From 3ffad37ea79a15fb0989cc1da00ac444faf3349b Mon Sep 17 00:00:00 2001
From: nakata-app <ataknakbaba@gmail.com>
Date: Wed, 8 Jul 2026 09:38:54 +0300
Subject: [PATCH] minizip: fix heap-buffer-overflow in zipRemoveExtraInfoBlock

zipRemoveExtraInfoBlock() read a 2-byte block-size field from the
input buffer and used it unchecked as a memcpy length and pointer
advance, with no validation against the buffer's remaining size.
An attacker-controlled extra-field blob can therefore drive both the
read cursor and the memcpy length past the end of the buffer.

Add a bounds check before consuming each block header: bail out with
ZIP_PARAMERROR if fewer than 4 bytes remain, or if the declared block
size (dataSize + 4) exceeds what is left in the buffer.

Verified with the reproducer from the report (ASan
heap/stack-buffer-overflow before the fix, clean run after) and a
regression case with two well-formed blocks confirming normal
block-removal behavior is unchanged.

Fixes #1276
---
 contrib/minizip/zip.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
index 0bbdf77e5f..5b0a0422ca 100644
--- a/contrib/minizip/zip.c
+++ b/contrib/minizip/zip.c
@@ -2212,9 +2212,21 @@ extern int ZEXPORT zipRemoveExtraInfoBlock(char* pData, int* dataLen, short sHea
 
   while(p < (pData + *dataLen))
   {
+    if ((pData + *dataLen) - p < 4)
+    {
+      free(pNewHeader);
+      return ZIP_PARAMERROR;
+    }
+
     header = *(short*)p;
     dataSize = *(((short*)p)+1);
 
+    if (dataSize < 0 || dataSize + 4 > (pData + *dataLen) - p)
+    {
+      free(pNewHeader);
+      return ZIP_PARAMERROR;
+    }
+
     if( header == sHeader ) /* Header found. */
     {
       p += dataSize + 4; /* skip it. do not copy to temp buffer */