8370986: Enhance Zip file reading

Reviewed-by: abakhtin
Backport-of: 0e46b6b0c682a6a4dd09d74bad4e7283fae4f479

Author: Aleksei Voitylov

src/hotspot/share/classfile/classLoader.cpp

@@ -749,6 +749,7 @@ ClassPathEntry* ClassLoader::create_class_path_entry(JavaThread* current,
 #if INCLUDE_CDS
       ClassLoaderExt::set_has_non_jar_in_classpath();
 #endif
+      log_info(class, path)("failed: %s, err: %s", path, error_msg);
       return nullptr;
     }
     log_info(class, path)("opened: %s", path);

src/java.base/share/native/libzip/zip_util.c

@@ -575,7 +575,7 @@ static jlong
 readCEN(jzfile *zip, jint knownTotal)
 {
     /* Following are unsigned 32-bit */
-    jlong endpos, end64pos, cenpos, cenlen, cenoff;
+    jlong endpos, end64pos, cenpos, cenlen, cenoff, total64;
     /* Following are unsigned 16-bit */
     jint total, tablelen, i, j;
     unsigned char *cenbuf = NULL;
@@ -609,7 +609,16 @@ readCEN(jzfile *zip, jint knownTotal)
         if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
             cenlen = ZIP64_ENDSIZ(end64buf);
             cenoff = ZIP64_ENDOFF(end64buf);
-            total = (jint)ZIP64_ENDTOT(end64buf);
+            total64 = ZIP64_ENDTOT(end64buf);
+            /* ZIP64 size, offset and total-count fields are unsigned 64-bit
+             * values. Sizes and offsets that do not fit in signed jlong
+             * (i.e., >= 2^63), or total values that do not fit in jint, are
+             * not supported and indicate a corrupt or invalid zip file.
+             */
+            if (cenlen < 0 || cenoff < 0 || total64 < 0 || total64 > INT_MAX) {
+                ZIP_FORMAT_ERROR("Zip64 END values exceed supported size");
+            }
+            total = (jint)total64;
             endpos = end64pos;
             endhdrlen = ZIP64_ENDHDR;
         }