@@ -11,18 +11,26 @@ use crate::result::{ZipError, ZipResult, invalid, invalid_archive_const};
 use crate::unstable::LittleEndianReadExt;
 
 /// AeX Encryption extra field
-#[derive(Copy, Clone, Debug, PartialEq)]
+#[derive(Copy, Clone, Debug, Eq)]
 pub struct AexEncryption {
     /// aes vendor
     pub(crate) aes_vendor_version: AesVendorVersion,
     /// aes mode
     pub(crate) aes_mode: AesMode,
     /// inner compression
     pub(crate) compression_method: CompressionMethod,
-    /// aes extra field start index
+    /// aes extra field start index (not written to the archive, therefore ignored by PartialEq)
     pub(crate) aes_extra_field_start: Option<usize>,
 }
 
+impl PartialEq for AexEncryption {
+    fn eq(&self, other: &Self) -> bool {
+        self.aes_vendor_version == other.aes_vendor_version
+            && self.aes_mode == other.aes_mode
+            && self.compression_method == other.compression_method
+    }
+}
+
 impl AexEncryption {
     /// Field Header ID
     pub(crate) const EXTRA_FIELD_ID: u16 = UsedExtraField::AeXEncryption.as_u16();
 
@@ -239,6 +239,11 @@ impl ExtraField {
 
 impl ZipFileData {
     pub(crate) fn apply_extra_fields(&mut self, file_name_raw: &mut Vec<u8>) -> ZipResult<()> {
+        #[cfg(feature = "aes-crypto")]
+        let mut has_aes = false;
+        let mut orig_name_crc = None;
+        let mut orig_comment_crc = None;
+
         for one_extra_field in &self.extra_fields.inner {
             match one_extra_field {
                 // Zip64 extended information extra field
@@ -260,6 +265,12 @@ impl ZipFileData {
                 ExtraField::AeXEncryption(AexEncryption {
                     compression_method, ..
                 }) => {
+                    if has_aes || self.compression_method != crate::CompressionMethod::Aes {
+                        return Err(invalid!(
+                            "AES extra field present without AES compression method (99)"
+                        ));
+                    }
+                    has_aes = true;
                     self.compression_method = *compression_method;
                 }
                 ExtraField::UnicodeComment(unicode) => {
@@ -268,7 +279,9 @@ impl ZipFileData {
                     // If the CRC check fails, this Unicode Comment extra field SHOULD be ignored and
                     // the File Comment field in the header SHOULD be used instead.
                     // Check if the comment is UTF-8
-                    if unicode.is_crc32_valid(self.file_comment.as_bytes())
+                    let crc = *orig_comment_crc
+                        .get_or_insert_with(|| crc32fast::hash(self.file_comment.as_bytes()));
+                    if unicode.crc32 == crc
                         && let Ok(comment) = String::from_utf8(unicode.content.to_vec())
                     {
                         self.file_comment = comment.into_boxed_str();
@@ -280,9 +293,8 @@ impl ZipFileData {
                     // APPNOTE 4.6.9 and https://libzip.org/specifications/extrafld.txt
                     // If the CRC check fails, this UTF-8 Path Extra Field SHOULD be ignored and
                     // the File Name field in the header SHOULD be used instead.
-                    if unicode.is_crc32_valid(file_name_raw)
-                        && std::str::from_utf8(&unicode.content).is_ok()
-                    {
+                    let crc = *orig_name_crc.get_or_insert_with(|| crc32fast::hash(file_name_raw));
+                    if unicode.crc32 == crc && std::str::from_utf8(&unicode.content).is_ok() {
                         *file_name_raw = unicode.content.to_vec();
                         self.flags |= ZipFlags::LanguageEncoding.as_u16();
                     }
 
@@ -7,7 +7,7 @@ use std::io::{Read, Write};
 /// specified in APPNOTE 4.6.8 and 4.6.9
 #[derive(Clone, Debug, PartialEq)]
 pub struct UnicodeExtraField {
-    crc32: u32,
+    pub(crate) crc32: u32,
     pub(crate) content: Box<[u8]>,
 }
 
