zlib-ng / minizip-ng

Fork of the popular zip manipulation library found in the zlib distribution.
Other
1.24k stars 434 forks source link

mz_zip_writer_add_path will crash when the filename contains * #792

Open zhyh2010 opened 4 months ago

zhyh2010 commented 4 months ago

when i use minizip-ng api mz_zip_writer_add_path to compress a directory which contains some filenames with *, just like this below:

-- HARDWARE     | -- test1.model     | -- STATION           | -- .test           | -- testa*_1.model

it will crash.

I read the source code:

int32_t mz_zip_writer_add_path(void *handle, const char *path, const char *root_path,
    uint8_t include_path, uint8_t recursive) {
    mz_zip_writer *writer = (mz_zip_writer *)handle;
    DIR *dir = NULL;
    struct dirent *entry = NULL;
    int32_t err = MZ_OK;
    int16_t is_dir = 0;
    const char *filename = NULL;
    const char *filenameinzip = path;
    char *wildcard_ptr = NULL;
    char full_path[1024];
    char path_dir[1024];

    if (strrchr(path, '*')) {
        strncpy(path_dir, path, sizeof(path_dir) - 1);
        path_dir[sizeof(path_dir) - 1] = 0;
        mz_path_remove_filename(path_dir);
        wildcard_ptr = path_dir + strlen(path_dir) + 1;
        root_path = path = path_dir;
    } else {
        if (mz_os_is_dir(path) == MZ_OK)
            is_dir = 1;
   ....

when detected a '*' in the path, it will try to locate in it's parent dir, and compress again.

In my case, when path enters testa*_1.model, it will return back to it's parent dir which should be STATION, and compress again, then, oops, it meet testa*_1.model again, now it will loop around.

my coredump stack appears like below

image

The input filename is unexpected for me, how can I avoid crash, in this suituation, Thanks