Skip to content

gh-156539: Validate duplicate ZIP members individually in testzip - #156540

Open
lpyu001 wants to merge 2 commits into
python:mainfrom
lpyu001:fix-testzip-bug-156539
Open

lpyu001 wants to merge 2 commits into
python:mainfrom
lpyu001:fix-testzip-bug-156539

Conversation

@lpyu001

@lpyu001 lpyu001 commented Aug 29, 2026

Copy link
Copy Markdown
Contributor

Fix ZipFile.testzip() to pass each ZipInfo object directly to open() instead of reopening the member by filename.

When an archive contains duplicate filenames, filename-based lookup resolves to the last matching entry. As a result, testzip() can iterate over an earlier ZipInfo but actually reopen and validate a later duplicate, allowing corruption in the earlier member to go undetected.

Passing the ZipInfo directly preserves the identity of the member being iterated and ensures that every entry in filelist is validated individually.

This also avoids an unnecessary filename-to-ZipInfo lookup through NameToInfo and makes the implementation better match the existing ZipFile.open() API, which already accepts ZipInfo objects specifically to disambiguate duplicate members.

Pass each ZipInfo directly to open() so testzip() does not resolve duplicate filenames to the last matching member.

Co-authored-by: lipengyu <lipengyu@kylinos.cn>
@lpyu001

lpyu001 commented Sep 22, 2026

Copy link
Copy Markdown
Contributor Author

Could you take a look at this PR when you have a chance? @pitrou

Since testzip() already iterates over the exact ZipInfo objects, I don't think it needs to look the member up again by name. Passing the ZipInfo directly preserves member identity, avoids an unnecessary lookup, and handles duplicate filenames correctly.

the relevant commit:
c534270

@lpyu001 lpyu001 closed this Sep 23, 2026
@lpyu001
lpyu001 deleted the fix-testzip-bug-156539 branch September 23, 2026 02:54
@lpyu001
lpyu001 restored the fix-testzip-bug-156539 branch September 23, 2026 03:00
@lpyu001 lpyu001 reopened this Sep 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant