GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — zlib: validate central directory record count by mcollina · Pull Request #65002 · nodejs/node

Conversation

@mcollina

@mcollina mcollina commented Aug 4, 2026

Copy link
Copy Markdown
Member

ZIP readers trusted the EOCD record count without checking that the parsed headers consumed the declared central directory size. Reject archives whose record count leaves central directory bytes unparsed so all ZIP reader paths agree on the archive's entries.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@mcollina
zlib: validate central directory record count
3469b1b 
ZIP readers trusted the EOCD record count. They did not check that
the parsed headers consumed the declared central directory size.
Reject archives whose count leaves directory bytes unparsed.

Signed-off-by: Matteo Collina <[email protected]>
@nodejs-github-bot nodejs-github-bot added the needs-ci PRs that need a full CI run. label Aug 4, 2026
@mcollina
mcollina requested a review from aduh95 August 4, 2026 08:26
@pipobscure

pipobscure commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

lgtm 👍
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@mcollina
mcollina requested review from ShogunPanda, anonrig and jasnell August 4, 2026 09:18
@codecov

codecov Bot commented Aug 4, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.27%. Comparing base (f43086d) to head (3469b1b).
⚠️ Report is 175 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main   #65002   +/-   ##
=======================================
  Coverage   90.27%   90.27%           
=======================================
  Files         762      762           
  Lines      247515   247540   +25     
  Branches    46683    46690    +7     
=======================================
+ Hits       223447   223478   +31     
- Misses      15485    15489    +4     
+ Partials     8583     8573   -10
Files with missing lines Coverage Δ
lib/internal/zip/entry.js 98.44% <100.00%> (+<0.01%) ⬆️
lib/internal/zip/headers.js 97.28% <100.00%> (+0.02%) ⬆️

... and 39 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@pipobscure pipobscure mentioned this pull request Aug 5, 2026
zlib: harden ZIP archive reading and writing against malicious input #65016
Closed
panva
panva approved these changes Aug 5, 2026
View reviewed changes
@aduh95 aduh95 added author ready PRs with CI started, the required approvals, and no outstanding review comments. request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. labels Aug 5, 2026
aduh95
aduh95 approved these changes Aug 5, 2026
View reviewed changes
@github-actions github-actions Bot removed the request-ci Add this label to start a Jenkins CI on a PR. Only starts once the PR has an approving review. label Aug 5, 2026
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

This comment was marked as outdated.

Sign in to view
@nodejs-github-bot

nodejs-github-bot commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75558/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@trivikr trivikr added the zlib Issues and PRs related to the zlib module and its compression dependencies. label Aug 7, 2026
@nodejs-github-bot

nodejs-github-bot commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/75791/
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@aduh95
aduh95 merged commit 00f0f8c into nodejs:main Aug 12, 2026
78 of 80 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@aduh95

aduh95 commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Landed in 00f0f8c
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@mcollina @aduh95
zlib: validate central directory record count
4b2254b 
ZIP readers trusted the EOCD record count. They did not check that
the parsed headers consumed the declared central directory size.
Reject archives whose count leaves directory bytes unparsed.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #65002
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
aduh95 pushed a commit that referenced this pull request Aug 25, 2026
@mcollina @aduh95
zlib: validate central directory record count
575260d 
ZIP readers trusted the EOCD record count. They did not check that
the parsed headers consumed the declared central directory size.
Reject archives whose count leaves directory bytes unparsed.

Signed-off-by: Matteo Collina <[email protected]>
PR-URL: #65002
Reviewed-By: Filip Skokan <[email protected]>
Reviewed-By: Antoine du Hamel <[email protected]>
@aduh95 aduh95 mentioned this pull request Aug 25, 2026
2026-08-26, Version 26.8.0 (Current) #65551
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@panva panva panva approved these changes
@aduh95 aduh95 aduh95 approved these changes
@jasnell jasnell Awaiting requested review from jasnell
@anonrig anonrig Awaiting requested review from anonrig
@ShogunPanda ShogunPanda Awaiting requested review from ShogunPanda

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

author ready PRs with CI started, the required approvals, and no outstanding review comments. needs-ci PRs that need a full CI run. zlib Issues and PRs related to the zlib module and its compression dependencies.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@mcollina @pipobscure @nodejs-github-bot @aduh95 @panva @trivikr
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.