> You might think that ZIP files would have a header, or at least a fixed-width footer, but they don't. Instead you're supposed to scan backward through the file looking for a magic number indicating you've found the central directory.

Yes. ZIP has no header, it has a footer.

What gets really messy is that the footer contains a variable length comment field, with the length stored before the field, so good look finding where the footer starts.

And here we are just talking a about a correctly generated file. This also opens up the door to all kinds of intentional abuse.