Merge branch 'master' into oldpr436

.github/workflows/ci.yaml

@@ -115,11 +115,11 @@ jobs:
           command: fuzz
           args: build --all-features fuzz_read
       - name: run fuzz
-        timeout-minutes: 331
+        timeout-minutes: 350
         uses: actions-rs/cargo@v1
         with:
           command: fuzz
-          args: run --all-features fuzz_read -- fuzz/corpus/fuzz_read -timeout=10s -fork=2 -runs=25000000 -max_len=16500 -len_control=0 -dict=fuzz/fuzz.dict
+          args: run --all-features fuzz_read -- fuzz/corpus/fuzz_read -timeout=10s -rss_limit_mb=8192 -fork=2 -runs=25000000 -max_len=70000 -max_total_time=20700 -dict=fuzz/fuzz.dict
       - name: Upload any failure inputs
         if: always()
         uses: actions/upload-artifact@v4
@@ -129,16 +129,14 @@ jobs:
           if-no-files-found: ignore
       - name: Minimize seed corpus
         if: always()
-        uses: actions-rs/cargo@v1
-        with:
-          command: fuzz
-          args: cmin --all-features fuzz_read fuzz/corpus/fuzz_read -- -dict=fuzz/fuzz.dict fuzz/corpus/new_seed
+        run: ./recursive-fuzz-cmin.sh read 70000
+        shell: bash
       - name: Upload updated seed corpus
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: fuzz_read_corpus
-          path: fuzz/corpus/new_seed/*
+          path: fuzz/corpus/fuzz_read/*
 
   fuzz_read_with_no_features:
     runs-on: ubuntu-latest
@@ -163,30 +161,18 @@ jobs:
           command: fuzz
           args: build --no-default-features fuzz_read
       - name: run fuzz
-        timeout-minutes: 331
+        timeout-minutes: 350
         uses: actions-rs/cargo@v1
         with:
           command: fuzz
-          args: run --no-default-features fuzz_read fuzz/corpus/fuzz_read -- -timeout=10s -fork=2 -runs=40000000 -max_total_time=19800 -max_len=16500 -len_control=0 -dict=fuzz/fuzz.dict
+          args: run --no-default-features fuzz_read fuzz/corpus/fuzz_read -- -rss_limit_mb=8192 -timeout=10s -fork=2 -runs=40000000 -max_total_time=20700 -max_len=70000 -dict=fuzz/fuzz.dict
       - name: Upload any failure inputs
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: fuzz_read_no_features_bad_inputs
           path: fuzz/artifacts/fuzz_read/crash-*
           if-no-files-found: ignore
-      - name: Minimize seed corpus
-        if: always()
-        uses: actions-rs/cargo@v1
-        with:
-          command: fuzz
-          args: cmin --no-default-features fuzz_read fuzz/corpus/fuzz_read -- -dict=fuzz/fuzz.dict fuzz/corpus/new_seed
-      - name: Upload updated seed corpus
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: fuzz_read_no_features_corpus
-          path: fuzz/corpus/new_seed/*
 
   fuzz_write:
     runs-on: ubuntu-latest
@@ -211,11 +197,11 @@ jobs:
           command: fuzz
           args: build --all-features fuzz_write
       - name: run fuzz
-        timeout-minutes: 331
+        timeout-minutes: 350
         uses: actions-rs/cargo@v1
         with:
           command: fuzz
-          args: run --all-features fuzz_write fuzz/corpus/fuzz_write -- -timeout=2s -fork=2 -runs=1000000 -max_len=500 -dict=fuzz/fuzz.dict
+          args: run --all-features fuzz_write fuzz/corpus/fuzz_write -- -rss_limit_mb=8192 -timeout=2s -fork=2 -runs=5000000 -max_len=500 -max_total_time=20700 -dict=fuzz/fuzz.dict
       - name: Upload any failure inputs
         if: always()
         uses: actions/upload-artifact@v4
@@ -228,16 +214,14 @@ jobs:
           if-no-files-found: ignore
       - name: Minimize seed corpus
         if: always()
-        uses: actions-rs/cargo@v1
-        with:
-          command: fuzz
-          args: cmin --all-features fuzz_write fuzz/corpus/fuzz_write -- -dict=fuzz/fuzz.dict fuzz/corpus/new_seed
+        run: ./recursive-fuzz-cmin.sh write 500
+        shell: bash
       - name: Upload updated seed corpus
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: fuzz_write_corpus
-          path: fuzz/corpus/new_seed/*
+          path: fuzz/corpus/fuzz_write/*
 
