deps: update zlib to 1.3.1-7eda07b

Author: nodejs-github-bot

deps/zlib/contrib/minizip/README.chromium

@@ -40,3 +40,6 @@ Local Modifications:
   large CRX files).
   0018-support-prefixed-zip64.patch
 
+- Added stricter parsing for zip64 candidates to avoid an issue where a zip64
+  could be embedded in a non-zip64 zip.
+  0019-fix-zip64-in-zip.patch

deps/zlib/contrib/minizip/unzip.c

@@ -444,12 +444,28 @@ local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
         if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
             break;
 
-        for (i=(int)uReadSize-3; (i--)>0;)
+        /* Search for the non-zip64 EoCDR and confirm zip64 EoCDL is 20 bytes
+           earlier. This avoids false positives if the file is a non-zip64 zip
+           but contains an uncompressed zip64 near its end. Note: zip64 EoCDL is
+           20 bytes long. */
+        for (i=(int)uReadSize-3; (i--)>20;)
+            // End of central directory record signature (PK\5\6)
             if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) &&
-                ((*(buf+i+2))==0x06) && ((*(buf+i+3))==0x07))
+                ((*(buf+i+2))==0x05) && ((*(buf+i+3))==0x06))
             {
-                uPosFound = uReadPos+(unsigned)i;
-                break;
+                // Zip64 end of central directory locator signature (PK\6\7)
+                if (((*(buf+i-20))==0x50) && ((*(buf+i+1-20))==0x4b) &&
+                    ((*(buf+i+2-20))==0x06) && ((*(buf+i+3-20))==0x07))
+                {
+                    uPosFound = uReadPos+(unsigned)i-20;
+                    break;
+                }
+                else
+                {
+                  /* This is a non-zip64 zip; abandon the search. */
+                  free(buf);
+                  return CENTRALDIRINVALID;
+                }
             }
 
         if (uPosFound!=CENTRALDIRINVALID)

deps/zlib/google/zip_reader.cc

@@ -5,11 +5,14 @@
 #include "third_party/zlib/google/zip_reader.h"
 
 #include <algorithm>
+#include <cstdint>
 #include <string_view>
 #include <utility>
 
 #include "base/check.h"
+#include "base/containers/span.h"
 #include "base/containers/heap_array.h"
+#include "base/strings/string_view_util.h"
 #include "base/files/file.h"
 #include "base/files/file_util.h"
 #include "base/functional/bind.h"
@@ -86,8 +89,8 @@ class StringWriterDelegate : public WriterDelegate {
   explicit StringWriterDelegate(std::string* output) : output_(output) {}
 
   // WriterDelegate methods:
-  bool WriteBytes(const char* data, int num_bytes) override {
-    output_->append(data, num_bytes);
+  bool WriteBytes(base::span<const uint8_t> data) override {
+    *output_ += base::as_string_view(data);
     return true;
   }
 
@@ -485,8 +488,10 @@ bool ZipReader::ExtractCurrentEntry(WriterDelegate* delegate,
 
     uint64_t num_bytes_to_write = std::min<uint64_t>(
         remaining_capacity, base::checked_cast<uint64_t>(num_bytes_read));
-    if (!delegate->WriteBytes(buf, num_bytes_to_write))
+    if (!delegate->WriteBytes(base::as_byte_span(buf).first(
+            base::checked_cast<size_t>(num_bytes_to_write)))) {
       break;
+    }
 
     if (remaining_capacity == base::checked_cast<uint64_t>(num_bytes_read)) {
       // Ensures function returns true if the entire file has been read.
@@ -679,7 +684,9 @@ void ZipReader::ExtractChunk(base::File output_file,
     return;
   }
 
-  if (num_bytes_read != output_file.Write(offset, buffer, num_bytes_read)) {
+  if (!output_file.WriteAndCheck(
+          offset, base::as_byte_span(buffer).first(
+                      static_cast<size_t>(num_bytes_read)))) {
     LOG(ERROR) << "Cannot write " << num_bytes_read
                << " bytes to file at offset " << offset;
     std::move(failure_callback).Run();
@@ -734,11 +741,12 @@ bool FileWriterDelegate::PrepareOutput() {
   return true;
 }
 
-bool FileWriterDelegate::WriteBytes(const char* data, int num_bytes) {
-  int bytes_written = file_->WriteAtCurrentPos(data, num_bytes);
-  if (bytes_written > 0)
-    file_length_ += bytes_written;
-  return bytes_written == num_bytes;
+bool FileWriterDelegate::WriteBytes(base::span<const uint8_t> data) {
+  const std::optional<size_t> bytes_written = file_->WriteAtCurrentPos(data);
+  if (bytes_written > 0) {
+    file_length_ += *bytes_written;
+  }
+  return bytes_written == data.size();
 }
 
 void FileWriterDelegate::SetTimeModified(const base::Time& time) {

deps/zlib/google/zip_reader.h

@@ -12,6 +12,7 @@
 #include <string>
 #include <string_view>
 
+#include "base/containers/span.h"
 #include "base/files/file.h"
 #include "base/files/file_path.h"
 #include "base/functional/callback.h"
@@ -39,7 +40,7 @@ class WriterDelegate {
 
   // Invoked to write the next chunk of data. Return false on failure to cancel
   // extraction.
-  virtual bool WriteBytes(const char* data, int num_bytes) { return true; }
+  virtual bool WriteBytes(base::span<const uint8_t> data) { return true; }
 
   // Sets the last-modified time of the data.
   virtual void SetTimeModified(const base::Time& time) {}
@@ -377,9 +378,9 @@ class FileWriterDelegate : public WriterDelegate {
   // Returns true if the file handle passed to the constructor is valid.
   bool PrepareOutput() override;
 
-  // Writes |num_bytes| bytes of |data| to the file, returning false on error or
-  // if not all bytes could be written.
-  bool WriteBytes(const char* data, int num_bytes) override;
+  // Writes |data| to the file, returning false on error or if not all bytes
+  // could be written.
+  bool WriteBytes(base::span<const uint8_t> data) override;
 
   // Sets the last-modified time of the data.
   void SetTimeModified(const base::Time& time) override;

deps/zlib/google/zip_reader_unittest.cc

@@ -119,7 +119,7 @@ class MockUnzipListener final {
 class MockWriterDelegate : public zip::WriterDelegate {
  public:
   MOCK_METHOD0(PrepareOutput, bool());
-  MOCK_METHOD2(WriteBytes, bool(const char*, int));
+  MOCK_METHOD1(WriteBytes, bool(base::span<const uint8_t>));
   MOCK_METHOD1(SetTimeModified, void(const base::Time&));
   MOCK_METHOD1(SetPosixFilePermissions, void(int));
   MOCK_METHOD0(OnError, void());
@@ -896,7 +896,7 @@ TEST_F(ZipReaderTest, ExtractCurrentEntryWriteBytesFailure) {
   testing::StrictMock<MockWriterDelegate> mock_writer;
 
   EXPECT_CALL(mock_writer, PrepareOutput()).WillOnce(Return(true));
-  EXPECT_CALL(mock_writer, WriteBytes(_, _)).WillOnce(Return(false));
+  EXPECT_CALL(mock_writer, WriteBytes).WillOnce(Return(false));
   EXPECT_CALL(mock_writer, OnError());
 
   base::FilePath target_path(FILE_PATH_LITERAL("foo/bar/quux.txt"));
@@ -912,7 +912,7 @@ TEST_F(ZipReaderTest, ExtractCurrentEntrySuccess) {
   testing::StrictMock<MockWriterDelegate> mock_writer;
 
   EXPECT_CALL(mock_writer, PrepareOutput()).WillOnce(Return(true));
-  EXPECT_CALL(mock_writer, WriteBytes(_, _)).WillRepeatedly(Return(true));
+  EXPECT_CALL(mock_writer, WriteBytes).WillRepeatedly(Return(true));
   EXPECT_CALL(mock_writer, SetPosixFilePermissions(_));
   EXPECT_CALL(mock_writer, SetTimeModified(_));
 
@@ -1002,7 +1002,7 @@ TEST_F(FileWriterDelegateTest, WriteToEnd) {
     FileWriterDelegate writer(&file_);
     EXPECT_EQ(0, writer.file_length());
     ASSERT_TRUE(writer.PrepareOutput());
-    ASSERT_TRUE(writer.WriteBytes(payload.data(), payload.size()));
+    ASSERT_TRUE(writer.WriteBytes(base::as_byte_span(payload)));
     EXPECT_EQ(payload.size(), writer.file_length());
   }
 
@@ -1016,7 +1016,7 @@ TEST_F(FileWriterDelegateTest, EmptyOnError) {
     FileWriterDelegate writer(&file_);
     EXPECT_EQ(0, writer.file_length());
     ASSERT_TRUE(writer.PrepareOutput());
-    ASSERT_TRUE(writer.WriteBytes(payload.data(), payload.size()));
+    ASSERT_TRUE(writer.WriteBytes(base::as_byte_span(payload)));
     EXPECT_EQ(payload.size(), writer.file_length());
     EXPECT_EQ(payload.size(), file_.GetLength());
     writer.OnError();

deps/zlib/google/zip_unittest.cc

@@ -15,6 +15,7 @@
 #include <unordered_set>
 #include <vector>
 
+#include "base/containers/span.h"
 #include "base/files/file.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_path.h"
@@ -81,8 +82,8 @@ class ProgressWriterDelegate : public zip::WriterDelegate {
     CHECK_GT(expected_size_, 0);
   }
 
-  bool WriteBytes(const char* data, int num_bytes) override {
-    received_bytes_ += num_bytes;
+  bool WriteBytes(base::span<const uint8_t> data) override {
+    received_bytes_ += data.size();
     LogProgressIfNecessary();
     return true;
   }

deps/zlib/google/zip_writer.cc

@@ -7,8 +7,10 @@
 #include <algorithm>
 #include <tuple>
 
+#include "base/containers/span.h"
 #include "base/files/file.h"
 #include "base/logging.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/strings/strcat.h"
 #include "base/strings/string_util.h"
 #include "third_party/zlib/google/redact.h"
@@ -34,27 +36,29 @@ bool ZipWriter::ShouldContinue() {
 }
 
 bool ZipWriter::AddFileContent(const base::FilePath& path, base::File file) {
-  char buf[zip::internal::kZipBufSize];
+  uint8_t buf[zip::internal::kZipBufSize];
 
   while (ShouldContinue()) {
-    const int num_bytes =
-        file.ReadAtCurrentPos(buf, zip::internal::kZipBufSize);
+    const std::optional<size_t> num_bytes = file.ReadAtCurrentPos(buf);
 
-    if (num_bytes < 0) {
+    if (!num_bytes) {
       PLOG(ERROR) << "Cannot read file " << Redact(path);
       return false;
     }
 
-    if (num_bytes == 0)
+    if (*num_bytes == 0) {
       return true;
+    }
 
-    if (zipWriteInFileInZip(zip_file_, buf, num_bytes) != ZIP_OK) {
+    if (zipWriteInFileInZip(zip_file_, buf,
+                            base::checked_cast<unsigned int>(*num_bytes)) !=
+        ZIP_OK) {
       PLOG(ERROR) << "Cannot write data from file " << Redact(path)
                   << " to ZIP";
       return false;
     }
 
-    progress_.bytes += num_bytes;
+    progress_.bytes += *num_bytes;
   }
 
   return false;

deps/zlib/patches/0019-fix-zip64-in-zip.patch

@@ -0,0 +1,37 @@
+diff --git a/third_party/zlib/contrib/minizip/unzip.c b/third_party/zlib/contrib/minizip/unzip.c
+index b77b787ccc0db..78663ec2d53a8 100644
+--- a/third_party/zlib/contrib/minizip/unzip.c
++++ b/third_party/zlib/contrib/minizip/unzip.c
+@@ -444,12 +444,28 @@ local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
+         if (ZREAD64(*pzlib_filefunc_def,filestream,buf,uReadSize)!=uReadSize)
+             break;
+ 
+-        for (i=(int)uReadSize-3; (i--)>0;)
++        /* Search for the non-zip64 EoCDR and confirm zip64 EoCDL is 20 bytes
++           earlier. This avoids false positives if the file is a non-zip64 zip
++           but contains an uncompressed zip64 near its end. Note: zip64 EoCDL is
++           20 bytes long. */
++        for (i=(int)uReadSize-3; (i--)>20;)
++            // End of central directory record signature (PK\5\6)
+             if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) &&
+-                ((*(buf+i+2))==0x06) && ((*(buf+i+3))==0x07))
++                ((*(buf+i+2))==0x05) && ((*(buf+i+3))==0x06))
+             {
+-                uPosFound = uReadPos+(unsigned)i;
+-                break;
++                // Zip64 end of central directory locator signature (PK\6\7)
++                if (((*(buf+i-20))==0x50) && ((*(buf+i+1-20))==0x4b) &&
++                    ((*(buf+i+2-20))==0x06) && ((*(buf+i+3-20))==0x07))
++                {
++                    uPosFound = uReadPos+(unsigned)i-20;
++                    break;
++                }
++                else
++                {
++                  /* This is a non-zip64 zip; abandon the search. */
++                  free(buf);
++                  return CENTRALDIRINVALID;
++                }
+             }
+ 
+         if (uPosFound!=CENTRALDIRINVALID)

src/zlib_version.h

@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.1-e00f703"
+#define ZLIB_VERSION "1.3.1-7eda07b"
 #endif  // SRC_ZLIB_VERSION_H_