|
I try to add a new file in a existing zip with the following commands:
hz = OpenZip(pszArchive2, 0, ZIP_FILENAME);
if(ZipAdd(hz, pszName3, pszName3, 0, ZIP_FILENAME) == ZR_OK)
{
m_List.Printf(CXListBox::Red, CXListBox::White, 0,
_T(" Am adaugat in arhiva"));
}
else
{
m_List.Printf(CXListBox::Red, CXListBox::White, 0,
_T(" Nu am adaugat in arhiva"));
}
CloseZip(hz);
but this things doesn.t work.
How can I add a new file in a existing zip????
|
|
|
|
|
In TUnzip::Get the evaluation of ufi.external_fa returns invalid results, if the upper half (unix attributes) is not set at all for some reason (=0x0000xxxx). In this case uwritable gets false and later FILE_ATTRIBUTE_READONLY is set.
I think, if the unix attributes are not set at all, you should not evaluate them. Obviously e.g. Winzip or the Windows-XP-Buildt-In-Zip are able to handle missing unix attributes correcltly.
By the way, I have created the zip file with the missing unix attributes with the so called internal zip of "Total Comander 5.51".
Thomas Haase
|
|
|
|
|
Is it possible to create multiple archives. (e.g. 1.44mb)
Thanks,
Marco
|
|
|
|
|
line 3652 :
if (err==Z_STREAM_END) return (iRead==0) ? UNZ_EOF : iRead;
to
if (err==Z_STREAM_END) return (iRead==<code>len</code>) ? UNZ_EOF : iRead;
As iRead is an accumulator of the ZIP output buffer, if Z_STREAM_END is reached, UNZ_EOF is get if the total output bytes equal the expected len !
Kochise
PS : Especialy in ZIP_MEMORY mode !!!
In Code we trust !
|
|
|
|
|
This code is part of zlib, and I assume that is well tested.
Thomas Haase
|
|
|
|
|
Thanks Kochise
This is definitely a bug.
|
|
|
|
|
For some unknown reasons, I inflate a CAB file with odd (300937 bytes) size.
err=inflate(&pfile_in_zip_read_info->stream,flush); The previous line returns me Z_OK intead of Z_STREAM_END at the end of the zipped file, so it fails to the following line in int unzReadCurrentFile :
if (err==Z_OK) return iRead; The problem is it returns the size of the uncompressed file (300937 bytes) in ZRESULT TUnzip::Unzip, which believes there still something to read there :
if (res>0) return ZR_MORE; Just replace this line at the end of int unzReadCurrentFile from :
if (err==Z_OK) return iRead; to
if (err==Z_OK) return pfile_in_zip_read_info->rest_read_uncompressed; So if there REALLY still something to read, the return code will be correct (ZR_MORE), and UNZ_EOF (==0) if there is nothing more left to be read...
But I cannot understand why the zipped CAB file is not correctly unstreamed (doesn't last with a Z_STREAM_END code from 'inflate' but Z_OK instead) :/ I'm still puzzled on this one.
And no, the zlib is far from being well tested, the ZIP_MEMORY handle was specificaly said to be particulary UNTESTED ! It ALWAYS fails if the size of the buffer doesn't match to the size of the uncompressed file (iRead==len), especially on larger buffers which should normally handle file of thiner size. There is plenty of such tricks in the code which turns some particular cases into debuging hell...
Kochise
In Code we trust !
|
|
|
|
|
And just to stop moaning about how zlib is perfect and well tested, that I'm a moron so far, just read this :
http://www.eweek.com/article2/0,1895,1834632,00.asp
Reproduced here for archiving :
"A serious security flaw has been identified in Zlib, a widely used data compression library. Fixes have begun to appear, but a large number of programs could be affected.
Zlib is a data compression library that is used by many third-party programs and is distributed with many operating systems, including many Linux and BSD distributions.
Microsoft Corp. and other proprietary software companies also use the library in many programs. These companies can do so because Zlib is licensed under liberal BSD-style license.
This isn't the first time that the popular Zlib has been the center of a security concern. In 2002, a problem with how it handled memory allocation became a major concern.
This time, the flaw is a buffer overflow in the decompression process. Because the program doesn't properly validate input data, it can be fed bad data, which can lead to a buffer overflow.
This, in turn, means that if a user opens a file with a Zlib-enabled application, such as a Web browser or data compression tool, which contains specially malformed compressed data, an attacker could execute arbitrary code as the user. If this user were running as a system administrator the flaw would run at that level as well.
Read details here about open-source security tools on view at InfoSec.
The flaw was discovered by Tavis Ormandy of the Gentoo Linux Security Audit Team.
Since Zlib is so ubiquitous, this represents a serious security concern.
It's not clear how many programs are affected, but some operating system distributions are widely exposed. According to one source, numerous key packages in the Fedora Core 3 distribution use Zlib. Symantec Corp. reports that AIX, Debian, FreeBSD, Gentoo, SuSE, Red Hat, Ubuntu and many other operating systems are affected.
