From 6464d5ffdc6ee54f023c6230f1633debf183815f Mon Sep 17 00:00:00 2001
From: Antoine Pitrou <solipsis@pitrou.net>
Date: Sun, 12 Sep 2010 14:51:20 +0000
Subject: [PATCH] Issue #9837: The read() method of ZipExtFile objects (as
 returned by ZipFile.open()) could return more bytes than requested.

---
 Lib/test/test_zipfile.py | 20 ++++++++++++++++++++
 Lib/zipfile.py           | 15 +++++++++------
 Misc/NEWS                |  3 +++
 3 files changed, 32 insertions(+), 6 deletions(-)

diff --git a/Lib/test/test_zipfile.py b/Lib/test/test_zipfile.py
index 82b4061599..380e63b5ab 100644
--- a/Lib/test/test_zipfile.py
+++ b/Lib/test/test_zipfile.py
@@ -939,6 +939,26 @@ class OtherTests(unittest.TestCase):
     def test_read_with_bad_crc_deflated(self):
         self.check_read_with_bad_crc(zipfile.ZIP_DEFLATED)
 
+    def check_read_return_size(self, compression):
+        # Issue #9837: ZipExtFile.read() shouldn't return more bytes
+        # than requested.
+        for test_size in (1, 4095, 4096, 4097, 16384):
+            file_size = test_size + 1
+            junk = b''.join(struct.pack('B', randint(0, 255))
+                            for x in range(file_size))
+            with zipfile.ZipFile(io.BytesIO(), "w", compression) as zipf:
+                zipf.writestr('foo', junk)
+                with zipf.open('foo', 'r') as fp:
+                    buf = fp.read(test_size)
+                    self.assertEqual(len(buf), test_size)
+
+    def test_read_return_size_stored(self):
+        self.check_read_return_size(zipfile.ZIP_STORED)
+
+    @skipUnless(zlib, "requires zlib")
+    def test_read_return_size_deflated(self):
+        self.check_read_return_size(zipfile.ZIP_DEFLATED)
+
     def tearDown(self):
         unlink(TESTFN)
         unlink(TESTFN2)
diff --git a/Lib/zipfile.py b/Lib/zipfile.py
index c47c3ccfa3..bcdb2b8c9a 100644
--- a/Lib/zipfile.py
+++ b/Lib/zipfile.py
@@ -564,17 +564,20 @@ class ZipExtFile(io.BufferedIOBase):
         """Read and return up to n bytes.
         If the argument is omitted, None, or negative, data is read and returned until EOF is reached..
         """
-
         buf = b''
-        while n < 0 or n is None or n > len(buf):
-            data = self.read1(n)
+        if n is None:
+            n = -1
+        while True:
+            if n < 0:
+                data = self.read1(n)
+            elif n > len(buf):
+                data = self.read1(n - len(buf))
+            else:
+                return buf
             if len(data) == 0:
                 return buf
-
             buf += data
 
-        return buf
-
     def _update_crc(self, newdata, eof):
         # Update the CRC using the given data.
         if self._expected_crc is None:
diff --git a/Misc/NEWS b/Misc/NEWS
index c49c96ee68..6dec53d037 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -32,6 +32,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #9837: The read() method of ZipExtFile objects (as returned by
+  ZipFile.open()) could return more bytes than requested.
+
 - Issue #9826: OrderedDict.__repr__ can now handle self-referential
   values:   d['x'] = d.
 
-- 
2.40.0