Unable to extract zip file using InputStream (AES-encrypted, CompressionMethod.STORE)

[barix]

Hi,

with the following code I am able to produce an IOExceoption "Reached end of data for this entry, but aes verification failed" when the CompressionMethod.STORE is used. This exception does not occurs when using CompressionMethod.DEFLATE. I used Zip4j in Version 2.6.1, 2.6.4 and 2.8.0.

import org.apache.commons.io.FileUtils;

import net.lingala.zip4j.ZipFile;
import net.lingala.zip4j.io.inputstream.ZipInputStream;
...

public class MainCompact {
   private static final String PW = "test".toCharArray();
   private static final String TESTFOLDER = "testfolder";
   private static final String OUT_ZIP = "out.zip";

   public static void main(String[] args) throws IOException {
      packWithStream(TESTFOLDER);
      unpackWithStream(OUT_ZIP);
   }

   private static void packWithStream(String dirpath) throws IOException {
      var zipParameters = new ZipParameters();
      zipParameters.setCompressionMethod(CompressionMethod.DEFLATE);
      zipParameters.setIncludeRootFolder(false);
      zipParameters.setEncryptFiles(true);
      zipParameters.setEncryptionMethod(EncryptionMethod.AES);

      File[] files = new File(dirpath).listFiles();
      var zipFile = new ZipFile(OUT_ZIP, PW);

      for (File file : files) {
         if (file.isFile()) {
            var zipParametersForFile = new ZipParameters(zipParameters);
            zipParametersForFile.setFileNameInZip(file.getName());
            zipFile.addStream(new ByteArrayInputStream(FileUtils.readFileToByteArray(file)), zipParametersForFile);
         }
      }
   }

   private static void unpackWithStream(String zipFileName) throws IOException {
      LocalFileHeader localFileHeader;
      int readLen;
      var readBuffer = new byte[4096];

      try (var zipInputStream = new ZipInputStream(new FileInputStream(new File(zipFileName)), PW)) {
         while ((localFileHeader = zipInputStream.getNextEntry()) != null) {
            var extractedFile = new File("out/" + localFileHeader.getFileName());
            try (OutputStream outputStream = new FileOutputStream(extractedFile)) {
               while ((readLen = zipInputStream.read(readBuffer)) != -1) {
                  outputStream.write(readBuffer, 0, readLen);
               }
            }
         }
      }
   }
}

Exception:

Exception in thread "main" java.io.IOException: Reached end of data for this entry, but aes verification failed
	at net.lingala.zip4j.io.inputstream.AesCipherInputStream.verifyContent(AesCipherInputStream.java:140)
	at net.lingala.zip4j.io.inputstream.AesCipherInputStream.endOfEntryReached(AesCipherInputStream.java:121)
	at net.lingala.zip4j.io.inputstream.DecompressedInputStream.endOfEntryReached(DecompressedInputStream.java:43)
	at net.lingala.zip4j.io.inputstream.ZipInputStream.endOfCompressedDataReached(ZipInputStream.java:205)
	at net.lingala.zip4j.io.inputstream.ZipInputStream.read(ZipInputStream.java:159)
	at net.lingala.zip4j.io.inputstream.ZipInputStream.read(ZipInputStream.java:132)
	at com.example.MainCompact.unpackWithStream(MainCompact.java:58)
	at com.example.MainCompact.main(MainCompact.java:27)

Extracting the generated zip file "out.zip" with 7-Zip or using the following method works fine:

   private static void perform(String zipFileName) throws ZipException {
      var zipFile = new ZipFile(zipFileName, PW);
      zipFile.extractAll("out/");
   }

[srikanth-lingala]

I was able to reproduce this issue. I will work on a fix. Thanks for reporting this.

[hotzen]

We are dealing with the same problem when downloading aes-encrypted/password-protected zip-files from the deutschepost.com. Thanks for fixing this!

Since it's already merged, when/how does this appear at https://mvnrepository.com/artifact/net.lingala.zip4j/zip4j ?

[srikanth-lingala]

@hotzen I have to make a release for the fix to be released. There are a couple of failing tests after the fix which I need to look into. I will release a version with this fix once I look into it and they are fixed.

[srikanth-lingala]

Fixed in v2.9.0 released today.