Pull request overview

This PR updates the fuzzers for the new ZIP encryption streams to exercise the actual ZipArchive encryption/decryption paths (ZipCrypto and WinZip AES) rather than constructing the internal crypto streams via reflection.

Changes:

• Replace reflection-based stream construction with ZipArchive.CreateEntry(..., password, ZipEncryptionMethod) + Open/OpenAsync(password) round-trip workflows.
• Add validation that the entry is encrypted and the expected encryption method is recorded, and verify plaintext round-trips correctly (sync + async).
• Add a “wrong password” scenario intended to ensure failures are handled as InvalidDataException (but it currently doesn’t assert failure if no exception is thrown).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

        // Decrypting with a wrong password must fail cleanly with InvalidDataException, never crash.
        try
        {
            using Stream stream = readEntry.Open("wrong-password".AsSpan());
            stream.CopyTo(Stream.Null);
        }
        catch (InvalidDataException)
        {
            // Expected: the header password verifier rejects the wrong key.
        }

        // Decrypting with a wrong password must fail cleanly with InvalidDataException, never crash.
        try
        {
            using Stream stream = readEntry.Open("wrong-password".AsSpan());
            stream.CopyTo(Stream.Null);
        }
        catch (InvalidDataException)
        {
            // Expected: the AES password verifier / HMAC rejects the wrong key.
        }

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Thanks, this looks a lot better!

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

        int newlineIndex = payload.IndexOf((byte)'\n');
        ReadOnlySpan<byte> passwordBytes = newlineIndex < 0 ? ReadOnlySpan<byte>.Empty : payload.Slice(0, newlineIndex);
        ReadOnlySpan<byte> contentBytes = newlineIndex < 0 ? payload : payload.Slice(newlineIndex + 1);

        // The first byte is consumed below as the encryption-method selector, so an empty
        // input has no byte to interpret and there is nothing to fuzz.
        if (bytes.Length < 2)
        {
            return;