{"record":{"id":"ec0aaae6c9149c1d","repo":"can1357/oh-my-pi","slug":"invalid-zip-archive-malformed-lzma-properties-for","errorCode":null,"errorMessage":"Invalid ZIP archive: malformed LZMA properties for '${memberPath}'","messagePattern":"Invalid ZIP archive: malformed LZMA properties for '(.+?)'","errorType":"exception","errorClass":"ArchiveError","httpStatus":null,"severity":"error","filePath":"packages/utils/src/ar/zip.ts","lineNumber":345,"sourceCode":"}\n\nasync function decodeMember(\n\tcompressed: Uint8Array,\n\tmethod: number,\n\tsize: number,\n\tmemberPath: string,\n): Promise<Uint8Array> {\n\ttry {\n\t\tswitch (method) {\n\t\t\tcase 0:\n\t\t\t\treturn compressed;\n\t\t\tcase 8:\n\t\t\t\treturn zlib.inflateRawSync(compressed, { maxOutputLength: Math.max(size, 1) });\n\t\t\tcase 12:\n\t\t\t\treturn await bzip2Decompress(compressed, size);\n\t\t\tcase 14: {\n\t\t\t\tif (compressed.byteLength < 9 || compressed[2] !== 5 || compressed[3] !== 0) {\n\t\t\t\t\tthrow new ArchiveError(`Invalid ZIP archive: malformed LZMA properties for '${memberPath}'`);\n\t\t\t\t}\n\t\t\t\treturn await lzmaDecompress(compressed.subarray(4, 9), compressed.subarray(9), size);\n\t\t\t}\n\t\t\tcase 20:\n\t\t\tcase 93:\n\t\t\t\treturn await zstdDecompress(compressed, size);\n\t\t\tcase 95:\n\t\t\t\treturn await xzDecompress(compressed, size);\n\t\t\tdefault:\n\t\t\t\tthrow new ArchiveError(`Unsupported ZIP compression method ${method} for '${memberPath}'`);\n\t\t}\n\t} catch (error) {\n\t\tthrow archiveError(error, `Failed to decompress ZIP member '${memberPath}'`);\n\t}\n}\n\nclass ZipMemberSource implements MemberSource {\n\treadonly #source: ByteSource;","sourceCodeStart":327,"sourceCodeEnd":363,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/utils/src/ar/zip.ts#L327-L363","documentation":"A ZIP member compressed with method 14 (LZMA) must begin with a 4-byte LZMA SDK header whose bytes 2 and 3 are the properties size marker 0x05 0x00, followed by 5 bytes of LZMA properties and the LZMA stream. This member's compressed data is shorter than 9 bytes or lacks the 0x05 0x00 marker, so it is not a valid LZMA-in-ZIP payload.","triggerScenarios":"Reading a ZIP entry whose compression method is 14 whose stored data is truncated (fewer than 9 bytes) or whose bytes at offsets 2-3 are not 0x05,0x00 — i.e. not produced by a conformant LZMA ZIP writer.","commonSituations":"Corrupted or truncated downloads of LZMA-compressed archives, hand-rolled writers that store raw LZMA without the 5-byte ZIP LZMA properties header, malicious/fuzzed archives.","solutions":["Verify the archive with unzip -t / 7z t and re-obtain if corrupt.","Repack the archive with 7-Zip (7z a -tzip -m0=lzma) so the header/properties bytes are written correctly.","If you write LZMA entries yourself, prepend the 4-byte header (version 2 bytes, then 0x05 0x00) plus the 5-byte LZMA properties block before the stream, matching the ZIP APPNOTE method-14 layout."],"exampleFix":"// before: raw LZMA stream stored directly in the entry\n// after\n// payload = concat(Uint8Array([0x02,0x00,0x05,0x00]), lzmaProperties5Bytes, lzmaStream);","handlingStrategy":"try-catch","validationCode":"const res = await $`unzip -lv archive.zip`.quiet().nothrow();\nif (res.exitCode === 0 && (await res.text()).includes(\"LZMA\")) {\n  // method 14 present: ensure archive came from a conformant writer (e.g. 7-Zip)\n}","typeGuard":null,"tryCatchPattern":"try {\n  await archive.readMember(path);\n} catch (err) {\n  if (err instanceof ArchiveError && err.message.includes(\"malformed LZMA properties\")) {\n    // repack with 7z: 7z x corrupted.zip -o tmp && 7z a -tzip -m0=lzma fixed.zip tmp/*\n  } else throw err;\n}","preventionTips":["Only create LZMA ZIP entries with 7-Zip or another APPNOTE-conformant tool.","Verify integrity (unzip -t) before ingesting LZMA archives.","Avoid hand-rolled LZMA-in-ZIP writers."],"tags":["zip","lzma","decompression","archive-corruption"],"backgroundTag":"lzma-malformed-properties","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}