{"record":{"id":"b73ba77599150c27","repo":"oven-sh/bun","slug":"zip-central-directory-not-within-tail-for-url","errorCode":null,"errorMessage":"zip central directory not within tail for ${url}","messagePattern":"zip central directory not within tail for (.+?)","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/binary-size.ts","lineNumber":342,"sourceCode":"  if (!head.ok) throw new Error(`HEAD ${url}: ${head.status}`);\n  const total = Number(head.headers.get(\"content-length\"));\n  const tail = Math.min(65536, total);\n  const res = await fetch(url, { headers: { Range: `bytes=${total - tail}-${total - 1}` } });\n  if (!res.ok) throw new Error(`Range ${url}: ${res.status}`);\n  const buf = new Uint8Array(await res.arrayBuffer());\n  const dv = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);\n\n  let eocd = -1;\n  for (let i = buf.length - 22; i >= Math.max(0, buf.length - 22 - 65535); i--) {\n    if (dv.getUint32(i, true) === 0x06054b50) {\n      eocd = i;\n      break;\n    }\n  }\n  if (eocd < 0) throw new Error(`no zip EOCD in ${url}`);\n\n  let p = dv.getUint32(eocd + 16, true) - (total - tail);\n  if (p < 0) throw new Error(`zip central directory not within tail for ${url}`);\n\n  let size = 0;\n  while (p + 46 <= eocd && dv.getUint32(p, true) === 0x02014b50) {\n    const uncompressed = dv.getUint32(p + 24, true);\n    const nameLen = dv.getUint16(p + 28, true);\n    const name = new TextDecoder().decode(buf.subarray(p + 46, p + 46 + nameLen));\n    // The binary is the only non-directory entry; take the largest in case the\n    // zip ever grows extra metadata files.\n    if (!name.endsWith(\"/\") && uncompressed > size) size = uncompressed;\n    p += 46 + nameLen + dv.getUint16(p + 30, true) + dv.getUint16(p + 32, true);\n  }\n  if (size === 0) throw new Error(`no file entry in ${url}`);\n  return size;\n}\n","sourceCodeStart":324,"sourceCodeEnd":357,"githubUrl":"https://github.com/oven-sh/bun/blob/8c5296ac459e8252d3cd702f3fbcbb0c249d95d5/scripts/binary-size.ts#L324-L357","documentation":"zipBinarySize() found the EOCD, but the central-directory offset it records (read at EOCD+16, rebased by the tail start) is negative — the central directory begins earlier than the fetched 64 KB tail, so entry headers are not fully inside the buffer.","triggerScenarios":"A release zip whose central directory (all entry headers plus names and extra fields) exceeds ~64 KB. The release zips here normally hold only two entries (the <triplet>/ directory and the bun binary), so any layout growth breaks the assumption.","commonSituations":"Release tooling adds metadata files or long entry names; a different artifact type accidentally matches isBinaryZip and is probed.","solutions":["Raise the tail window in zipBinarySize, e.g. fetch min(1 MB, total) instead of 64 KB","Or fall back to downloading the whole zip when this throws","Verify only the expected two-entry release zips are being probed (check the isBinaryZip filter)"],"exampleFix":"// before\nconst tail = Math.min(65536, total);\n\n// after — central directories can exceed 64 KB\nconst tail = Math.min(1024 * 1024, total);","handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { return await zipBinarySize(url); }\ncatch (e) {\n  if (/central directory not within tail/.test(e.message)) {\n    return sizeFromFullZip(new Uint8Array(await (await fetch(url)).arrayBuffer()));\n  }\n  throw e;\n}","preventionTips":["Size the tail window for the worst-case central directory, not the current one","Keep release zips minimal (dir + binary) so the 64 KB assumption holds"],"tags":["zip","parsing","binary-size","range-request"],"backgroundTag":null,"analyzedSha":"8c5296ac459e8252d3cd702f3fbcbb0c249d95d5","analyzedAt":"2026-08-16T08:01:58.794Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}