Backport and apply upstream patch for CVE-2017-14107

diff --git a/ext/zip/lib/zip_open.c b/ext/zip/lib/zip_open.c
index d91fe469dbebbe3603ed4cbe5a41a0f167fc7cba..3616cc544800ea3082540c1804fa2e1777fec303 100644 (file)
--- a/ext/zip/lib/zip_open.c
+++ b/ext/zip/lib/zip_open.c
@@ -726,7 +726,12 @@ _zip_read_eocd64(FILE *f, const zip_uint8_t *eocd64loc, const zip_uint8_t *buf,
         _zip_error_set(error, ZIP_ER_SEEK, EFBIG);
         return NULL;
     }
-    if ((flags & ZIP_CHECKCONS) && offset+size != eocd_offset) {
+    if (offset+size > buf_offset + eocd_offset) {
+       /* cdir spans past EOCD record */
+       _zip_error_set(error, ZIP_ER_INCONS, 0);
+       return NULL;
+    }
+    if ((flags & ZIP_CHECKCONS) && offset+size != buf_offset + eocd_offset) {
        _zip_error_set(error, ZIP_ER_INCONS, 0);
        return NULL;
     }