Skip to content

Commit

Permalink
FIXUP now allocate copy of stream passed to zip_stream_open to resolv…
Browse files Browse the repository at this point in the history
…e hacks around double free.
  • Loading branch information
prot0man committed Jan 17, 2024
1 parent 6e161da commit ead371d
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 6 deletions.
10 changes: 9 additions & 1 deletion src/zip.c
Original file line number Diff line number Diff line change
Expand Up @@ -1844,7 +1844,15 @@ struct zip_t *zip_stream_openwitherror(const char *stream, size_t size,
// for modes 'd' and 'w', would be better to use mz_zip_reader_init_writer, but there's no clean
// way to load the existing stream with that.
if ((stream != NULL) && (size > 0) && (mode == 'r' || mode == 'd' || mode == 'w')) {
if (!mz_zip_reader_init_mem(&(zip->archive), stream, size, 0)) {
uint8_t *stream_copy = (uint8_t *)malloc(size);

if(!stream_copy) {
*errnum = ZIP_EOOMEM;
goto cleanup;
}
memcpy(stream_copy, stream, size);

if (!mz_zip_reader_init_mem(&(zip->archive), stream_copy, size, 0)) {
*errnum = ZIP_ERINIT;
goto cleanup;
}
Expand Down
6 changes: 1 addition & 5 deletions src/zip.h
Original file line number Diff line number Diff line change
Expand Up @@ -446,8 +446,7 @@ zip_stream_extract(const char *stream, size_t size, const char *dir,
/**
* Opens zip archive stream into memory.
*
* @param stream zip archive stream. If not NULL,
* stream will be freed on zip_stream_close.
* @param stream zip archive stream.
* @param size stream size.
* @param level compression level (0-9 are the standard zlib-style levels).
* @param mode file access mode.
Expand Down Expand Up @@ -495,9 +494,6 @@ extern ZIP_EXPORT ssize_t zip_stream_copy(struct zip_t *zip, void **buf,
/**
* Close zip archive releases resources.
*
* If a buffer was provided to zip_stream_open,
* it will be unallocated here.
*
* @param zip zip archive handler.
*
* @return
Expand Down
3 changes: 3 additions & 0 deletions test/test_entry.c
Original file line number Diff line number Diff line change
Expand Up @@ -424,6 +424,9 @@ MU_TEST(test_entries_delete_stream) {
zip_stream_copy(zip, (void **)&modified_zdata, &zsize);
mu_check(modified_zdata != NULL);

free(zdata);
zdata = NULL;

// Note that zip_stream_close will free the zdata passed in zip_stream_open
zip_stream_close(zip);
zdata = NULL;
Expand Down

0 comments on commit ead371d

Please sign in to comment.