Menu

#13 zip_fread failure in malformed files cause _opf_get_file to return garbage data

v1.0 (example)
open
nobody
None
5
2025-07-21
2025-07-21
Azhar Momin
No

If zip_fread fails, _opf_get_file leaves fileStr allocated with garbage data and no null terminator. The callers of this function expect fileStr to be a null-terminated string, which leads to undefined behavior or out of bound reads when searching for the null terminator.

I’ve attached a proposed patch that ensures fileStr is freed and set to NULL if zip_fread fails, preventing use of invalid memory.

1 Attachments

Discussion


Log in to post a comment.

MongoDB Logo MongoDB