   fuzz_write_with_no_features:
     runs-on: ubuntu-latest
@@ -262,27 +246,15 @@ jobs:
           command: fuzz
           args: build --no-default-features fuzz_write
       - name: run fuzz
-        timeout-minutes: 331
+        timeout-minutes: 350
         uses: actions-rs/cargo@v1
         with:
           command: fuzz
-          args: run --no-default-features fuzz_write fuzz/corpus/fuzz_write -- -timeout=10s -fork=2 -runs=50000000 -max_len=10000 -len_control=200 -dict=fuzz/fuzz.dict
+          args: run --no-default-features fuzz_write fuzz/corpus/fuzz_write -- -rss_limit_mb=8192 -timeout=10s -fork=2 -runs=50000000 -max_len=500 -max_total_time=20700 -len_control=200 -dict=fuzz/fuzz.dict
       - name: Upload any failure inputs
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: fuzz_write_no_features_bad_inputs
           path: fuzz/artifacts/fuzz_write/crash-*
           if-no-files-found: ignore
-      - name: Minimize seed corpus
-        if: always()
-        uses: actions-rs/cargo@v1
-        with:
-          command: fuzz
-          args: cmin --no-default-features fuzz_write fuzz/corpus/fuzz_write -- -dict=fuzz/fuzz.dict fuzz/corpus/new_seed
-      - name: Upload updated seed corpus
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: fuzz_write_no_features_corpus
-          path: fuzz/corpus/new_seed/*

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [2.1.3](https://github.com/zip-rs/zip2/compare/v2.1.2...v2.1.3) - 2024-06-04
+
+### <!-- 1 -->🐛 Bug Fixes
+- Some date/time filters were previously unreliable (i.e. later-pass filters had no earliest-pass or latest-fail, and vice-versa)
+- Decode Zip-Info UTF8 name and comment fields ([#159](https://github.com/zip-rs/zip2/pull/159))
+
+### <!-- 2 -->🚜 Refactor
+- Return extended timestamp fields copied rather than borrowed ([#183](https://github.com/zip-rs/zip2/pull/183))
+
+### <!-- 7 -->⚙️ Miscellaneous Tasks
+- Fix a new Clippy warning
+- Fix a bug and inline `deserialize` for safety
+- Add check for wrong-length blocks, and incorporate fixed-size requirement into the trait name
+- Fix a fuzz failure by using checked_sub
+- Add feature gate for new unit test
+
+## [2.1.1](https://github.com/zip-rs/zip2/compare/v2.1.0...v2.1.1) - 2024-05-28
+
+### <!-- 1 -->🐛 Bug Fixes
+- Derive `Debug` for `ZipWriter`
+- lower default version to 4.5 and use the version-needed-to-extract where feasible.
+
+### <!-- 2 -->🚜 Refactor
+- use a MIN_VERSION constant
+
+### <!-- 7 -->⚙️ Miscellaneous Tasks
+- Bug fixes for debug implementation
+- Bug fixes for debug implementation
+- Update unit tests
+- Remove unused import
+
 ## [2.1.0](https://github.com/zip-rs/zip2/compare/v2.0.0...v2.1.0) - 2024-05-25
 
 ### <!-- 0 -->🚀 Features

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "zip"
-version = "2.1.0"
+version = "2.1.3"
 authors = [
     "Mathijs van de Nes <[email protected]>",
     "Marli Frost <[email protected]>",
@@ -30,34 +30,34 @@ aes = { version = "0.8.4", optional = true }
 bzip2 = { version = "0.4.4", optional = true }
 chrono = { version = "0.4.38", optional = true }
 constant_time_eq = { version = "0.3.0", optional = true }
-crc32fast = "1.4.0"
+crc32fast = "1.4.2"
 displaydoc = { version = "0.2.4", default-features = false }
-flate2 = { version = "1.0.28", default-features = false, optional = true }
+flate2 = { version = "1.0.30", default-features = false, optional = true }
 indexmap = "2"
 hmac = { version = "0.12.1", optional = true, features = ["reset"] }
 memchr = "2.7.2"
 pbkdf2 = { version = "0.12.2", optional = true }
 rand = { version = "0.8.5", optional = true }
 sha1 = { version = "0.10.6", optional = true }
-thiserror = "1.0.48"
+thiserror = "1.0.61"
 time = { workspace = true, optional = true, features = [
     "std",
 ] }
-zeroize = { version = "1.6.0", optional = true, features = ["zeroize_derive"] }
+zeroize = { version = "1.8.1", optional = true, features = ["zeroize_derive"] }
 zstd = { version = "0.13.1", optional = true, default-features = false }
 zopfli = { version = "0.8.1", optional = true }
 deflate64 = { version = "0.1.8", optional = true }
 lzma-rs = { version = "0.3.0", default-features = false, optional = true }
 
 [target.'cfg(any(all(target_arch = "arm", target_pointer_width = "32"), target_arch = "mips", target_arch = "powerpc"))'.dependencies]
-crossbeam-utils = "0.8.19"
+crossbeam-utils = "0.8.20"
 
 [target.'cfg(fuzzing)'.dependencies]
 arbitrary = { version = "1.3.2", features = ["derive"] }
 
