diff --git a/tests/test.cpp b/tests/test.cpp index 76558db..0481752 100644 --- a/tests/test.cpp +++ b/tests/test.cpp @@ -41017,6 +41017,56 @@ static const char *expected_content_types_string = " z; + z.assign(comment_crash_zip, comment_crash_zip+sizeof(comment_crash_zip)); + + miniz_cpp::zip_file f; + try + { + f.load(z); + } catch(const std::runtime_error &) + { + } +} + void write_existing() { std::ofstream stream(existing_file, std::ios::binary); @@ -41272,6 +41336,7 @@ void remove_existing() void test_zip() { + test_comment_crash_zip(); write_existing(); test_load_file(); test_load_stream(); diff --git a/zip_file.hpp b/zip_file.hpp index c324f70..befa3bf 100644 --- a/zip_file.hpp +++ b/zip_file.hpp @@ -5651,10 +5651,20 @@ class zip_file throw std::runtime_error("didn't find end of central directory signature"); } + if (position + 1 >= buffer_.size()) + { + throw std::runtime_error("central dictionary position invalid"); + } + uint16_t length = static_cast(buffer_[position + 1]); length = static_cast(length << 8) + static_cast(buffer_[position]); position += 2; + if (position + length > buffer_.size()) + { + throw std::runtime_error("comment too long"); + } + if(length != 0) { comment = std::string(buffer_.data() + position, buffer_.data() + position + length);