there is an off-by-one error in the loop that searches for the 'end of central directory record'

git-svn-id: https://svn.apache.org/repos/asf/ant/core/trunk@1154107 13f79535-47bb-0310-9956-ffa450edef68

WHATSNEW

@@ -78,6 +78,10 @@ Fixed bugs:
    that was invoked by multiple targets from the command line.
    Bugzilla Report 50894.
 
+ * The ZipFile class could read past the start of the file if the
+   given file is not a ZIP archive and it is smaller than the size of
+   a ZIP "end of central directory record".
+
 Other changes:
 --------------
 

src/main/org/apache/tools/zip/ZipFile.java

@@ -451,12 +451,16 @@ public class ZipFile {
         throws IOException {
         boolean found = false;
         long off = archive.length() - MIN_EOCD_SIZE;
-        long stopSearching = Math.max(0L, archive.length() - MAX_EOCD_SIZE);
+        final long stopSearching =
+            Math.max(0L, archive.length() - MAX_EOCD_SIZE);
         if (off >= 0) {
-            archive.seek(off);
-            byte[] sig = ZipOutputStream.EOCD_SIG;
-            int curr = archive.read();
-            while (off >= stopSearching && curr != -1) {
+            final byte[] sig = ZipOutputStream.EOCD_SIG;
+            for (; off >= stopSearching; off--) {
+                archive.seek(off);
+                int curr = archive.read();
+                if (curr == -1) {
+                    break;
+                }
                 if (curr == sig[POS_0]) {
                     curr = archive.read();
                     if (curr == sig[POS_1]) {
@@ -470,8 +474,6 @@ public class ZipFile {
                         }
                     }
                 }
-                archive.seek(--off);
-                curr = archive.read();
             }
         }
         if (!found) {