--- a/jdk/src/share/classes/java/util/zip/ZipOutputStream.java Wed Aug 28 15:50:03 2013 +0100
+++ b/jdk/src/share/classes/java/util/zip/ZipOutputStream.java Wed Aug 28 09:46:55 2013 -0700
@@ -663,6 +663,9 @@
while (off + 4 <= len) {
int tag = get16(extra, off);
int sz = get16(extra, off + 2);
+ if (sz < 0 || (off + 4 + sz) > len) {
+ break;
+ }
if (tag == EXTID_EXTT || tag == EXTID_ZIP64) {
skipped += (sz + 4);
}
@@ -684,11 +687,18 @@
while (off + 4 <= len) {
int tag = get16(extra, off);
int sz = get16(extra, off + 2);
+ if (sz < 0 || (off + 4 + sz) > len) {
+ writeBytes(extra, off, len - off);
+ return;
+ }
if (tag != EXTID_EXTT && tag != EXTID_ZIP64) {
writeBytes(extra, off, sz + 4);
}
off += (sz + 4);
}
+ if (off < len) {
+ writeBytes(extra, off, len - off);
+ }
}
}