ignore number_entry_cd when recover

zlib-ng · Nov 18, 2024 · 6d45beb · 6d45beb
1 parent d7f5fdd
commit 6d45beb
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 1 deletion.
diff --git a/compat/unzip.c b/compat/unzip.c
@@ -137,6 +137,8 @@ unzFile unzOpen_MZ(void *stream) {
     if (!handle)
         return NULL;
 
+    mz_zip_set_recover(handle, 1);
+
     err = mz_zip_open(handle, stream, MZ_OPEN_MODE_READ);
     if (err != MZ_OK) {
         mz_zip_delete(&handle);

diff --git a/mz_zip.c b/mz_zip.c
@@ -980,7 +980,8 @@ static int32_t mz_zip_read_cd(void *handle) {
         if (err == MZ_OK)
             err = mz_stream_read_uint16(zip->stream, &value16);
         number_entry_cd = value16;
-        if (number_entry_cd != zip->number_entry)
+        /* When recover is enabled, we can ignore incorrect number of entries */
+        if (number_entry_cd != zip->number_entry && !zip->recover)
             err = MZ_FORMAT_ERROR;
         /* Size of the central directory */
         if (err == MZ_OK)

diff --git a/test/fuzz/unzip_fuzzer_seed_corpus/incorrect_number_entries.zip b/test/fuzz/unzip_fuzzer_seed_corpus/incorrect_number_entries.zip