughCompressionStream(readable, useCompressionStream, options, CompressionStreamNative, CompressionStreamFallback) {
 	const Stream = useCompressionStream && CompressionStreamNative ?
 		CompressionStreamNative :
@@ -2527,10 +2612,12 @@ class CodecWorker {
 							workerData.terminated = true;
 							worker.terminate();
 						}
-						terminateResolvers.forEach(resolve => resolve());
 					}
 					workerData.busy = false;
-					onTaskFinished(workerData);
+					const pendingTasks = onTaskFinished(workerData);
+					if (terminateResolvers) {
+						terminateResolvers.forEach(resolve => resolve(pendingTasks));
+					}
 				}
 			}
 		});
@@ -3215,7 +3302,10 @@ async function runWorker(stream, workerOptions) {
 
 	function onTaskFinished(workerData) {
 		clearStarvationTimeout();
-		if (pendingRequests.length) {
+		if (workerData.terminated) {
+			workerData.terminated = false;
+			return runPendingRequestsInline();
+		} else if (pendingRequests.length) {
 			const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
 			resolve(new CodecWorker(workerData, stream, workerOptions, onTaskFinished));
 			armStarvationTimeout();
@@ -3253,12 +3343,26 @@ function onWorkerStarvation() {
 	starvationTimeout = null;
 	if (pendingRequests.length) {
 		const [{ resolve, stream, workerOptions }] = pendingRequests.splice(0, 1);
-		const inlineWorkerOptions = Object.assign({}, workerOptions, { useWebWorkers: false, workerURI: UNDEFINED_VALUE, createWorker: UNDEFINED_VALUE });
-		resolve(new CodecWorker({}, stream, inlineWorkerOptions, onInlineTaskFinished));
+		resolve(new CodecWorker({}, stream, getInlineWorkerOptions(workerOptions), onInlineTaskFinished));
 		armStarvationTimeout();
 	}
 }
 
+function runPendingRequestsInline() {
+	const tasks = pendingRequests.splice(0).map(({ resolve, stream, workerOptions }) => new Promise(resolveTask => {
+		resolve(new CodecWorker({}, stream, getInlineWorkerOptions(workerOptions), () => {
+			onInlineTaskFinished();
+			resolveTask();
+		}));
+	}));
+	clearStarvationTimeout();
+	return Promise.all(tasks);
+}
+
+function getInlineWorkerOptions(workerOptions) {
+	return Object.assign({}, workerOptions, { useWebWorkers: false, workerURI: UNDEFINED_VALUE, createWorker: UNDEFINED_VALUE });
+}
+
 function onInlineTaskFinished() {
 	clearStarvationTimeout();
 	armStarvationTimeout();
@@ -3268,18 +3372,14 @@ function terminateWorker(workerData, workerOptions) {
 	const { config } = workerOptions;
 	const { terminateWorkerTimeout } = config;
 	if (Number.isFinite(terminateWorkerTimeout) && terminateWorkerTimeout >= 0) {
-		if (workerData.terminated) {
-			workerData.terminated = false;
-		} else {
-			workerData.terminateTimeout = setTimeout(async () => {
-				pool = pool.filter(data => data != workerData);
-				try {
-					await workerData.terminate();
-				} catch {
-					// ignored
-				}
-			}, terminateWorkerTimeout);
-		}
+		workerData.terminateTimeout = setTimeout(async () => {
+			pool = pool.filter(data => data != workerData);
+			try {
+				await workerData.terminate();
+			} catch {
+				// ignored
+			}
+		}, terminateWorkerTimeout);
 	}
 }
 
@@ -3292,10 +3392,13 @@ function clearTerminateTimeout(workerData) {
 }
 
 async function terminateWorkers() {
-	await Promise.allSettled(pool.map(workerData => {
-		clearTerminateTimeout(workerData);
-		return workerData.terminate();
-	}));
+	await Promise.allSettled([
+		runPendingRequestsInline(),
+		...pool.map(workerData => {
+			clearTerminateTimeout(workerData);
+			return workerData.terminate();
+		})
+	]);
 	resetWebWorkerSupport();
 }
 
@@ -3370,6 +3473,19 @@ function decodeText(value, encoding) {
 	return decode(value, encoding, true);
 }
 
+function isUTF8Text(value) {
+	if (value.some(byte => byte > 0x7f)) {
+		try {
+			new TextDecoder("utf-8", { fatal: true }).decode(value);
+			return true;
+		} catch {
+			return false;
+		}
+	} else {
+		return false;
+	}
+}
+
 function decodeTextRemovingBOM(value, encoding) {
 	return decode(value, encoding, false);
 }
@@ -3702,10 +3818,11 @@ class FetchReader extends Reader {
 
 	createReadable(options) {
 		const reader = this;
-		const { useRangeHeader, forceRangeRequests, size } = reader;
+		const { useRangeHeader, forceRangeRequests, size, eocdCache } = reader;
 		if ((useRangeHeader || forceRangeRequests) && size !== UNDEFINED_VALUE) {
 			const { offset = 0, size: readSize = size - offset } = options || {};
-			if (readSize > 0 && offset < size) {
+			const cached = eocdCache && offset >= size - eocdCache.length;
+			if (readSize > 0 && offset < size && !cached) {
 				return createRangeReadable(reader, offset, Math.min(readSize, size - offset));
 			}
 		}
@@ -4659,6 +4776,7 @@ const WARNING_MISMATCHED_LOCAL_FILE_HEADER_COMPRESSION_METHOD = "mismatched loca
 const WARNING_MISMATCHED_LOCAL_FILE_HEADER_CRC32_OR_SIZES = "mismatched local file header (crc32 or sizes)";
 const MAX_KNOWN_VERSION = 63;
 const DRIVE_LETTER_REGEXP = /^[a-zA-Z]:/;
+const PARENT_DIRECTORY_REGEXP = /(^|[\\/])\.\.([\\/]|$)/;
 const CHARSET_UTF8 = "utf-8";
 const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 const CHARSET_CP437 = "cp437";
@@ -4911,12 +5029,13 @@ class ZipReader {
 			const versionMadeBy = getUint16$1(directoryView, offset + 4);
 			const msDosCompatible = versionMadeBy >> 8 == 0;
 			const unixCompatible = versionMadeBy >> 8 == 3;
-			const rawFilename = directoryArray.subarray(filenameOffset, extraFieldOffset);
 			const commentLength = getUint16$1(directoryView, offset + 32);
 			const endOffset = commentOffset + commentLength;
-			const rawComment = directoryArray.subarray(commentOffset, endOffset);
-			const filenameUTF8 = languageEncodingFlag;
-			const commentUTF8 = languageEncodingFlag;
+			const rawEntryData = new Uint8Array(directoryArray.subarray(filenameOffset, endOffset));
+			const rawFilename = rawEntryData.subarray(0, fileEntry.filenameLength);
+			const rawComment = rawEntryData.subarray(fileEntry.filenameLength + fileEntry.extraFieldLength);
+			const filenameUTF8 = languageEncodingFlag || (!filenameEncoding && isUTF8Text(rawFilename));
+			const commentUTF8 = languageEncodingFlag || (!commentEncoding && isUTF8Text(rawComment));
 			const externalFileAttributes = getUint32$1(directoryView, offset + 38);
 			const msdosAttributesRaw = externalFileAttributes & MAX_8_BITS;
 			const msdosAttributes = {
@@ -4967,7 +5086,7 @@ class ZipReader {
 				rawFilename,
 				filenameUTF8,
 				commentUTF8,
-				rawExtraField: directoryArray.subarray(extraFieldOffset, commentOffset),
+				rawExtraField: rawEntryData.subarray(fileEntry.filenameLength, fileEntry.filenameLength + fileEntry.extraFieldLength),
 				rawComment,
 				filename,
 				comment
@@ -5475,7 +5594,7 @@ function readDigitalSignature(signatureRecordArray) {
 		if (getUint32$1(signatureRecordView, 0) == DIGITAL_SIGNATURE_RECORD_SIGNATURE) {
 			const signatureDataLength = getUint16$1(signatureRecordView, 4);
 			if (6 + signatureDataLength <= signatureRecordArray.length) {
-				return signatureRecordArray.subarray(6, 6 + signatureDataLength);
+				return new Uint8Array(signatureRecordArray.subarray(6, 6 + signatureDataLength));
 			}
 		}
 	}
@@ -5998,10 +6117,10 @@ function isUnsafeFilename(filename, filenameValidation) {
 	if (pathParts.length > 1 && pathParts[pathParts.length - 1] === "") {
 		pathParts.pop();
 	}
-	if (pathParts.includes("..") || filename.startsWith("/") || filename.startsWith("\\\\") || DRIVE_LETTER_REGEXP.test(filename)) {
+	if (PARENT_DIRECTORY_REGEXP.test(filename) || filename.startsWith("/") || filename.startsWith("\\") || DRIVE_LETTER_REGEXP.test(filename)) {
 		return true;
 	}
-	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes(""));
+	return filenameValidation == STRICTNESS_STRICT && (pathParts.includes(".") || pathParts.includes("") || filename.includes("\0"));
 }
 
 function getMaxAppendedDataSize(maxAppendedDataSize, strictness) {
@@ -6087,7 +6206,7 @@ async function* scanEndOfCentralDirectory(reader, scanLength) {
 }
 
 function getEndOfCentralDirectoryInfo(scanArray, indexByte, offset) {
-	return { offset, buffer: scanArray.slice(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH).buffer };
+	return { offset, buffer: new Uint8Array(scanArray.subarray(indexByte, indexByte + END_OF_CENTRAL_DIR_LENGTH)).buffer };
 }
 
 async function getCentralDirectoryReachability(reader, view, anchoredOffset, indexByte, offset, size, remoteProbeBudget) {
@@ -8734,7 +8853,7 @@ function formatSupported(StreamClass, format) {
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-const VERSION = "2.14.1";
+const VERSION = "2.16.0";
 
 /*
  Copyright (c) 2025 Gildas Lormeau. All rights reserved.