Commit 2804ba7 for zlib
commit 2804ba75738582d9c87b31e61622290cde0ac4e5
Author: Oculytic <oculytic@gmail.com>
Date: Mon Oct 19 09:28:41 2026 +0100
Fix double free in minizip block_central_name().
block_central_name() frees a central directory file name that
contains a null and continues to the next record, but leaves
name pointing to the freed memory. If the next record then has an
invalid signature, the loop breaks before name is reassigned, and
the error path frees name again.
Set name to NULL after freeing it in the null case. set_free()
accepts NULL, so the error path is then harmless.
diff --git a/contrib/minizip/zip.c b/contrib/minizip/zip.c
index 0bbdf77..b2db1df 100644
--- a/contrib/minizip/zip.c
+++ b/contrib/minizip/zip.c
@@ -447,6 +447,7 @@ local char *block_central_name(block_t *block, set_t *set) {
name. (Who the heck is putting nuls inside their zip file entry
names anyway?) */
set_free(set, name);
+ name = NULL;
continue;
}