chore(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream fuzz test (DSPX-5102) by dmihalcik-virtru · Pull Request #4217 · opentdf/platform

dmihalcik-virtru · 2026-10-14T15:12:42Z

Summary

Test-only follow-up for the ZIP64 length overflow in sdk: TDF reader panics and permissive validation on malformed archives (v0.34.0) #4202 (DSPX-5102, duplicates DSPX-4687). There is no code change: main is not affected. DSPX-4590 (fix(sdk): bound zip64 reader offsets against the archive (DSPX-4590) #4043) already checks every ZIP64 size and offset against the archive bounds in NewReader. I confirmed by building the exact archive from the issue.
What this pins: the bounds check in bound.offset is written delta > limit-base. 0xFFFFFFFFFFFFFFFF is the value that wraps if someone rewrites it as base+delta > limit. The existing rows (1<<63, 1<<40) don't wrap, so they would not notice that regression.
Adds stored size MaxUint64 to TestReaderRejectsZip64ValuesBeyondArchive and the same archive as a FuzzReader seed.

Verification

I mutated the check to base+delta > b.limit and ran the package. Three tests fail: the new conformance row, the new FuzzReader seed (the seed runs as a plain test case under go test, not only under -fuzz), and #4214's TestManifest_DeclaredSizeBeyondArchiveRejectedWithoutCap. The 1<<63 and 1<<40 rows keep passing.

Notes

Overlaps with fix(sdk): make the manifest size limit opt-in (DSPX-4502) #4214's test, which covers the same value through NewTDFReader. The row here is the targeted home for it next to the other bounds rows.
An earlier revision added guards in ReadAllFileData/readBytes. They are unreachable (ReadFileData already bounds its arguments, and NewReader guarantees non-negative entries), so they were dropped.

Testing

go test -race and golangci-lint for sdk/internal/zipstream.

Summary by CodeRabbit

Tests
- Expanded coverage for ZIP archive validation, including ZIP64 entries with oversized compressed-size values and edge cases in archive bounds checking. These checks help verify that malformed archives are rejected rather than accepted. No user-facing features or behavior changes are included.

coderabbitai · 2026-10-14T15:12:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 1c5dc3b1-5c1d-47fb-96a7-56f7eadf4d49

📥 Commits

Reviewing files that changed from the base of the PR and between 08ecb66 and 53babfa.

📒 Files selected for processing: 2

sdk/internal/zipstream/fuzz_test.go
sdk/internal/zipstream/zip64_conformance_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The ZIP stream fuzz and conformance tests now include a ZIP64 entry with a declared compressed size of math.MaxUint64. The conformance test expects NewReader to reject the archive and identify the file-data offset field.

Changes: ZIP64 size-boundary tests

Layer / File(s)	Summary
ZIP64 overflow test coverage `sdk/internal/zipstream/fuzz_test.go`, `sdk/internal/zipstream/zip64_conformance_test.go`	The fuzz seed and conformance case use `math.MaxUint64` as the declared compressed size. The conformance test expects an invalid ZIP error for the file-data offset field.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: elizabethhealy

Merge Risk: ⚪ Minimal · up to 53bab

The change adds ZIP64 overflow regression coverage without an identified production behavior change or merge-blocking issue.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the test-only ZIP64 MaxUint64 stored-size coverage added to the fuzz test. It is specific and related to the main change, although it does not mention the additional confo…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 2

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🛠️ Fix failing CI checks: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{A rabbit zipped a seed away
With MaxUint64 tucked in the tray
The reader checked the file-data door
And turned the invalid archive from the floor
Then hopped off, pleased with tests once more}

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-14T15:17:46Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	381.674222ms
Throughput	262.00 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.648064318s
Average Latency	395.636459ms
Throughput	126.11 requests/second

github-actions · 2026-10-14T15:28:35Z

…PX-5102) A ZIP64 stored size of 0xFFFFFFFFFFFFFFFF would narrow to int64 -1 and reach make([]byte, -1) (#4202). NewReader already rejects it because every ZIP64 size and offset is checked against the archive bounds (DSPX-4590, #4043), so there is no code change here. The bounds check is written as delta > limit-base. MaxUint64 is the value that wraps if it were ever rewritten as base+delta > limit; the other rows (1<<63, 1<<40) do not wrap, so they would not notice. Add MaxUint64 as a conformance row and as a FuzzReader seed. Both fail if the check is made additive. Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

github-actions · 2026-10-14T15:45:26Z

X-Test Failure Report

govulncheck-failure-4
govulncheck-failure-1
govulncheck-failure-2
govulncheck-failure-7
opentdf~~platform~~M0U4NT.dockerbuild
govulncheck-failure-0

github-actions · 2026-10-14T15:45:41Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	320.197534ms
Throughput	312.31 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.520477424s
Average Latency	374.657443ms
Throughput	133.26 requests/second

github-actions · 2026-10-14T15:48:06Z

Benchmark results, click to expand

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	347.829305ms
Throughput	287.50 requests/second

TDF3 Benchmark Results

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	36.518421142s
Average Latency	364.530047ms
Throughput	136.92 requests/second

github-actions · 2026-10-14T15:57:51Z

github-actions · 2026-10-14T17:25:41Z

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

otdfctl
sdk
service
lib/fixtures
tests-bdd

See the workflow run for details.

github-actions Bot added comp:sdk A software development kit, including library, for client applications and inter-service communicati size/s labels Oct 14, 2026

dmihalcik-virtru force-pushed the DSPX-5102-zip-negative-lengths branch from 10244d9 to 026ded2 Compare October 14, 2026 15:41

dmihalcik-virtru changed the title ~~fix(sdk): refuse negative ZIP lengths in ReadAllFileData and readBytes (DSPX-5102)~~ test(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream (DSPX-5102) Oct 14, 2026

dmihalcik-virtru force-pushed the DSPX-5102-zip-negative-lengths branch from 026ded2 to 53babfa Compare October 14, 2026 15:43

dmihalcik-virtru changed the title ~~test(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream (DSPX-5102)~~ chore(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream fuzz test (DSPX-5102) Oct 14, 2026

dmihalcik-virtru mentioned this pull request Oct 14, 2026

fix(sdk): reject malformed ZIP64 lengths and null assertion statements; refuse isEncrypted=false (DSPX-5102) #4207

Closed

2 of 3 tasks

dmihalcik-virtru marked this pull request as ready for review October 14, 2026 15:48

dmihalcik-virtru requested review from a team as code owners October 14, 2026 15:48

elizabethhealy approved these changes Oct 14, 2026

View reviewed changes

dmihalcik-virtru added this pull request to the merge queue Oct 14, 2026

Merged via the queue into main with commit 5d0a4c4 Oct 14, 2026
112 of 124 checks passed

dmihalcik-virtru deleted the DSPX-5102-zip-negative-lengths branch October 14, 2026 20:27

Navigation Menu

Repository navigation

chore(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream fuzz test (DSPX-5102) - #4217

chore(sdk): pin the #4202 ZIP64 MaxUint64 stored size in zipstream fuzz test (DSPX-5102)#4217
dmihalcik-virtru merged 1 commit into
mainfrom
DSPX-5102-zip-negative-lengths

dmihalcik-virtru commented Oct 14, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

github-actions Bot commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dmihalcik-virtru commented Oct 14, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Notes

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 14, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

Bulk Benchmark Results

TDF3 Benchmark Results

Uh oh!

github-actions Bot commented Oct 14, 2026

X-Test Results

Uh oh!

github-actions Bot commented Oct 14, 2026

⚠️ Govulncheck found vulnerabilities ⚠️

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dmihalcik-virtru commented Oct 14, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 14, 2026 •

edited

Loading