Some versions of Microsoft's DirectX, FrontPage, Internet Explorer, Office, Visual Studio, Messenger and the Windows InstallShield program, among other programs, also use Zlib and are potentially vulnerable.
Microsoft is currently looking into what vulnerabilities may exist in its software because of the Zlib problem.
As Ormandy said, "Everything from the Linux kernel to OpenSSH, Mozilla and Internet Explorer makes use of Zlib, and any application that understands PNG [portable network graphics] image [format] is likely to use it."
Click here to read about vulnerabilities in two popular open-source projects, phpMyAdmin and phpBB.
If exploited, this flaw could lead to DoS (denial of service) attacks on the targeted machine. This buffer overflow could also be used to allow a hacker unaurhorized access to a system.
At this time, however, Symantec reports, there are no known exploits.
In the open-source operating systems, deploying application fixes for this problem will tend to be straightforward. That's because in these operating systems the Zlib library is usually linked dynamically to applications. Thus, simply updating the operating system with the new library will take care of the problem for most applications. On other systems, however, and even with some open-source applications, each application will need to be patched.
"Zlib is statically linked quite often, especially on non-Unix platforms such as Windows; however, on Linux, BSD and [similar operating systems] it's more conventional to use dynamic linking, especially as Zlib is so widely used on these platforms that it reduces lots of unnecessary duplication," explained Ormandy.
Activity at the Zlib development site has been sparse for some time, and the main developers seem to have moved on to other projects. We received no response to our attempts to contact the developers in time for this story.
However, Ormandy said, "Zlib is very mature and stable, so development is sporadic, but it's certainly not dead. Mark Adler [a Zlib co-author] responded to my report with a patch and an in-depth investigation and explanation within 24 hours, and I believe he expects to release a new version of Zlib very soon."
In the meantime, many open-source operating systems already have patches for the buffer problem. These include Debian, FreeBSD, Gentoo, SuSE and Ubuntu.
Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog."
Kochise
In Code we trust !
|
|
|
|
|
Firstly, I'd like to thank everyone involved in making this component - it was very easy to add to the application I'm working on, and it worked the first time I tried it (no debugging - how often does that happen!)
I ran Boundschecker and it reported reading uninitialized memory in XUnZip.cpp for the following lines:
Line 1171:<br />
NEEDBITS(j)<br />
<br />
Line 1545:<br />
NEEDBITS(t)<br />
<br />
Line 2898:<br />
int unzlocal_getByte(LUFILE *fin,int *pi)<br />
{ unsigned char c;<br />
int err = (int)lufread(&c, 1, 1, fin);<br />
if (err==1)<br />
{ *pi = (int)c; <-- here
Has else anyone encountered this?
Warren
|
|
|
|
|
I haven't used XUnzip as much as I have XZip, so I don't know if this is a serious problem. If you believe it is serious, let me know the details - does it happen with all files, just one file, etc. Does BC report this error with the sample app?
Best wishes,
Hans
|
|
|
|
|
Hans,
Thanks for the quick reply.
Some of the problems depended on the file that was being unzipped, some occurred for all of the files. I ran your sample application in Boundschecker and I didn't get the same problems, but I did get these:
1) XZipTestDlg.cpp - Line 313 - Expression uses dangling pointer
CloseZip(hz);
It looks like CloseZip isn't needed, as there is another one on line 305. As a fix, it might be good to change the CloseZip Macro to set hz to zero, so it can't me misused after it's already closed?
2) XZip.cpp - Line 1894 - reading uninitialized memory
state.ds.prev_length = match_length, prev_match = state.ds.match_start;
The uninitialized memory is state.ds.match_start although
I'm not sure what the comma is doing after match_length 
maybe is was meant to be a semi-colon ?!?
As a fix, maybe the TDeflateState constructor can initialize this variable - just to be on the safe side (my personal preference is to trade tons of speed for any chance at avoiding a bug).
3) XZip.cpp - Line 1623 - reading uninitialized memory
register uch scan_end = scan[best_len];
I'm not sure if these problems are serious or not, but I would say I've dealt with "reading uninitialized memory" problems in the past and they are the hardest to debug  . 99 times out of 100 the app will be okay, and then once in a long while it will act funny.
Warren
|
|
|
|
|
I doubt anyone ever reads this one anymore, but I'm looking for something like this that I can code cross-platform.
I know this won't work in Linux, as it XZip.cpp includes windows.h, but I'm trying to do a cross-platform app.
Any ideas for something that:
A) Is free to use
B) reads/writes ZIP or RAR files
C) Runs independent of any OS libraries
It also preferably:
D) Links statically
E) Zips/Unzips in memory
Cheers
Phaedrus
|
|
|
|
|
phaedrus wrote:
I know this won't work in Linux, as it XZip.cpp includes windows.h
Actually its use of windows stuff is minimal - some typedefs and some file i/o. It would not be that hard to port.
You might look at zlib - although I do not know if that is more portable.
Best wishes,
Hans
|
|
|
|
|
There is a buffer overflow vulnerability in ZipAdd function that could allow arbitrary code execution.
The overflow occurs when the second parameter is more than 520 characters.
Maybe vulnerable also others functions.
For example:
char overflow[550];
for (int i=0; i < 550; i++) overflow[i] = 'A';
HZIP hz = CreateZip("c:\\example.zip", 0, ZIP_FILENAME);
ZipAdd(hz, overflow , "c:\\source.exe", 0, ZIP_FILENAME);
May manifest itself as a vulnerability in applications that allows input from remote client.
|
|
|
|
|
The last 3 lines of the TUnzip::Open() function (in XUnzip.cpp) are:
uf = unzOpenInternal(f);
return ZR_OK;
}
The unzOpenInternal() function opens the specified ZIP file checks it's validity; as written, it returns a NULL value of there is a problem with the ZIP file:
if (err!=UNZ_OK) {lufclose(fin);return NULL;}
However, the Open() function ignores this return value and returns "all ok" regardless. If you attempt to open a file that is *not* a valid ZIP file, this creates a big problem if one uses the documented OpenZip() function (in the Code Project article:
HZIP hz = OpenZip(z,len,flags); //non-zero if zip archive opened ok, otherwise 0
if (hz) { <some code=""> }
To correct this problem I modified XUnzip.cpp as follows:
#pragma warning(disable : 4702) //(reference line to locate new code below)
ZRESULT zopenerror = ZR_OK; // NEW code
unzFile unzOpenInternal(LUFILE *fin) //(reference line to locate new code below)
{
zopenerror = ZR_OK; //NEW code
.
.
.
// if (err!=UNZ_OK) {lufclose(fin);return NULL;} //OLD code
if (err!=UNZ_OK) {lufclose(fin); zopenerror = err; return NULL;} //NEW code
.
.
.
}
ZRESULT TUnzip::Open(void *z,unsigned int len,DWORD flags) //(reference line to locate new code below)
{
.
.
.
// return ZR_OK; //OLD code
return zopenerror; //NEW code
}
I hope this is useful.
I've only had this a couple of days, and this is the only problem I've found. Otherwise it's great.
|
|
|
|
|
Is there a way to protect the archive by password during creation or later ?
Thanks a lot for reply.
|
|
|
|
|
Thanks a lot, your code was very helpful to me, although a simple wrapper-class would have been even nicer. 
PS: "Look at the size of that thing!" 
|
|
|
|
|
Is there/will be there any Progress Bar Support ? 
|
|
|
|
|
Anyone fancy converting this into a .NET class library / assembly?
Don't worry, nobody lives forever.
|
|
|
|
|
|
I want a progress show during compression, how can I do? May be some function I don't know? Can I solve this question with "Createpipe",but how to do?
maybe someone tell me?
Thanks a lot in advance!
|
|
|
|
|
I really like this application/xzip/xunzip but I think it does not work on Linux. Is there a similar program that does work on linux???
|
|
|
|
|
I know the GUI wont but will the Zip and Unzip functionality work in linux as only a console app? I will try this out tomorrow but if it doesnt I will stop.
Why cant people get along with penguins
|
|
|
|
|
Seems that I'm too stupid to figure it out myself...
How do I set the desired compression level?
Please help, it's kinda urgent...
|
|
|
|
|
The compression level (or ratio) is determined by the configuration_table, which you can see at line 365 of XZip.cpp:
const config configuration_table[10] = {
{0, 0, 0, 0},
{4, 4, 8, 4},
{4, 5, 16, 8},
{4, 6, 32, 32},
{4, 4, 16, 16},
{8, 16, 32, 32},
{8, 16, 128, 128},
{8, 32, 128, 256},
{32, 128, 258, 1024},
{32, 258, 258, 4096}};
There is some explanation of the four values at line 563:
unsigned max_chain_length;
unsigned int max_lazy_match;
unsigned good_match;
int nice_match;
At line 1533 you will find the function lm_init():
void lm_init (TState &state, int pack_level, ush *flags)
and at line 1556 in lm_init():
state.ds.max_lazy_match = configuration_table[pack_level].max_lazy;
state.ds.good_match = configuration_table[pack_level].good_length;
state.ds.nice_match = configuration_table[pack_level].nice_length;
state.ds.max_chain_length = configuration_table[pack_level].max_chain;
So your question is answered by finding what the value of pack_level is. At line 2551, we see that lm_init() gets called:
lm_init(state,state.level, &zfi->flg);
and previously state is set up at line 2542:
state.param=this; state.level=8; state.seekable=iseekable; state.err=NULL;
So the answer seems to be 8, the next-to-highest compression level. (There is no external way to change the value of 8, so you will have to implement your own function if you want to do this.) The code does not seem to want to accept level 9, since at line 1537 we see:
Assert(state,pack_level>=1 && pack_level<=8,"bad pack level");
If you do change the compression level, I strongly urge you to test it thoroughly. I have not done much testing in this area myself.
Best wishes,
Hans
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
