Some New Sony Stores epub files corrupt?

[KevinH]

Hi,

I just bought two new epub books from the Sony store and had trouble with them on non-Sony readers that do support Adobe DE epubs. I am not sure how pervasive this problem is, but it hit 2 out of 2 for me.

Captain's Fury by Jim Butcher
Princeps' Fury by Jim Butcher

It seems the software that Sony is using to create epubs (which are zip archives) is faulty in a dangerous way.

In both cases using unzip -t to test the epubs I find that at least one of the central directory filenames is different from the name of the file given in the local headers.

In both cases the local headers name is correct but the central directory name is wrong (mangled).

This is actually a security violation for zip archives since an attacker can modify the path and name in the local headers to force the unzip software to unpack the file into some bad location. All "unzip" programs should always default to the name of the file as given in the central directory of the zip archive.

Unfortunately, if you did that in this case both epubs would be broken since the file names would never fit with the toc entries or anything else.

In fact, if you run Adobe's own epubcheck-1.0.5 (latest development version) on the epubs in question (ignoring all of the can't decrypt anything messages) you see the following:

ERROR: /Users/kbhend/Desktop/ebook_pieces/Captain's_Fury.epub: OPS/XHTML file OEBPS/captainsfury_ch50.html is missing

and

ERROR: /Users/kbhend/Desktop/ebook_pieces/Princeps'_Fury.epub: image file OEBPS/butc_9781440642753_oeb_044_r1.jpg is missing

So Sony is not bothering to even check if the epubs they have created are correct.

This is not good. I have now bought things from a number of ebook stores and have found **terrible** quality control of the ebooks across a number of stores including:

- incorrect special (unicode) characters for the first couple of chapters used in Bernard Cornwall's latest book "The Burning Land"

- multi-column text used as a simple table in Outliers (Gladwell) that have non-properly (or even close!) layout in the ebook

- ereader styles books with the most horrible and non-spec usage of pml tags

- and now faulty epubs from the new Sony Store that do not pass epubcheck (and more importantly software that dangerously uses and unpacks things using local headers for paths and file names instead of the central directories version).

Sony should fix this asap!

KevinH

[sirmaru]

You cannot read Sony ePubs or BN ePubs with any other software but their's. However, it seems those ePubs can both be read by Sony's new 3.1 software.

I just downloaded one from BN and did read it with the Sony software.

Thus, they must be working together sharing access between them but shutting out other software.

[wallcraft]

Originally Posted by sirmaru

You cannot read Sony ePubs or BN ePubs with any other software but their's. However, it seems those ePubs can both be read by Sony's new 3.1 software.

I just downloaded one from BN and did read it with the Sony software.

Was the B&N ePub DRM-free? I think it must have been if you can read it using Sony eBL. B&N is using passworded ePubs (the password is your credit card number), which currently are not readable by anyone else. It is possible (but very unlikely) that eBL has this capability, but if so it would have asked you for the username and password for the ePub. One way to check its DRM status is to try to read it with Calibre.

On the other hand, Sony ePubs can be read by any PC or device with Adobe Digital Editions. The only issue is which AdobeID the ePub is registered to. If you have Desktop ADE and it already has an AdobeID, I think Sony uses that ID but if not you may get a different AdobeID for your Sony ePubs.

[KevinH]

Hi,

I realize that Sony used Adobe Digital Editions software to add DRM to protect their e-books. There are other Adobe Digital Editions epub readers out there including just downloading Adobe Digitial Editions software itself and using it to read the files on your Mac or PC.

The problem is that the epubs they created are technically corrupted since they do not always have the same name in the central directory as they have in the local file headers inside the zip archive that makes up the epub container.

This means that Sony, Adobe software is using the local header name instead of the central directory name when unzipping these files out of the epub (which is a security risk since someone could make a special epub that might give them an attack vector by forcing it to unpack so someplace it should not). Sony just ignores the one or two garbled/mangled central directory names and goes with the local header name. That is why the epub works on Sony and B&N (but I don't have one to try that) even though it is bad.

I think this is just a bug in their creation software that really should be fixed. Adobe's own epubcheck-1.0.5 agrees with me on this point, as does unzip -t to test the epub.

I was hoping someone from Sony would see this and pass it along to the right technical people at Sony to get this fixed.

KevinH

[cmoney]

Same problem here with Infinite Jest by David Foster Wallace and The Year of the Flood by Margaret Atwood. On my Mac, the files don't even open in the reader software. On a PC, they open ok but do not work on the reader (Sony Pocket Reader).

A week ago, I contacted Sony Support but they said they'd have to fix the files and would email me in a week. Haven't heard from them. I've since stripped the DRM and converted to LRF and the files now work on the reader.