Merge pull request #666 from acts-1631/validate-zip-output-size

[SDL] Bound ZIP extraction before narrowing its size
This commit is contained in:
ekeeke
2026-10-06 13:33:05 +02:00
committed by GitHub
3 changed files with 15 additions and 6 deletions
+5 -2
View File
@@ -91,11 +91,14 @@ int load_archive(char *filename, unsigned char *buffer, int maxsize, char *exten
}
/* Retrieve uncompressed file size */
size = info.uncompressed_size;
if(size > maxsize)
if(info.uncompressed_size > (uLong)maxsize)
{
size = maxsize;
}
else
{
size = info.uncompressed_size;
}
/* Read (decompress) the file */
ret = unzReadCurrentFile(fd, buffer, size);
+5 -2
View File
@@ -91,11 +91,14 @@ int load_archive(char *filename, unsigned char *buffer, int maxsize, char *exten
}
/* Retrieve uncompressed file size */
size = info.uncompressed_size;
if(size > maxsize)
if(info.uncompressed_size > (uLong)maxsize)
{
size = maxsize;
}
else
{
size = info.uncompressed_size;
}
/* Read (decompress) the file */
ret = unzReadCurrentFile(fd, buffer, size);
+5 -2
View File
@@ -91,11 +91,14 @@ int load_archive(char *filename, unsigned char *buffer, int maxsize, char *exten
}
/* Retrieve uncompressed file size */
size = info.uncompressed_size;
if(size > maxsize)
if(info.uncompressed_size > (uLong)maxsize)
{
size = maxsize;
}
else
{
size = info.uncompressed_size;
}
/* Read (decompress) the file */
ret = unzReadCurrentFile(fd, buffer, size);