libextractor

commit a09ab061a5690800d1a388802d33692d380e6cb6
parent fe6d657e9a401ed1a33ae28d33b8da38dfd1f530
Author: Christian Grothoff <christian@grothoff.org>
Date:   Wed, 29 Jul 2026 11:04:02 +0200

fix unzip OOB

Diffstat:
M
src/common/unzip.c
 | 
9
++++++++-

1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/src/common/unzip.c b/src/common/unzip.c
@@ -696,11 +696,18 @@ get_current_file_info (struct EXTRACTOR_UnzipFile *file,
       *(szComment + file_info.size_file_comment) = '\0';
       uSizeRead = file_info.size_file_comment;
     }
-    else
+    else if (commentBufferSize > 0)
     {
       *(szComment + commentBufferSize - 1) = '\0';
       uSizeRead = commentBufferSize - 1;
     }
+    else
+    {
+      /* Nothing fits, not even the terminator; without this branch
+         `szComment[-1]` is written and `commentBufferSize - 1` wraps to
+         ULONG_MAX.  Mirrors the guard the file name branch above has. */
+      uSizeRead = 0;
+    }
 
     if (0 != lSeek)
     {