@@ -229,12 +229,13 @@ if (_diskNumber == 0xFFFF || _centralDirectoryDisk == 0xFFFF || _centralDirectoryEntriesInDisk == 0xFFFF || _centralDirectoryEntries == 0xFFFF || _centralDirectorySize == 0xFFFFFFFF || - _centralDirectoryOffset == 0xFFFFFFFF) { - uint64_t offset64, size; + _centralDirectoryOffset == -1) { + int64_t offset64; + uint64_t size; seekOrThrowInvalidFormat(_stream, offset - 20, SEEK_END); if ([_stream readLittleEndianInt32] != 0x07064B50) { objc_autoreleasePoolPop(pool); @@ -246,11 +247,11 @@ * central directory record. */ [_stream readLittleEndianInt32]; offset64 = [_stream readLittleEndianInt64]; - if ((of_offset_t)offset64 != offset64) + if (offset64 < 0 || (of_offset_t)offset64 != offset64) @throw [OFOutOfRangeException exception]; seekOrThrowInvalidFormat(_stream, (of_offset_t)offset64, SEEK_SET); @@ -272,11 +273,12 @@ [_stream readLittleEndianInt64]; _centralDirectoryEntries = [_stream readLittleEndianInt64]; _centralDirectorySize = [_stream readLittleEndianInt64]; _centralDirectoryOffset = [_stream readLittleEndianInt64]; - if ((of_offset_t)_centralDirectoryOffset != + if (_centralDirectoryOffset < 0 || + (of_offset_t)_centralDirectoryOffset != _centralDirectoryOffset) @throw [OFOutOfRangeException exception]; } objc_autoreleasePoolPop(pool); @@ -284,11 +286,12 @@ - (void)OF_readEntries { void *pool = objc_autoreleasePoolPush(); - if ((of_offset_t)_centralDirectoryOffset != _centralDirectoryOffset) + if (_centralDirectoryOffset < 0 || + (of_offset_t)_centralDirectoryOffset != _centralDirectoryOffset) @throw [OFOutOfRangeException exception]; seekOrThrowInvalidFormat(_stream, (of_offset_t)_centralDirectoryOffset, SEEK_SET); @@ -321,11 +324,11 @@ - (OFStream*)streamForReadingFile: (OFString*)path { void *pool = objc_autoreleasePoolPush(); OFZIPArchiveEntry *entry = [_pathToEntryMap objectForKey: path]; OFZIPArchive_LocalFileHeader *localFileHeader; - uint64_t offset64; + int64_t offset64; if (entry == nil) @throw [OFOpenItemFailedException exceptionWithPath: path mode: @"rb" errNo: ENOENT]; @@ -333,11 +336,11 @@ [_lastReturnedStream close]; [_lastReturnedStream release]; _lastReturnedStream = nil; offset64 = [entry OF_localFileHeaderOffset]; - if ((of_offset_t)offset64 != offset64) + if (offset64 < 0 || (of_offset_t)offset64 != offset64) @throw [OFOutOfRangeException exception]; seekOrThrowInvalidFormat(_stream, (of_offset_t)offset64, SEEK_SET); localFileHeader = [[[OFZIPArchive_LocalFileHeader alloc] initWithStream: _stream] autorelease];