Symlink archive entries had their stored target passed directly to
mz_os_make_symlink without checking containment, so a malicious
archive could create a link pointing outside the extraction root.
Add mz_path_is_symlink_target_safe to verify a link target resolves
within the destination directory, and apply it to both the UNIX1
extrafield and entry-content link targets. Reject symlink entries
outright when no destination base is set, since the target cannot be
validated without one.
Assisted-By: Claude Opus 4.8
These test files were conditionally added to the test target by CMake,
so their in-source guards never ran in the excluded configurations.
Compile them unconditionally and let the ifdef guards select the tests.
test_compat.cc keeps its MZ_COMPAT gate in CMake since the compatibility
layer is only built then, but its compression requirement moves into the
source.
Assisted-By: Claude Opus 4.8
The stream tests compress then decompress, but the deflate path returns
MZ_SUPPORT_ERROR when built with MZ_ZIP_NO_COMPRESSION, so the round
trip cannot run. Guard the tests on that macro, and exclude only the
inflate-and-compare half when MZ_ZIP_NO_DECOMPRESSION is set.
Assisted-By: Claude Opus 4.8
Both packages export separate static and shared imported targets, but
the find_package paths picked one variant unconditionally — zstd
preferred libzstd_static and zlib-ng always linked the shared zlib.
Building minizip-ng with BUILD_SHARED_LIBS=ON against a system zstd
that ships both variants therefore produced a libminizip.so with zstd
statically baked in (#983).
Returns the absolute offset where the current entry's compressed
data begins, matching the original minizip API used by chromium and
other consumers. The position is already tracked internally via
entry_pos for STORE-method seek support, so this just exposes it.
mz_os_get_file_attribs used lstat on POSIX and GetFileAttributesW
on Win32, both of which return the link's own attributes rather
than the target's. Callers that wanted to follow a symlink had no
way to ask for that, so mz_zip_writer_add_file produced followed
entries tagged ISLNK and readers that tried to recreate them as
symlinks.
Flip mz_os_get_file_attribs to stat on POSIX and to a CreateFile +
GetFileInformationByHandle path on Win32 when the entry is a
reparse point. Add mz_os_get_link_attribs preserving the original
lstat / GetFileAttributesW semantics. Update mz_zip_writer_add_file
to pick the right getter for each branch and to skip symlinks
cleanly when neither store_links nor follow_links is set.
Refs #797.
minizip_erase rewrites the archive to a temp file under TMPDIR and
then renames it onto the source. rename(2) returns EXDEV across
filesystems, so when TMPDIR (e.g. /tmp) and the source live on
different mounts (a common conda-forge pattern), the rename fails
after the original was already moved aside to .bak — the next
operation that opens the archive sees no file and reports -111.
Add mz_os_path_same_fs() and have minizip_erase fall back on POSIX to
a same-dir temp when TMPDIR is on a different filesystem. POSIX uses
stat() st_dev comparison; Win32 uses _wstati64 for the parallel check
but the caller skips it under #ifndef _WIN32 because MoveFileExW with
MOVEFILE_COPY_ALLOWED already absorbs cross-volume rename internally.
Make the same-dir tmp filename unique (mz_ms_time suffix) and refuse
to clobber an existing leftover from a prior crash.
Refs #943.
The Apple crypto backend defaults MZ_TARGET_APPSTORE to 1, which
makes mz_crypt_aes_set_key return MZ_SUPPORT_ERROR for GCM mode
because the GCM CommonCrypto APIs are private and rejected by App
Store review. The test was hard-coded to expect MZ_OK and failed on
the default macOS build.
Skip the test when the runtime reports MZ_SUPPORT_ERROR; otherwise
proceed and verify correctness as before.
mz_dir_has_unsafe_symlink walks every component of the destination
path and rejects any symlink with an absolute target. That's too
strict: when the user-chosen destination dir (or one of its ancestors)
happens to be a symlink, extracting into it gets rejected with -107.
The check only needs to police symlinks that appear strictly inside
the destination, since those could be zip-controlled.
Skip the symlink check when check_path is at or above base_path; let
the existing logic enforce on components below.
Fixes#943.
A shared minizip encapsulates its PRIVATE backend deps (bzip2, lzma, zstd,
iconv, ...) inside the .so/.dylib, and minizip-targets.cmake doesn't
reference them. Emitting find_dependency() for those backends in the
generated package config forces consumers of shared minizip to install
every backend just to call find_package(minizip), even when nothing
needs them.
Split MINIZIP_DEP_PKG into a PUBLIC list (always required, e.g. ZLIB
under MZ_COMPAT) and a private list emitted only when minizip is built
static. The static archive still requires all of them transitively.
