zlib/contrib, branch v1.3.1

zlib 1.3.1

2024-01-22T18:32:37+00:00

Use Makefile compiler for minizip-test target.

2024-01-21T17:25:44+00:00

Correct typos in source code.

2024-01-18T00:43:38+00:00

Neutralize zip file traversal attacks in miniunz.

2024-01-17T23:08:08+00:00

Archive formats such as .zip files are generally susceptible to so-called "traversal attacks". This allows an attacker to craft an archive that writes to unexpected locations of the file system (e.g., /etc/shadow) if an unspecting root user were to unpack a malicious archive. This patch neutralizes absolute paths such as /tmp/moo and deeply relative paths such as dummy/../../../../../../../../../../tmp/moo The Debian project requested CVE-2014-9485 be allocated for the first identified weakness. The fix was incomplete, resulting in a revised patch applied here. Since there wasn't an updated version released by Debian with the incomplete fix, I suggest we use this CVE to identify both issues. Link: https://security.snyk.io/research/zip-slip-vulnerability Link: https://bugs.debian.org/774321 Link: https://bugs.debian.org/776831 Link: https://nvd.nist.gov/vuln/detail/CVE-2014-9485 Reported-by: Jakub Wilk Fixed-by: Michael Gilbert

Fix random typos over several source and text files.

2024-01-17T21:49:11+00:00

Correct case of MSDOS in contrib/minizip/miniunz.c.

2024-01-17T20:48:27+00:00

Refer to correct function in contrib/minizip/unzip.c comment.

2024-01-17T20:46:14+00:00

Correct repeated words in source file comments and a readme.

2023-11-15T02:44:32+00:00

Fix decision on the emission of Zip64 end records in minizip.

2023-11-07T23:46:41+00:00

The appnote says that if the number of entries in the end record is 0xffff, then the actual number of entries will be found in the Zip64 end record. Therefore if the number of entries is equal to 0xffff, it can't be in the end record by itself, since that is an instruction to get the number from the Zip64 end record. This code would just store 0xffff in the end record in that case, not making a Zip64 end record. This commit fixes that.

Update miniunz version.

2023-08-20T18:38:03+00:00