zip-rs: initial integration

[DavidKorczynski]

zip-rs is a rust library which supports reading and writing of simple ZIP files.

Data on crates.io shows it has been downloaded 5.7 million times https://crates.io/crates/zip and has 344 reverse dependencies https://crates.io/crates/zip/reverse_dependencies which also shows its list of customers

---

@Plecra would you be interested in integrating zip-rs into oss-fuzz? By way of OSS-Fuzz we can add fuzzers to zip-rs and run them continuously - you will then receive reports whenever crashes are found. If you would like to integrate, could you please provide a set of email(s) that will get access to the data produced by OSS-Fuzz, such as bug reports. The emails should be linked to a Google account in order to view the detailed reports and notice the emails affiliated with the project will be public in the OSS-Fuzz repo, as they will be part of a configuration file. We can also add the fuzzers of this PR to the main zip-rs repository.

[Plecra]

Wow, thankyou! I think this could do zip a lot of good.

Could you help me understand what would be involved in generating inputs for a crate like zip? I imagine it's more involved than completely random files that the parser would just treat as junk 😄

My own email (attached to this github account) would be best at the moment.

[DavidKorczynski]

Wow, thankyou! I think this could do zip a lot of good.

Could you help me understand what would be involved in generating inputs for a crate like zip? I imagine it's more involved than completely random files that the parser would just treat as junk

My own email (attached to this github account) would be best at the moment.

The benefit at first would be to test parser and ensure no unknown panics are being thrown. We could also add a fuzzer that checks if decompress(compress(s)) == s holds true, i.e. look for divergences.

Would you be happy to have the fuzzers in the upstream repository? If so, I can do a PR on zip-rs and move it all up there before merging in this PR.

[zamazan4ik]

@DavidKorczynski do you have any updates on this PR? I am interested in it a lot :)

[DavidKorczynski]

Thanks @zamazan4ik - I will make this one ready today

[zamazan4ik]

@DavidKorczynski just a friendly reminder :)

[zamazan4ik]

@DavidKorczynski do we need to ping someone explicitly for the review?

[DavidKorczynski]

@inferno-chromium @jonathanmetzman @oliverchang this one is ready for reaview