If the size of the central directory is too big, reject the file.

diff --git a/zzip/memdisk.c b/zzip/memdisk.c
index e227551ae0892ad5042596f97be0fc9bc630d3ca..262919e7c9c78fe4956ae358ac9aa142a74c76e8 100644 (file)
--- a/zzip/memdisk.c
+++ b/zzip/memdisk.c
@@ -148,6 +148,7 @@ zzip_mem_disk_load(ZZIP_MEM_DISK * dir, ZZIP_DISK * disk)
         zzip_mem_disk_unload(dir);
     ___ long count = 0;
     ___ struct zzip_disk_entry *entry = zzip_disk_findfirst(disk);
+    if (!entry) goto error;
     for (; entry; entry = zzip_disk_findnext(disk, entry))
     {
         ZZIP_MEM_ENTRY *item = zzip_mem_entry_new(disk, entry);

diff --git a/zzip/mmapped.c b/zzip/mmapped.c
index 537be26fd05a566eaffb88132ad29ad4de22b1e3..920c4df563c8a5336db309929fe8522e712f12d3 100644 (file)
--- a/zzip/mmapped.c
+++ b/zzip/mmapped.c
@@ -414,16 +414,19 @@ zzip_disk_findfirst(ZZIP_DISK * disk)
     for (; p >= disk->buffer; p--)
     {
         zzip_byte_t *root;      /* (struct zzip_disk_entry*) */
+       zzip_size_t rootsize;   /* Size of root central directory */
+
         if (zzip_disk_trailer_check_magic(p))
         {
             struct zzip_disk_trailer *trailer = (struct zzip_disk_trailer *) p;
             zzip_size_t rootseek = zzip_disk_trailer_get_rootseek(trailer);
+           rootsize = zzip_disk_trailer_get_rootsize(trailer);
+
             root = disk->buffer + rootseek;
             DBG2("disk rootseek at %lli", (long long)rootseek);
             if (root > p)
             {
                 /* the first disk_entry is after the disk_trailer? can't be! */
-                zzip_size_t rootsize = zzip_disk_trailer_get_rootsize(trailer);
                 DBG2("have rootsize at %lli", (long long)rootsize);
                 if (disk->buffer + rootsize > p)
                     continue;
@@ -442,6 +445,7 @@ zzip_disk_findfirst(ZZIP_DISK * disk)
                 return 0;
             }
             zzip_size_t rootseek = zzip_disk64_trailer_get_rootseek(trailer);
+           rootsize = zzip_disk64_trailer_get_rootsize(trailer);
             DBG2("disk64 rootseek at %lli", (long long)rootseek);
             root = disk->buffer + rootseek;
             if (root > p)
@@ -458,7 +462,7 @@ zzip_disk_findfirst(ZZIP_DISK * disk)
             errno = EBADMSG;
             return 0;
         }
-       if (root >= disk->endbuf)
+       if (root >= disk->endbuf || (root + rootsize) >= disk->endbuf)
        {
            DBG1("root behind endbuf should be impossible");
            errno = EBADMSG;