Skip to content

Conversation

@0f-0b
Copy link
Contributor

@0f-0b 0f-0b commented Sep 9, 2025

This PR fixes two issues with the recently introduced uncompressed size check.

  • In passthrough mode, the check would incorrectly fail if the compressed size is larger than the uncompressed size.
  • When reading an entry with the uncompressed size set to 0 in a malicious zip file, the check is only done after rather than during decompression, which may lead to excessive resource usage.

@gildas-lormeau gildas-lormeau merged commit 3fe977a into gildas-lormeau:master Sep 9, 2025
@0f-0b 0f-0b deleted the uncompressed-size branch September 9, 2025 09:34
@gildas-lormeau
Copy link
Owner

Thank you very much! It's fixed in the version 2.8.2 I've just deployed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants