@zip.js/zip.js 2.18.0 → 2.18.2

package/index.cjs

@@ -6027,32 +6027,19 @@ async function detectOverlappingEntry({
 }) {
 	let dataDescriptorLength = 0;
 	if (dataDescriptor) {
-		if (extraFieldZip64) {
-			dataDescriptorLength = DATA_DESCRIPTOR_RECORD_ZIP_64_LENGTH;
-		} else {
-			dataDescriptorLength = DATA_DESCRIPTOR_RECORD_LENGTH;
-		}
-	}
-	if (dataDescriptorLength) {
-		const dataDescriptorArray = await readUint8Array(reader, dataOffset + compressedSize, dataDescriptorLength + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH);
+		const zip64 = Boolean(extraFieldZip64);
+		const dataDescriptorArray = await readUint8Array(reader, dataOffset + compressedSize, DATA_DESCRIPTOR_RECORD_ZIP_64_LENGTH + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH);
 		const dataDescriptorView = getDataView(dataDescriptorArray);
-		let signature = dataDescriptorArray.length == dataDescriptorLength + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH &&
-			getUint32$1(dataDescriptorView, 0) == DATA_DESCRIPTOR_RECORD_SIGNATURE;
-		if (signature) {
-			const signedDataDescriptor = readDataDescriptor(dataDescriptorView, DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH, extraFieldZip64);
-			const matchCrc32 = (fileEntry.encrypted && !fileEntry.zipCrypto) || signedDataDescriptor.crc32 == crc32;
-			if (matchCrc32 &&
-				signedDataDescriptor.compressedSize == compressedSize &&
-				signedDataDescriptor.uncompressedSize == uncompressedSize) {
-				dataDescriptorLength += DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH;
-			} else {
-				signature = false;
-			}
-		}
-		if (dataDescriptorArray.length >= dataDescriptorLength) {
-			const localDataDescriptor = readDataDescriptor(dataDescriptorView, signature ? DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH : 0, extraFieldZip64);
-			localDataDescriptor.signature = signature;
+		const candidates = [[zip64, true], [zip64, false], [!zip64, true], [!zip64, false]]
+			.map(([zip64Layout, signature]) => readDataDescriptor(dataDescriptorView, zip64Layout, signature))
+			.filter(candidate => candidate && candidate.compressedSize == compressedSize && candidate.uncompressedSize == uncompressedSize);
+		const localDataDescriptor = candidates.find(candidate => candidate.crc32 == crc32) || candidates[0] ||
+			readDataDescriptor(dataDescriptorView, zip64, true) || readDataDescriptor(dataDescriptorView, zip64, false);
+		if (localDataDescriptor) {
 			fileEntry.localDirectory.dataDescriptor = localDataDescriptor;
+			dataDescriptorLength = getDataDescriptorLength(localDataDescriptor.zip64, localDataDescriptor.signature);
+		} else {
+			dataDescriptorLength = getDataDescriptorLength(zip64, false);
 		}
 	}
 	const range = {
@@ -6117,18 +6104,31 @@ function mergeRanges(sortedRanges, pendingRanges) {
 	return mergedRanges;
 }
 
-function readDataDescriptor(dataDescriptorView, offset, extraFieldZip64) {
+function readDataDescriptor(dataDescriptorView, zip64, signature) {
+	const offset = signature ? DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH : 0;
+	if (dataDescriptorView.byteLength < getDataDescriptorLength(zip64, signature) ||
+		(signature && getUint32$1(dataDescriptorView, 0) != DATA_DESCRIPTOR_RECORD_SIGNATURE)) {
+		return UNDEFINED_VALUE;
+	}
 	const crc32 = getUint32$1(dataDescriptorView, offset);
 	let compressedSize;
 	let uncompressedSize;
-	if (extraFieldZip64) {
-		compressedSize = getBigUint64(dataDescriptorView, offset + 4);
-		uncompressedSize = getBigUint64(dataDescriptorView, offset + 12);
-	} else {
-		compressedSize = getUint32$1(dataDescriptorView, offset + 4);
-		uncompressedSize = getUint32$1(dataDescriptorView, offset + 8);
+	try {
+		if (zip64) {
+			compressedSize = getBigUint64(dataDescriptorView, offset + 4);
+			uncompressedSize = getBigUint64(dataDescriptorView, offset + 12);
+		} else {
+			compressedSize = getUint32$1(dataDescriptorView, offset + 4);
+			uncompressedSize = getUint32$1(dataDescriptorView, offset + 8);
+		}
+	} catch {
+		return UNDEFINED_VALUE;
 	}
-	return { crc32, compressedSize, uncompressedSize };
+	return { signature, zip64, crc32, compressedSize, uncompressedSize };
+}
+
+function getDataDescriptorLength(zip64, signature) {
+	return (zip64 ? DATA_DESCRIPTOR_RECORD_ZIP_64_LENGTH : DATA_DESCRIPTOR_RECORD_LENGTH) + (signature ? DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH : 0);
 }
 
 function getDiskOffset$1(reader, diskNumber) {
@@ -9049,7 +9049,7 @@ function formatSupported(StreamClass, format) {
  EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-const VERSION = "2.18.0";
+const VERSION = "2.18.2";
 
 /*
  Copyright (c) 2025 Gildas Lormeau. All rights reserved.

package/index.d.cts

@@ -2240,10 +2240,23 @@ export interface LocalDataDescriptor {
    * `true` if the record is preceded by its optional signature.
    *
    * The signature is not part of the original format, it is a later convention writers are free to follow. It is
-   * reported as absent when the values following it disagree with the central directory, since the record is then
-   * read as starting at the first byte.
+   * `false` when the record is read as starting at its first byte, see {@link LocalDataDescriptor#zip64} for how the
+   * layout is chosen.
    */
   signature: boolean;
+  /**
+   * `true` if the sizes are stored as 8-byte values.
+   *
+   * Neither record tells the width reliably: the local file header is written before a streaming writer knows the
+   * sizes, and the Zip64 extra field of the central directory record, written last, describes that record, not the
+   * descriptor, so e.g. an entry placed past 4 GB can carry a Zip64 extra field in its central directory record for
+   * its offset alone and a descriptor with 4-byte sizes. The record is therefore read with the layout, among the two
+   * widths with and without the signature, whose sizes agree with the central directory, its CRC-32 too when the
+   * central directory stores one and several layouts qualify; when none does, the width announced by the Zip64 extra
+   * field of the local file header or of the central directory record is used, with the signature when the record
+   * starts with one.
+   */
+  zip64: boolean;
   /**
    * The CRC-32 checksum stored in the record, which is allowed to differ from {@link EntryMetaData#crc32}.
    */

package/index.d.ts

@@ -2240,10 +2240,23 @@ export interface LocalDataDescriptor {
    * `true` if the record is preceded by its optional signature.
    *
    * The signature is not part of the original format, it is a later convention writers are free to follow. It is
-   * reported as absent when the values following it disagree with the central directory, since the record is then
-   * read as starting at the first byte.
+   * `false` when the record is read as starting at its first byte, see {@link LocalDataDescriptor#zip64} for how the
+   * layout is chosen.
    */
   signature: boolean;
+  /**
+   * `true` if the sizes are stored as 8-byte values.
+   *
+   * Neither record tells the width reliably: the local file header is written before a streaming writer knows the
+   * sizes, and the Zip64 extra field of the central directory record, written last, describes that record, not the
+   * descriptor, so e.g. an entry placed past 4 GB can carry a Zip64 extra field in its central directory record for
+   * its offset alone and a descriptor with 4-byte sizes. The record is therefore read with the layout, among the two
+   * widths with and without the signature, whose sizes agree with the central directory, its CRC-32 too when the
+   * central directory stores one and several layouts qualify; when none does, the width announced by the Zip64 extra
+   * field of the local file header or of the central directory record is used, with the signature when the record
+   * starts with one.
+   */
+  zip64: boolean;
   /**
    * The CRC-32 checksum stored in the record, which is allowed to differ from {@link EntryMetaData#crc32}.
    */