#57 buffer overflow in zipRemoveExtraInfoBlock

[Felix von Leitner]

1962 pNewHeader = (char)ALLOC(dataLen);
1963 pTmp = pNewHeader;
1964
1965 while(p < (pData + dataLen))
1966 {
1967 header = (short)p;
1968 dataSize = (((short*)p)+1);

At this point the code assumes that dataSize < *dataLen. An attacker could be handing you an malicious ZIP file with corrupt data however.

1977 memcpy(pTmp, p, dataSize + 4);

In which case this is a heap buffer overflow.

[Felix von Leitner]

oops sorry I filed against the wrong project. This is in zlib not info-zip.

[Ed Gordon]

No problem.