Fixes#898.
find_package(ZLIB-NG QUIET CONFIG) reads zlib-ng's installed
zlib-ng-config.cmake and the matching zlib-ng-targets-<config>.cmake
files, so the bundled MODULE-mode finder is no longer consulted. The
upstream config knows the correct library names per build configuration
(including the -ngd debug suffix on MSVC), which the bundled finder
didn't.
Fixes#952.
Hard-coding "-lssl -lcrypto" in Libs.private breaks for LibreSSL (different
library names), MSVC import libraries, and custom build suffixes. Reference
openssl in Requires.private instead so the consumer's pkg-config delegates
to openssl.pc and resolves the correct library names locally.
Caught in PR review on #983.
compat/zip.h and compat/unzip.h reference zlib types and macros (ZEXPORT,
Z_DEFLATED, ...), so any consumer including those headers needs zlib's
INTERFACE_INCLUDE_DIRECTORIES on its include path. Linking via the imported
target keeps the install portable: find_dependency(ZLIB) on the consumer
recreates the target with the consumer's local paths, not the build host's.
Other backends are pure implementation details and stay PRIVATE.
Refs #914.
The list drives find_dependency() calls in the generated minizip-config.cmake,
so registering a package whose CMake config doesn't exist on the consumer
machine (PPMD, fetched BZip2/LibLZMA/zstd, etc.) makes find_package(minizip)
fail at configure time. Only register a package when it was located via
find_package, not when built from a fetched source tree (those targets are
already carried forward through install(EXPORT)).
Add Threads to MINIZIP_DEP_PKG when liblzma is fetched, since upstream xz's
exported target lists Threads::Threads in its INTERFACE_LINK_LIBRARIES and
the consumer's config has to recreate that imported target.
Refs #914.
Backend libraries (zlib, bzip2, lzma, zstd, openssl, iconv, frameworks)
are implementation details that don't appear in mz.h's public API, so
their linkage is PRIVATE rather than PUBLIC. For static minizip CMake
still propagates them transitively via INTERFACE_LINK_LIBRARIES_PRIVATE
when needed; for shared minizip they stay encapsulated and don't pollute
consumer link lines.
The target_link_directories call is no longer needed because every
imported target carries its own library directory; MINIZIP_LBD is
removed along with it.
Refs #914.
find_library returns SDK-absolute paths like
/Applications/Xcode.app/.../MacOSX.sdk/System/Library/Frameworks/CoreFoundation.framework
which get baked into INTERFACE_LINK_LIBRARIES on install and break
downstream consumers whose SDK lives at a different path. Pass the
frameworks as plain "-framework Foo" linker flags so each consumer's
own toolchain resolves them.
Refs #914.
Replace raw ${FOO_LIBRARIES} / ${FOO_LIBRARY_DIRS} / ${FOO_INCLUDE_DIRS}
appends with imported target references so installed targets files don't
bake build-machine paths into INTERFACE_LINK_LIBRARIES. Affects ZLIB-NG,
ZLIB, BZip2, LibLZMA, ZSTD, OpenSSL, Iconv, and libbsd. Drops the
pkg-config-first paths for LZMA/ZSTD/OpenSSL since find_package now
provides portable imported targets across CMake 3.14+.
Refs #914.
gtest_minizip fails under MSAN with use-of-uninitialized-value in
std::basic_string's small-string-optimization union during static
TEST() registration, because system libstdc++ (and Ubuntu's libc++)
are not built with MSAN. We follow zlib-ng's approach.
System libz on Ubuntu is not built with MSAN, which produced
use-of-uninitialized-value reports in mz_stream_os_write when
flushing bytes that came out of zlib's deflate (the internal state
buffer is malloc'd and written by uninstrumented code).
Set MZ_FORCE_FETCH_LIBS=ON so zlib-ng, bzip2, liblzma and zstd are
built from source with the project's MSAN flags. This mirrors what
the Windows MSVC job already does for unrelated reasons.
System libcrypto on Ubuntu is not built with MSAN, so calls into
OPENSSL_init_crypto (via EVP_MD_fetch and EVP_MAC_fetch in
mz_crypt_openssl.c) produced ~130 use-of-uninitialized-value reports
in BIO_new_file and OBJ_obj2txt for buffers allocated inside the
uninstrumented library.
Disable MZ_OPENSSL for the MSAN job so the built-in crypto path
is used instead, which is instrumented along with the rest of the
project sources.
The bytes_avail variable was declared as int32_t and the 64-bit result
of (disk_size - total_out_disk) was cast to int32_t, causing truncation
and wraparound for split sizes exceeding INT32_MAX (~2GB). This resulted
in MZ_STREAM_ERROR when creating archives with split sizes above ~50GB.
Changed bytes_avail to int64_t and removed the truncating cast.
Fixes#961
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
At the end of a disk, we return any bytes read before proceeding to
the next disk. This allows us to return MZ_EXIST_ERROR when the next
disk is not found.
Nathan Moin Vaziri