Malformed APK zip header?

[Eric Cloninger]

We had someone send an app to our team this week with some problems.
The app, which was *not* exported, had several problems. One thing I
found interesting, there was a folder in the ZIP header called "..",
so I followed it. Eventually, I found a folder 3 levels above the
manifest named "src" and then some folders under that. This is valid
in ZIP and the app installed in on my phone. I also installed it on
the emulator and it doesn't appear that the presence of the
../../../src folder does anything negative, but I would think the
build chain would prevent this somehow.

Bug, works as designed, or nothing to see here?

-E

[Manfred Moser]

Could be a different build chain creating the app..

[Eric Cloninger]

I have a question out to the dev to ask them how they built it.
Decompiling the app shows the usual stuff in terms of resources, but I
haven't decompiled the code parts with smali to see if it looks like
standard Java lifecycle stuff. I'll dig into it a little deeper.

Good idea. Thanks, Manfred.

-E