The details are explained in the WinZip documentation. It describes two encryption formats, termed AE-1 and AE-2. The format itself supports 128, 192, and 256-bit keys for AES in CTR mode, using PBKDF2-HMAC-SHA1 with 1000 iterations for key derivation. The salt is random and is half the size of the key. Help with decrypting data using a library is given elsewhere on the site.
You can verify that the decryption is correct by checking the password verification value:
This two-byte value is produced as part of the process that derives the encryption and decryption keys from the password. When encrypting, a verification value is derived from the encryption password and stored with the encrypted file. Before decrypting, a verification value can be derived from the decryption password and compared to the value stored with the file, serving as a quick check that will detect most, but not all, incorrect passwords. There is a 1 in 65,536 chance that an incorrect password will yield a matching verification value; therefore, a matching verification value cannot be absolutely relied on to indicate a correct password.
The key is derived from the password using PBKDF2, explained as follows:
Key derivation, as used by AE-1 and AE-2 and as implemented in Dr. Gladman's library, is done according to the PBKDF2 algorithm, which is described in the RFC2898 guidelines. An iteration count of 1000 is used. An appropriate number of bits from the resulting hash value are used to compose three output values: an encryption key, an authentication key, and a password verification value. The first n bits become the encryption key, the next m bits become the authentication key, and the last 16 bits (two bytes) become the password verification value.
General useful information on the PKZip format is also available here.