gh-158494: zipimport: raise ZipImportError for corrupt deflate data

Author: Tony123-tech

Lib/test/test_zipimport.py

@@ -1,5 +1,6 @@
 import sys
 import os
+import py_compile
 import marshal
 import glob
 import importlib
@@ -300,6 +301,52 @@ def testBadMTime(self):
                  TESTMOD + pyc_ext: badtime_pyc}
         self.doTest(".py", files, TESTMOD)
 
+    def testCorruptDeflateDataRaisesZipImportError(self):
+        # Regression test: a corrupt deflate stream inside a .pyc must
+        # raise ZipImportError, not leak zlib.error.
+        # See gh-158494.
+        if self.compression != ZIP_DEFLATED:
+            self.skipTest("requires ZIP_DEFLATED")
+
+        modname = TESTMOD
+
+        src = os.path.join(TEMP_DIR, modname + ".py")
+        self.addCleanup(os_helper.unlink, TEMP_ZIP)
+        self.addCleanup(os_helper.rmtree, TEMP_DIR)
+
+        os.makedirs(TEMP_DIR, exist_ok=True)
+        with open(src, "w") as f:
+            f.write(test_src)
+
+        # Build a real .pyc so its magic number matches this build.
+        pyc_src = os.path.join(TEMP_DIR, modname + ".pyc")
+        py_compile.compile(src, cfile=pyc_src, doraise=True)
+
+        with ZipFile(TEMP_ZIP, "w", compression=ZIP_DEFLATED) as z:
+            z.write(src, modname + ".py")
+            z.write(pyc_src, modname + ".pyc")
+
+        # Corrupt the compressed bytes of the .pyc entry in place.
+        with open(TEMP_ZIP, "r+b") as f:
+            data = f.read()
+            idx = data.find((modname + ".pyc").encode())
+            self.assertNotEqual(idx, -1)
+            local_header = data.rfind(b"PK\x03\x04", 0, idx)
+            self.assertNotEqual(local_header, -1)
+            name_len, extra_len = struct.unpack_from(
+                "<HH", data, local_header + 26)
+            data_start = local_header + 30 + name_len + extra_len
+            f.seek(data_start)
+            f.write(b"\xff" * 8)
+
+        zipimport._zip_directory_cache.clear()
+        sys.path.insert(0, TEMP_ZIP)
+        self.addCleanup(sys.modules.pop, modname, None)
+        importlib.invalidate_caches()
+
+        with self.assertRaises(zipimport.ZipImportError):
+            importlib.import_module(modname)
+
     def test2038MTime(self):
         # Make sure we can handle mtimes larger than what a 32-bit signed number
         # can hold.

Lib/zipimport.py

@@ -668,7 +668,10 @@ def _get_data(archive, toc_entry):
                 decompress = _get_zlib_decompress_func()
             except Exception:
                 raise ZipImportError("can't decompress data; zlib not available")
-            return decompress(raw_data, -15)
+            try:
+                return decompress(raw_data, -15)
+            except Exception:
+                raise ZipImportError("could not decompress deflate data")
         case 93:  # zstd
             try:
                 return _zstd_decompress(raw_data)

Misc/NEWS.d/next/Library/2026-09-30-19-30-00.gh-issue-158494.AbCdEf.rst

@@ -0,0 +1,2 @@
+Fix :mod:`zipimport` to raise :exc:`zipimport.ZipImportError` instead of
+leaking :exc:`zlib.error` when a zip entry's deflate stream is corrupt.