It's been the source of at least two Android vulns that I can recall, since code-path A uses the top manifest for signature verification but code-path B uses th

It's been the source of at least two Android vulns that I can recall, since code-path A uses the top manifest for signature verification but code-path B uses the bottom manifest for reading out "the file" and poof!