bodgit / sevenzip / 37242949759

78%

push

github

fix: validate file and stream counts in header (#497)

readHeader mapped each non-empty file to a stream with
FileFolderAndSize without checking the header was consistent, so a
crafted header could panic NewReader:

* files with streams but no unpack info (nil pointer dereference)
* files with streams but no streams info at all (nil pointer
  dereference in init)
* more non-empty files than substreams (index out of range)
* a folder with multiple substreams but no sizes (index out of range)

Require the number of non-empty files to match the number of streams,
as 7-Zip does, and require substream sizes when any folder has more
than one stream.

Also fix FileFolderAndSize mapping every file to folder 0 when there
is no substreams info; each folder holds exactly one file in that case.

Fixes #491

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

30 of 30 new or added lines in 2 files covered. (100.0%)

1903 of 2513 relevant lines covered (75.73%)

0.85 hits per line