1 files changed, 32 insertions, 27 deletions

diff --git a/deps/zlib/contrib/minizip/mztools.c b/deps/zlib/contrib/minizip/mztools.c
index a30ba6985b..96891c2e0b 100644
--- a/deps/zlib/contrib/minizip/mztools.c
+++ b/deps/zlib/contrib/minizip/mztools.c
@@ -8,12 +8,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-
-#if defined(USE_SYSTEM_ZLIB)
-#include <zlib.h>
-#else
 #include "zlib.h"
-#endif
 #include "unzip.h"
 
 #define READ_8(adr)  ((unsigned char)*(adr))
@@ -47,7 +42,7 @@ uLong* bytesRecovered;
     int entries = 0;
     uLong totalBytes = 0;
     char header[30];
-    char filename[256];
+    char filename[1024];
     char extra[1024];
     int offset = 0;
     int offsetCD = 0;
@@ -67,7 +62,7 @@ uLong* bytesRecovered;
         unsigned int fnsize = READ_16(header + 26); /* file name length */
         unsigned int extsize = READ_16(header + 28); /* extra field length */
         filename[0] = extra[0] = '\0';
-        
+
         /* Header */
         if (fwrite(header, 1, 30, fpOut) == 30) {
           offset += 30;
@@ -75,12 +70,17 @@ uLong* bytesRecovered;
           err = Z_ERRNO;
           break;
         }
-        
+
         /* Filename */
         if (fnsize > 0) {
-          if (fread(filename, 1, fnsize, fpZip) == fnsize) {
-            if (fwrite(filename, 1, fnsize, fpOut) == fnsize) {
-              offset += fnsize;
+          if (fnsize < sizeof(filename)) {
+            if (fread(filename, 1, fnsize, fpZip) == fnsize) {
+                if (fwrite(filename, 1, fnsize, fpOut) == fnsize) {
+                offset += fnsize;
+              } else {
+                err = Z_ERRNO;
+                break;
+              }
             } else {
               err = Z_ERRNO;
               break;
@@ -96,9 +96,14 @@ uLong* bytesRecovered;
 
         /* Extra field */
         if (extsize > 0) {
-          if (fread(extra, 1, extsize, fpZip) == extsize) {
-            if (fwrite(extra, 1, extsize, fpOut) == extsize) {
-              offset += extsize;
+          if (extsize < sizeof(extra)) {
+            if (fread(extra, 1, extsize, fpZip) == extsize) {
+              if (fwrite(extra, 1, extsize, fpOut) == extsize) {
+                offset += extsize;
+                } else {
+                err = Z_ERRNO;
+                break;
+              }
             } else {
               err = Z_ERRNO;
               break;
@@ -108,7 +113,7 @@ uLong* bytesRecovered;
             break;
           }
         }
-        
+
         /* Data */
         {
           int dataSize = cpsize;
@@ -138,7 +143,7 @@ uLong* bytesRecovered;
             }
           }
         }
-        
+
         /* Central directory entry */
         {
           char header[46];
@@ -164,7 +169,7 @@ uLong* bytesRecovered;
           /* Header */
           if (fwrite(header, 1, 46, fpOutCD) == 46) {
             offsetCD += 46;
-            
+
             /* Filename */
             if (fnsize > 0) {
               if (fwrite(filename, 1, fnsize, fpOutCD) == fnsize) {
@@ -177,7 +182,7 @@ uLong* bytesRecovered;
               err = Z_STREAM_ERROR;
               break;
             }
-            
+
             /* Extra field */
             if (extsize > 0) {
               if (fwrite(extra, 1, extsize, fpOutCD) == extsize) {
@@ -187,7 +192,7 @@ uLong* bytesRecovered;
                 break;
               }
             }
-            
+
             /* Comment field */
             if (comsize > 0) {
               if ((int)fwrite(comment, 1, comsize, fpOutCD) == comsize) {
@@ -197,8 +202,8 @@ uLong* bytesRecovered;
                 break;
               }
             }
-            
-            
+
+
           } else {
             err = Z_ERRNO;
             break;
@@ -230,17 +235,17 @@ uLong* bytesRecovered;
       WRITE_32(header + 12, offsetCD);    /* size of CD */
       WRITE_32(header + 16, offset);      /* offset to CD */
       WRITE_16(header + 20, comsize);     /* comment */
-      
+
       /* Header */
       if (fwrite(header, 1, 22, fpOutCD) == 22) {
-        
+
         /* Comment field */
         if (comsize > 0) {
           if ((int)fwrite(comment, 1, comsize, fpOutCD) != comsize) {
             err = Z_ERRNO;
           }
         }
-        
+
       } else {
         err = Z_ERRNO;
       }
@@ -262,14 +267,14 @@ uLong* bytesRecovered;
         fclose(fpOutCD);
       }
     }
-    
+
     /* Close */
     fclose(fpZip);
     fclose(fpOut);
-    
+
     /* Wipe temporary file */
     (void)remove(fileOutTmp);
-    
+
     /* Number of recovered entries */
     if (err == Z_OK) {
       if (nRecovered != NULL) {