summaryrefslogtreecommitdiff
path: root/Build/source/libs/zziplib/zziplib-src/zzip/zip.c
diff options
context:
space:
mode:
Diffstat (limited to 'Build/source/libs/zziplib/zziplib-src/zzip/zip.c')
-rw-r--r--Build/source/libs/zziplib/zziplib-src/zzip/zip.c14
1 files changed, 13 insertions, 1 deletions
diff --git a/Build/source/libs/zziplib/zziplib-src/zzip/zip.c b/Build/source/libs/zziplib/zziplib-src/zzip/zip.c
index fbca9951d17..d0b2d6e4196 100644
--- a/Build/source/libs/zziplib/zziplib-src/zzip/zip.c
+++ b/Build/source/libs/zziplib/zziplib-src/zzip/zip.c
@@ -320,6 +320,12 @@ __zzip_fetch_disk_trailer(int fd, zzip_off_t filesize,
# endif
__fixup_rootseek(offset + tail - mapped, trailer);
+ /*
+ * "extract data from files archived in a single zip file."
+ * So the file offsets must be within the current ZIP archive!
+ */
+ if (trailer->zz_rootseek >= filesize || (trailer->zz_rootseek + trailer->zz_rootsize) >= filesize)
+ return(ZZIP_CORRUPTED);
{ return(0); }
} else if ((*tail == 'P') &&
end - tail >=
@@ -338,6 +344,12 @@ __zzip_fetch_disk_trailer(int fd, zzip_off_t filesize,
zzip_disk64_trailer_finalentries(orig);
trailer->zz_rootseek = zzip_disk64_trailer_rootseek(orig);
trailer->zz_rootsize = zzip_disk64_trailer_rootsize(orig);
+ /*
+ * "extract data from files archived in a single zip file."
+ * So the file offsets must be within the current ZIP archive!
+ */
+ if (trailer->zz_rootseek >= filesize || (trailer->zz_rootseek + trailer->zz_rootsize) >= filesize)
+ return(ZZIP_CORRUPTED);
{ return(0); }
# endif
}
@@ -630,7 +642,7 @@ zzip_dir_alloc(zzip_strings_t * fileext)
* are helper functions used implicitly in other zzipcalls
* e.g. => zzip_dir_close = zzip_close
*
- * returns zero on sucess
+ * returns zero on success
* returns the refcount when files are attached.
*/
int