From a263718a19eb7828b114a2634d2fe8895c42dbf6 Mon Sep 17 00:00:00 2001
From: Tim Hatch <tim@timhatch.com>
Date: Sun, 21 Aug 2022 10:33:00 -0700
Subject: [PATCH] zipfile: handle extras after a zip64 extra

Previously, any data _after_ the zip64 extra would be removed.

With many new tests.

Fixes #88233
---
 Lib/test/test_zipfile.py | 52 ++++++++++++++++++++++++++++++++++++++++
 Lib/zipfile.py           |  2 ++
 2 files changed, 54 insertions(+)

diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
index 6f6f4bc26b0d40..9d4925d26bd12e 100644
--- a/Lib/test/test_zipfile.py
+++ b/Lib/test/test_zipfile.py
@@ -3425,6 +3425,58 @@ def test_cli_with_metadata_encoding_extract(self):
         for name in self.file_names:
             self.assertIn(name, listing)
 
+class StripExtraTests(unittest.TestCase):
+    # Note: all of the "z" characters are technically invalid, but up to 3 bytes
+    # at the end of the extra will be passed through as they are too short to
+    # encode a valid extra.
+    def test_no_data(self):
+        s = struct.Struct("<HH")
+        a = s.pack(1, 0)  # 1=zip64 exta signature
+        b = s.pack(2, 0)
+        c = s.pack(3, 0)
+
+        self.assertEqual(b'', zipfile._strip_extra(a, (1,)))
+        self.assertEqual(b, zipfile._strip_extra(b, (1,)))
+        self.assertEqual(b+b"z", zipfile._strip_extra(b+b"z", (1,)))
+
+        self.assertEqual(b+c, zipfile._strip_extra(a+b+c, (1,)))
+        self.assertEqual(b+c, zipfile._strip_extra(b+a+c, (1,)))
+        self.assertEqual(b+c, zipfile._strip_extra(b+c+a, (1,)))
+
+    def test_with_data(self):
+        s = struct.Struct("<HH")
+        a = s.pack(1, 1) + b"a"  # 1=zip64 exta signature
+        b = s.pack(2, 2) + b"bb"
+        c = s.pack(3, 3) + b"ccc"
+
+        self.assertEqual(b"", zipfile._strip_extra(a, (1,)))
+        self.assertEqual(b, zipfile._strip_extra(b, (1,)))
+        self.assertEqual(b+b"z", zipfile._strip_extra(b+b"z", (1,)))
+
+        self.assertEqual(b+c, zipfile._strip_extra(a+b+c, (1,)))
+        self.assertEqual(b+c, zipfile._strip_extra(b+a+c, (1,)))
+        self.assertEqual(b+c, zipfile._strip_extra(b+c+a, (1,)))
+
+    def test_multiples(self):
+        s = struct.Struct("<HH")
+        a = s.pack(1, 1) + b"a"  # 1=zip64 exta signature
+        b = s.pack(2, 2) + b"bb"
+        c = s.pack(3, 3) + b"ccc"
+
+        self.assertEqual(b"", zipfile._strip_extra(a+a, (1,)))
+        self.assertEqual(b"", zipfile._strip_extra(a+a+a, (1,)))
+        self.assertEqual(b"z", zipfile._strip_extra(a+a+b"z", (1,)))
+        self.assertEqual(b+b"z", zipfile._strip_extra(a+a+b+b"z", (1,)))
+
+        self.assertEqual(b, zipfile._strip_extra(a+a+b, (1,)))
+        self.assertEqual(b, zipfile._strip_extra(a+b+a, (1,)))
+        self.assertEqual(b, zipfile._strip_extra(b+a+a, (1,)))
+
+    def test_too_short(self):
+        self.assertEqual(b"", zipfile._strip_extra(b"", (1,)))
+        self.assertEqual(b"z", zipfile._strip_extra(b"z", (1,)))
+        self.assertEqual(b"zz", zipfile._strip_extra(b"zz", (1,)))
+        self.assertEqual(b"zzz", zipfile._strip_extra(b"zzz", (1,)))
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/Lib/zipfile.py b/Lib/zipfile.py
index b6465373c107d5..7fb53f3836987d 100644
--- a/Lib/zipfile.py
+++ b/Lib/zipfile.py
@@ -211,6 +211,8 @@ def _strip_extra(extra, xids):
         i = j
     if not modified:
         return extra
+    if start != len(extra):
+        buffer.append(extra[start:])
     return b''.join(buffer)
 
 def _check_zipfile(fp):