 [dev-dependencies]
 bencher = "0.1.5"
-getrandom = { version = "0.2.14", features = ["js", "std"] }
+getrandom = { version = "0.2.15", features = ["js", "std"] }
 walkdir = "2.5.0"
 time = { workspace = true, features = ["formatting", "macros"] }
 anyhow = "1"
@@ -78,6 +78,7 @@ deflate-zlib-ng = ["flate2/zlib-ng", "deflate-flate2"]
 deflate-zopfli = ["zopfli", "_deflate-any"]
 lzma = ["lzma-rs/stream"]
 unreserved = []
+xz = ["lzma-rs/raw_decoder"]
 default = [
     "aes-crypto",
     "bzip2",
@@ -86,6 +87,7 @@ default = [
     "lzma",
     "time",
     "zstd",
+    "xz",
 ]
 
 [[bench]]

build-fuzz-corpus-multiple-restarts.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euxo pipefail
+ncpus=$(nproc || getconf NPROCESSORS_ONLN)
+ncpus=$(( ncpus / ( 1 + $(cat /sys/devices/system/cpu/smt/active))))
+RESTARTS=10
+mv "fuzz/corpus/fuzz_$1" "fuzz/corpus/fuzz_$1_pre_fresh_blood" || true
+for i in $(seq 1 $RESTARTS); do
+  echo "RESTART ${i}"
+  mkdir "fuzz/corpus/fuzz_$1"
+  cargo fuzz run --all-features "fuzz_$1" "fuzz/corpus/fuzz_$1" -- \
+    -dict=fuzz/fuzz.dict -max_len="$2" -fork="$ncpus" \
+    -max_total_time=5100 -runs=100000000
+  mv "fuzz/corpus/fuzz_$1" "fuzz/corpus/fuzz_$1_restart_${i}"
+done
+mkdir "fuzz/corpus/fuzz_$1"
+for i in $(seq 1 $RESTARTS); do
+  mv "fuzz/corpus/fuzz_$1_restart_${i}"/* "fuzz/corpus/fuzz_$1"
+  rmdir "fuzz/corpus/fuzz_$1_restart_${i}"
+done
+./fuzz-until-converged.sh $1 $2

examples/extract.rs

@@ -19,7 +19,7 @@ fn real_main() -> i32 {
     for i in 0..archive.len() {
         let mut file = archive.by_index(i).unwrap();
         let outpath = match file.enclosed_name() {
-            Some(path) => path.to_owned(),
+            Some(path) => path,
             None => continue,
         };
 

examples/write_dir.rs

@@ -42,12 +42,12 @@ fn real_main() -> i32 {
     let method = match args.compression_method {
         CompressionMethod::Stored => zip::CompressionMethod::Stored,
         CompressionMethod::Deflated => {
-            #[cfg(not(feature = "deflate"))]
+            #[cfg(not(feature = "deflate-flate2"))]
             {
-                println!("The `deflate` feature is not enabled");
+                println!("The `deflate-flate2` feature is not enabled");
                 return 1;
             }
-            #[cfg(feature = "deflate")]
+            #[cfg(feature = "deflate-flate2")]
             zip::CompressionMethod::Deflated
         }
         CompressionMethod::DeflatedZlib => {

fuzz-until-converged.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+set -euxo pipefail
+rm -r "fuzz/corpus/fuzz_$1_old" || true
+ncpus=$(nproc || getconf NPROCESSORS_ONLN)
+ncpus=$(( ncpus / ( 1 + $(cat /sys/devices/system/cpu/smt/active))))
+MAX_ITERS_WITHOUT_IMPROVEMENT=3
+iters_without_improvement=0
+while [[ $iters_without_improvement -lt $MAX_ITERS_WITHOUT_IMPROVEMENT ]]; do
+  cp -r "fuzz/corpus/fuzz_$1" "fuzz/corpus/fuzz_$1_old"
+  cargo fuzz run --all-features "fuzz_$1" "fuzz/corpus/fuzz_$1" -- \
+    -dict=fuzz/fuzz.dict -max_len="$2" -fork="$ncpus" \
+    -max_total_time=1800 -runs=20000000 -rss_limit_mb=8192 -timeout=30
+  ./recursive-fuzz-cmin.sh "$1" "$2"
+  if diff "fuzz/corpus/fuzz_$1" "fuzz/corpus/fuzz_$1_old"; then
+    iters_without_improvement=$(( iters_without_improvement + 1 ))
+    echo "$iters_without_improvement iterations without improvement"
+  else
+    iters_without_improvement=0
+  fi
+  rm -r "fuzz/corpus/fuzz_$1_old"
+done

fuzz/.gitignore

@@ -1,2 +1,5 @@
 target
 artifacts
+corpus/*
+!corpus/fuzz_read/
+!corpus/fuzz_write/

fuzz/Cargo.toml

@@ -10,8 +10,9 @@ cargo-fuzz = true
 
 [dependencies]
 libfuzzer-sys = "0.4"
-arbitrary = { version = "1.3.0", features = ["derive"] }
+arbitrary = { version = "1.3.2", features = ["derive"] }
 replace_with = "0.1.7"
+tikv-jemallocator = "0.5.4"
 
 [dependencies.zip]
 path = ".."