@@ -30,12 +30,6 @@ impl UnicodeExtraField {
         Ok(self.content)
     }
 
-    /// Check if the crc32 is valid
-    pub(crate) fn is_crc32_valid(&self, ascii_field: &[u8]) -> bool {
-        let computed_crc32 = crc32fast::hash(ascii_field);
-        self.crc32 == computed_crc32
-    }
-
     pub(crate) fn try_from_reader<R: Read>(reader: &mut R, len: u16) -> ZipResult<Self> {
         // Read and discard version byte
         reader.read_exact(&mut [0u8])?;
 
@@ -266,6 +266,8 @@ pub struct ZipReadOptions<'a> {
     /// The uncompressed size is not known (streamed entry with a data descriptor), so it
     /// can't bound the output.
     pub(crate) size_unknown: bool,
+    /// Enforce consistency between the local file header and central directory header.
+    pub(crate) enforce_header_consistency: bool,
 }
 
 impl<'a> ZipReadOptions<'a> {
@@ -316,4 +318,179 @@ impl<'a> ZipReadOptions<'a> {
         self.force_crc = Some(crc);
         self
     }
+
+    /// Enforces that the local file header (LFH) matches the central directory header (CDFH).
+    #[must_use]
+    pub fn enforce_header_consistency(mut self, enforce: bool) -> Self {
+        self.enforce_header_consistency = enforce;
+        self
+    }
+}
+
+/// Helper to extract Info-ZIP UnicodePath (0x7075) extra field content and CRC32.
+pub(crate) fn get_upath(extra_fields: &ExtraFields) -> (Option<&[u8]>, Option<u32>) {
+    extra_fields
+        .inner
+        .iter()
+        .rev()
+        .find_map(|f| match f {
+            ExtraField::UnicodePath(u) => Some((&*u.content, u.crc32)),
+            _ => None,
+        })
+        .unzip()
+}
+
+/// Data descriptor / payload metadata (CRC32 and sizes) that can be verified either
+/// immediately or after reading a data descriptor.
+#[derive(Debug, Copy, Clone, PartialEq, Eq, Default)]
+pub(crate) struct HeaderDataDescriptorMetadata {
+    pub(crate) crc32: u32,
+    pub(crate) compressed_size: u64,
+    pub(crate) uncompressed_size: u64,
+    pub(crate) is_pending_data_descriptor: bool,
+}
+
+impl HeaderDataDescriptorMetadata {
+    /// Validates data descriptor fields between local and central headers.
+    pub(crate) fn validate_matches(&self, central: &Self) -> ZipResult<()> {
+        if self.crc32 != central.crc32 && (!self.is_pending_data_descriptor || self.crc32 != 0) {
+            return Err(invalid!(
+                "header inconsistency detected: CRC32 checksum mismatch (does not match central directory)"
+            ));
+        }
+
+        if self.compressed_size != central.compressed_size
+            && (!self.is_pending_data_descriptor || self.compressed_size != 0)
+        {
+            return Err(invalid!(
+                "header inconsistency detected: compressed size mismatch (does not match central directory)"
+            ));
+        }
+
+        if self.uncompressed_size != central.uncompressed_size
+            && (!self.is_pending_data_descriptor || self.uncompressed_size != 0)
+        {
+            return Err(invalid!(
+                "header inconsistency detected: uncompressed size mismatch (does not match central directory)"
+            ));
+        }
+
+        Ok(())
+    }
+}
+
+/// Unified header metadata used to validate consistency between Local and Central headers.
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct HeaderConsistencyMetadata<T: AsRef<[u8]>, U: AsRef<[u8]> = T> {
+    pub(crate) name: T,
+    pub(crate) upath: Option<U>,
+    pub(crate) upath_crc32: Option<u32>,
+    pub(crate) compression_method: u16,
+    pub(crate) is_encrypted: bool,
+    pub(crate) is_using_data_descriptor: bool,
+    pub(crate) last_modified_time: Option<DateTime>,
+    pub(crate) data: HeaderDataDescriptorMetadata,
+    #[cfg(feature = "aes-crypto")]
+    pub(crate) aes: Option<crate::extra_fields::AexEncryption>,
+}
+
+impl HeaderConsistencyMetadata<&[u8]> {
+    pub(crate) fn into_owned(self) -> HeaderConsistencyMetadata<Box<[u8]>> {
+        HeaderConsistencyMetadata {
+            name: self.name.into(),
+            upath: self.upath.map(Into::into),
+            upath_crc32: self.upath_crc32,
+            compression_method: self.compression_method,
+            is_encrypted: self.is_encrypted,
+            is_using_data_descriptor: self.is_using_data_descriptor,
+            last_modified_time: self.last_modified_time,
+            data: self.data,
+            #[cfg(feature = "aes-crypto")]
+            aes: self.aes,
+        }
+    }
+}
+
+impl<T: AsRef<[u8]>, U: AsRef<[u8]>> HeaderConsistencyMetadata<T, U> {
+    /// Validates header identity (filename, UnicodePath, compression method, and flags).
+    pub(crate) fn validate_identity_matches<T2: AsRef<[u8]>, U2: AsRef<[u8]>>(
+        &self,
+        central: &HeaderConsistencyMetadata<T2, U2>,
+    ) -> ZipResult<()> {
+        let local_effective = self
+            .upath
+            .as_ref()
+            .map(AsRef::as_ref)
+            .unwrap_or_else(|| self.name.as_ref());
+
+        if self.upath.as_ref().map(AsRef::as_ref) != central.upath.as_ref().map(AsRef::as_ref)
+            || self.upath_crc32 != central.upath_crc32
+        {
+            return Err(invalid!(
+                "header inconsistency detected: UnicodePath (0x7075) extra field mismatch for '{}'",
+                String::from_utf8_lossy(local_effective)
+            ));
+        }
+
+        if self.name.as_ref() != central.name.as_ref() {
+            return Err(invalid!(
+                "header inconsistency detected: Local file header filename mismatch (does not match central directory)"
+            ));
+        }
+
+        if self.compression_method != central.compression_method {
+            return Err(invalid!(
+                "header inconsistency detected: compression method mismatch (does not match central directory)"
+            ));
+        }
+
+        if self.is_encrypted != central.is_encrypted {
+            return Err(invalid!(
+                "header inconsistency detected: encryption flag mismatch for '{}'",
+                String::from_utf8_lossy(self.name.as_ref())
+            ));
+        }
+
+        if self.is_using_data_descriptor != central.is_using_data_descriptor {
+            return Err(invalid!(
+                "header inconsistency detected: data descriptor flag mismatch for '{}'",
+                String::from_utf8_lossy(self.name.as_ref())
+            ));
+        }
+
+        if self.last_modified_time != central.last_modified_time {
+            return Err(invalid!(
+                "header inconsistency detected: last modified time mismatch for '{}'",
+                String::from_utf8_lossy(self.name.as_ref())
+            ));
+        }
+
+        #[cfg(feature = "aes-crypto")]
+        if self.aes != central.aes {
+            return Err(invalid!(
+                "header inconsistency detected: AES encryption metadata mismatch for '{}'",
+                String::from_utf8_lossy(self.name.as_ref())
+            ));
+        }
+
+        Ok(())
+    }
+
+    /// Validates data descriptor and payload consistency.
+    pub(crate) fn validate_data_matches<T2: AsRef<[u8]>, U2: AsRef<[u8]>>(
+        &self,
+        central: &HeaderConsistencyMetadata<T2, U2>,
+    ) -> ZipResult<()> {
+        self.data.validate_matches(&central.data)
+    }
+
+    /// Validates that local header metadata matches central directory metadata.
+    pub(crate) fn validate_matches<T2: AsRef<[u8]>, U2: AsRef<[u8]>>(
+        &self,
+        central: &HeaderConsistencyMetadata<T2, U2>,
+    ) -> ZipResult<()> {
+        self.validate_identity_matches(central)?;
+        self.validate_data_matches(central)?;
+        Ok(())
+    }
 }