Skip to content

Corrupted ZIP being created from simple read then write #555

Closed

Description

@carcigenicate

ADM-ZIP Version: 0.5.16
OS: Ubuntu 22.04.5 LTS
Node: 20.10.0

ADM-ZIP is creating corrupt ZIPs. Originally, I was trying to read the entries of an existing ZIP, edit a few of them, and then export the resulting buffer. That was failing, and managed to trim it down to this MCVE (minus the ZIP data itself):

const admZip = require('adm-zip');
const fs = require('fs/promises');

(async () => {
  const zipBuffer = await fs.readFile('./file.docx');
  const unzipped1 = admZip(zipBuffer);

  await unzipped1.writeZipPromise('./directWrite.zip');

  // I intended to do some modification here

  const modifiedBuffer = await unzipped1.toBufferPromise();

  const unzipped2 = admZip(modifiedBuffer);
  for (const entry of unzipped2.getEntries()) {
    console.log('Reading', entry.name);
    const entryText = entry.getData();    // ERROR!
  }
})();

On the ERROR! line, ADM-ZIP is throwing:

Error: ADM-ZIP: No descriptor present
    at Object.DESCRIPTOR_NOT_EXIST (node_modules/adm-zip/util/errors.js:56:16)
    at crc32OK (node_modules/adm-zip/zipEntry.js:42:36)
    at decompress (node_modules/adm-zip/zipEntry.js:121:26)
    at Object.getData (node_modules/adm-zip/zipEntry.js:320:24)

And if I try to unzip directWrite.zip, I get an error ("An error occurred while extracting files." in Ubuntu's extractor).

When I run unzip -t directWrite.zip, I get:

Archive:  directWrite.zip
    testing: _rels/.rels              OK
error: invalid zip file with overlapped components (possible zip bomb)

The source ZIP is fine. I've validated that. I also tried processing a simple ZIP that just contains some flat text files instead of a nested DOCX ZIP, and it still failed in the same way.


I ended up using archiver to create the modified ZIP which worked great. It's a shame though, because now I need to use two different libraries just to edit a ZIP!

Activity

  1. JohnJunior commented on Jun 28, 2026

    @JohnJunior
    Contributor

    I was able to reproduce this - it happens for entries that use a data descriptor (general-purpose flag bit 3), which is how many .docx files are written.

    A possible fix is up in #564, with a regression test.

    @carcigenicate - since the original repro used your own file.docx, could you try the branch from the PR against your actual files and confirm it resolves the corruption on your end? Want to make sure it covers your case before it lands.

  2. added a commit that references this issue on Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions