minizip.pc.in would add @include@/minizip to the include path,
which would permit simply #include <zip.h> to use minizip. However
that conflicts with the zip.h from libzip that is put in the root
include directory. This now does not add /minizip to the include
path. Now when using pkg-config, #include <minizip/zip.h> must be
used, where #include <zip.h> would be used for libzip. This is an
incompatible change with the previous state. Users of minizip and
pkg-config will need to update their code. #include <unzip.h> will
need to be updated to #include <minizip/unzip.h> as well.
Not all toolchains on UNIX-style operating systems predefine
"unix". For example, it's missing on NetBSD, OpenBSD/gcc, AIX,
HP-UX. There is no single macro defined everywhere, but checking
both "__unix__" and "__unix" should cover everything except macOS,
which is already checked for using "__APPLE__".
Note that case sensitivity should default to off on macOS and
cygwin, so the check there is different.
Archive formats such as .zip files are generally susceptible to
so-called "traversal attacks". This allows an attacker to craft
an archive that writes to unexpected locations of the file system
(e.g., /etc/shadow) if an unspecting root user were to unpack a
malicious archive.
This patch neutralizes absolute paths such as /tmp/moo and deeply
relative paths such as dummy/../../../../../../../../../../tmp/moo
The Debian project requested CVE-2014-9485 be allocated for the
first identified weakness. The fix was incomplete, resulting in a
revised patch applied here. Since there wasn't an updated version
released by Debian with the incomplete fix, I suggest we use this
CVE to identify both issues.
Link: https://security.snyk.io/research/zip-slip-vulnerability
Link: https://bugs.debian.org/774321
Link: https://bugs.debian.org/776831
Link: https://nvd.nist.gov/vuln/detail/CVE-2014-9485
Reported-by: Jakub Wilk <jwilk@debian.org>
Fixed-by: Michael Gilbert <mgilbert@debian.org>