Repository navigation
fix: consume the whole extended timestamp field in the central header - #1016
Merged
Its-Just-Nans merged 3 commits intoSep 29, 2026
Merged
Conversation
parse_central_header read the modification time only when the field was exactly 4 bytes after the flags, and read nothing otherwise. ExtraFields parses every field from one cursor, so a central 0x5455 field of length 9 or 13 (a writer that copies the local field, which Python's zipfile and FullFileOptions::add_extra_data both do) left 8 or 12 bytes that were then read as the next field header, and ZipArchive::new failed with "Extra field content truncated". Read the modification time when present and skip the rest, as parse_local_header already does.
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The parsing fix and regression coverage are complete with no unresolved blocking issues.
Review effort: Lite
Findings: None
What changed in this PR
Fixes central-directory extended timestamp parsing to consume the complete field while preserving the modification time.
Changes:
- Reads timestamps from fields at least four bytes long.
- Skips trailing bytes to preserve parser alignment.
- Adds regression coverage for extended fields.
| File | Description |
|---|---|
src/extra_fields/extended_timestamp.rs |
Fixes central-header parsing and adds regression tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: n4n5 <git@n4n5.dev>
Merged
Member
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1002 split out
parse_central_header, which reads the modification time only when the field is exactly 4 bytes after the flags and reads nothing otherwise.ExtraFields::parsewalks one cursor across all fields, so a central 0x5455 field of length 9 or 13 leaves 8 or 12 bytes that are read as the next field's header. Such fields come from any writer that copies the local field into the central directory, including this crate:An archive written by Python's
zipfilewith the same field fails the same way. This reads the modification time when there are at least 4 bytes and skips the rest, asparse_local_headeralready does with the same comment. The regression is not in a release yet (latest is 9.0.0-pre3).One behaviour to note: before #1002 a length-9 central field also reported
accessed; after this it reportsNone, as #1002 intended for the central header.Verification
Base
c5e58bcc. New case in the existingtest_extended_timestamp_in_central_header.extended_timestamp.rsmd58ba15635mod_timeisNoneab90196aadd3d132==instead of>=b2c57928mod_time>instead of>=32f50a48On stable:
cargo fmt --all -- --check;cargo clippy --all-targets -- -D warningswith--no-default-features, default and--all-features;cargo test --allwith each of the three (35 result blocks each, 0 failed);cargo doc --no-depswith default and--all-features. On 1.88 (MSRV):cargo buildwith--no-default-featuresand default.cargo doc --no-default-featuresreports two unresolved intra-doc links toCompressionMethod::Bzip2and::Deflated, identical on master. Not run: nightly, Windows and macOS, Miri, wasm and the fuzz job.Written with AI assistance (Claude); the measurements above were run locally and I have reviewed the change.