zlib: roll back a failed add() directory rewrite

add()/addEntrySync() advanced the central-directory offset and adopted
the new entry into memory before the final directory rewrite. If that
rewrite failed (ENOSPC/EIO after the member bytes were already written),
the in-memory state and the on-disk archive were left diverged and
half-updated, with no restore, corrupting the next add().

Wrap the rewrite: on failure, restore the previous offset and directory
entry and rewrite the original directory back, leaving the archive and
handle exactly as before the call, then rethrow.

Signed-off-by: Philipp Dunkel <pip@pipobscure.com>

Author: pipobscure

lib/internal/zip/file.js

@@ -387,10 +387,11 @@ class ZipFile {
     return this.#enqueue(async () =>
       this.#doAdd(await ZipEntry.create(filename, data, options)));
   }
-  // Append the entry's bytes where the central directory currently starts,
-  // then rewrite the directory to include it. On write failure, restore the
-  // original directory (the partial write may have clobbered it) and rethrow;
-  // on success, promote a spent stream entry to its on-disk copy.
+  // Append the entry's bytes where the central directory currently starts, then
+  // rewrite the directory to include it. If the member write or the directory
+  // rewrite fails, restore the original directory and drop the half-adopted
+  // entry so the archive is left exactly as it was, then rethrow; on success,
+  // promote a spent stream entry to its on-disk copy.
   async #doAdd(entry) {
     const localOffset = this.#centralDirectoryOffset;
     let written = 0;
@@ -413,9 +414,30 @@ class ZipFile {
       }
       throw err;
     }
+    const previousEntry = MapPrototypeGet(this.#entries, entry.name);
     this.#centralDirectoryOffset = localOffset + written;
     MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
-    await this.#rewriteCentralDirectory();
+    try {
+      await this.#rewriteCentralDirectory();
+    } catch (err) {
+      // The directory rewrite failed after the member bytes landed. Undo the
+      // in-memory adoption and rewrite the original directory back at its old
+      // offset (where the failed member bytes started), leaving the archive and
+      // this handle exactly as before the call.
+      this.#centralDirectoryOffset = localOffset;
+      if (previousEntry === undefined) {
+        MapPrototypeDelete(this.#entries, entry.name);
+      } else {
+        MapPrototypeSet(this.#entries, entry.name, previousEntry);
+      }
+      try {
+        await this.#rewriteCentralDirectory();
+      } catch {
+        // Restoring failed too (the device is likely full or gone); the
+        // original error is the actionable one.
+      }
+      throw err;
+    }
     // The entry now has a stable home in this archive; if it was a spent
     // streaming entry, rebind it to that on-disk copy so it stays readable.
     entry[kPromote](this.#handle, localOffset);
@@ -453,9 +475,27 @@ class ZipFile {
       }
       throw err;
     }
+    const previousEntry = MapPrototypeGet(this.#entries, entry.name);
     this.#centralDirectoryOffset = localOffset + written;
     MapPrototypeSet(this.#entries, entry.name, { central: null, entry, localOffset });
-    this.#rewriteCentralDirectorySync();
+    try {
+      this.#rewriteCentralDirectorySync();
+    } catch (err) {
+      // See #doAdd(): undo the in-memory adoption and restore the original
+      // directory so a failed rewrite leaves the archive exactly as it was.
+      this.#centralDirectoryOffset = localOffset;
+      if (previousEntry === undefined) {
+        MapPrototypeDelete(this.#entries, entry.name);
+      } else {
+        MapPrototypeSet(this.#entries, entry.name, previousEntry);
+      }
+      try {
+        this.#rewriteCentralDirectorySync();
+      } catch {
+        // Restoring failed too; the original error is the actionable one.
+      }
+      throw err;
+    }
     entry[kPromote](this.#handle, localOffset);
     return entry;
   }