Skip to content

Fix missing NUL termination for truncated filenames - #1315

Open
atharvmantri wants to merge 2 commits into
madler:developfrom
atharvmantri:fix/minizip-filename-termination
Open

atharvmantri wants to merge 2 commits into
madler:developfrom
atharvmantri:fix/minizip-filename-termination

Conversation

@atharvmantri

@atharvmantri atharvmantri commented Sep 14, 2026

Copy link
Copy Markdown

Terminate truncated Minizip filenames returned by unzGetCurrentFileInfo().

When the ZIP entry filename is at least as long as the caller's output buffer, the existing code reads the full buffer but does not write a terminating NUL. A later unzLocateFile() call can pass that buffer to strlen(), causing an out-of-bounds read. This change reserves one byte for the terminator whenever a nonzero output buffer is supplied and keeps the read length consistent with that reservation.

This addresses #1299.

Validation performed on Windows with native MinGW/CMake:

  • cmake --build build-pr1315 --parallel 2 passed, including the Minizip library, CLI targets, and the new regression test.
  • CTest passed all 30/30 configured tests, including the new truncated-filename regression and the existing Minizip zip/unzip/compare path tests.
  • git diff --check passes.

The regression test links the static Minizip target so it runs without relying on a platform-specific shared-DLL search path. The build directory is local evidence only and is not part of the source change.

Copilot AI lite review requested due to automatic review settings September 14, 2026 03:19

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants