Dennis,
>2. There is no reason that ODF 1.2 ever needs such things in a package,
>since the manifest is independent of that stuff.
Well, perhaps no "need", but if it's allowed...it can be in there...
>3. It is not possible to sign a directory/folder entry in the Zip because
>there is nothing to sign.
Actually, the same goes for the 0-size file, even an empty file can be signed :-)
> There is no data in such an entry and there should be no way to insert data
> in such an entry without it being a file instead of a folder
It is possible to craft a zip like that, although trying to unzip this could fail.
But who knows, perhaps some strange bug could be exploited because it is
not expected behavior.
>Oddly enough, the 0-length file Configurations2\accelerator\current.xml
>*has* data, and it is compressed, but the uncompressed size is 0. Fancy
>that.
Since the storage method is deflate, not stored, it could perhaps be some
deflate header ?
Bart
