fix: support skipping unread header sizes of ResChunk

Author: iBotPeaches

brut.apktool/apktool-lib/src/main/java/brut/androlib/res/data/arsc/ARSCHeader.java

@@ -21,6 +21,8 @@
 
 import java.io.EOFException;
 import java.io.IOException;
+import java.math.BigInteger;
+import java.util.logging.Logger;
 
 public class ARSCHeader {
     public final short type;
@@ -48,6 +50,28 @@ public static ARSCHeader read(ExtDataInput in, CountingInputStream countIn) thro
         return new ARSCHeader(type, in.readShort(), in.readInt(), start);
     }
 
+    public void skipRemainingHeader(ExtDataInput in, CountingInputStream countIn) throws IOException {
+        // Some applications lie about the reported size of their chunk header. Trusting the chunkSize is misleading
+        // So compare to what we actually read in the header vs reported and skip the rest.
+        int actualHeaderSize = countIn.getCount() - this.startPosition;
+        int exceedingSize = this.headerSize - actualHeaderSize;
+        if (exceedingSize > 0) {
+            byte[] buf = new byte[exceedingSize];
+            in.readFully(buf);
+            BigInteger exceedingBI = new BigInteger(1, buf);
+
+            if (exceedingBI.equals(BigInteger.ZERO)) {
+                LOGGER.fine(String.format("Chunk header size (%d), read (%d), but exceeding bytes are all zero.",
+                    this.headerSize, actualHeaderSize
+                ));
+            } else {
+                LOGGER.warning(String.format("Chunk header size (%d), read (%d). Exceeding bytes: 0x%X.",
+                    this.headerSize, actualHeaderSize, exceedingBI
+                ));
+            }
+        }
+    }
+
     public void skipChunk(ExtDataInput in) throws IOException {
         in.skipBytes(chunkSize - headerSize);
     }
@@ -76,4 +100,6 @@ public void skipChunk(ExtDataInput in) throws IOException {
     public final static short RES_XML_CDATA_TYPE = 0x0104;
     public final static short RES_XML_LAST_CHUNK_TYPE = 0x017f;
     public final static short RES_XML_RESOURCE_MAP_TYPE = 0x0180;
+
+    private static final Logger LOGGER = Logger.getLogger(ARSCHeader.class.getName());
 }

brut.apktool/apktool-lib/src/main/java/brut/androlib/res/decoder/ARSCDecoder.java

@@ -120,6 +120,9 @@ private ResPackage[] readResourceTable() throws IOException, AndrolibException {
                     }
                     break chunkLoop;
             }
+
+            // Check for chunks that are lying about their header size
+            mHeader.skipRemainingHeader(mIn, mCountIn);
         }
 
         if (mPkg.getResSpecCount() > 0) {