From 9ef68e2d93307ea5e38c29b3d61eba3b7002da37 Mon Sep 17 00:00:00 2001 From: PobreGato <315121269+pobregat0@users.noreply.github.com> Date: Mon, 31 Aug 2026 02:33:05 +0300 Subject: [PATCH] stop parsing a truncated zip in reseed instead of looping forever --- libi2pd/Reseed.cpp | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/libi2pd/Reseed.cpp b/libi2pd/Reseed.cpp index ee02a953..ca679911 100644 --- a/libi2pd/Reseed.cpp +++ b/libi2pd/Reseed.cpp @@ -330,7 +330,9 @@ namespace data { int numFiles = 0; size_t contentPos = s.tellg (); - while (!s.eof ()) + // not !eof: seekg clears eofbit, so a stream broken in the middle of a + // header stays not-eof forever and the loop never ends + while (s.good ()) { uint32_t signature; s.read ((char *)&signature, 4); @@ -357,13 +359,18 @@ namespace data uint16_t fileNameLength, extraFieldLength; s.read ((char *)&fileNameLength, 2); fileNameLength = le16toh (fileNameLength); + s.read ((char *)&extraFieldLength, 2); + extraFieldLength = le16toh (extraFieldLength); + if (!s.good ()) + { + LogPrint (eLogError, "Reseed: Truncated zip local file header"); + return numFiles; + } if ( fileNameLength >= 255 ) { // too big LogPrint(eLogError, "Reseed: SU3 fileNameLength too large: ", fileNameLength); return numFiles; } - s.read ((char *)&extraFieldLength, 2); - extraFieldLength = le16toh (extraFieldLength); char localFileName[255]; s.read (localFileName, fileNameLength); localFileName[fileNameLength] = 0;