Skip to content

avoid size_t overflow in zip_central_dir_move middle-run check#442

Merged
kuba-- merged 1 commit into
kuba--:masterfrom
jmestwa-coder:central-dir-move-run-overflow
Jul 14, 2026
Merged

avoid size_t overflow in zip_central_dir_move middle-run check#442
kuba-- merged 1 commit into
kuba--:masterfrom
jmestwa-coder:central-dir-move-run-overflow

Conversation

@jmestwa-coder

Copy link
Copy Markdown
Contributor

middle-run guard in zip_central_dir_move uses a size_t multiply to mean both sides have survivors:

  • l_size * r_size wraps to 0 on a 32-bit size_t build when both are a multiple of 64 KiB (reachable via ~64 KiB entry names)
  • the branch is skipped, so surviving records after the deleted run are not shifted over the gap and their central-dir offsets not rebased, while m_central_dir.m_size is still lowered
  • the finalized archive's central directory is left desynced from its offset table

test each size against zero directly; behavior is identical on 64-bit.

@kuba--
kuba-- merged commit d7a99a4 into kuba--:master Jul 14, 2026
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants