Reference: open-watcom#1369

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…-2015-2331

Backport fixes for multiple security vulnerabilities to bundled
libzip 0.6.1. A full library upgrade is not feasible due to breaking
API changes in libzip 0.11+.

Fixes:
- CVE-2012-1162: heap buffer overflow in _zip_readcdir when nentry
  is 0 but central directory data is present. Initialize directory
  entries before reading to prevent use of uninitialized memory.
- CVE-2012-1163: integer overflow in central directory size
  calculation. Validate cd->size + cd->comment_len + EOCDLEN does
  not wrap. Add overflow guards before size*nentry allocations.
- CVE-2015-2331: integer overflow in _zip_cdir_new when computing
  allocation size for large nentry values on 32-bit systems.
- Fix memory leaks on error paths in _zip_dirent_read where partial
  allocations (filename, extrafield, comment) were not freed on
  subsequent allocation failures (related to CVE-2017-12858).
- Replace deprecated stricmp with portable strcasecmp in
  zip_name_locate.

Note: CVE-2011-0421 was already patched in the bundled copy.
CVE-2017-14107 does not apply (no ZIP64 support in 0.6.1).
CVE-2017-12858 and CVE-2019-17582 manifest differently in 0.6.1
(memory leak, not double-free/use-after-free) and are addressed
by the error-path cleanup above.

Reference: open-watcom#1369

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…-2015-2331

Backport fixes for multiple security vulnerabilities to bundled
libzip 0.6.1. A full library upgrade is not feasible due to breaking
API changes in libzip 0.11+.

Fixes:
- CVE-2012-1162: heap buffer overflow in _zip_readcdir when nentry
  is 0 but central directory data is present. Initialize directory
  entries before reading to prevent use of uninitialized memory.
- CVE-2012-1163: integer overflow in central directory size
  calculation. Validate cd->size + cd->comment_len + EOCDLEN does
  not wrap. Add overflow guards before size*nentry allocations.
- CVE-2015-2331: integer overflow in _zip_cdir_new when computing
  allocation size for large nentry values on 32-bit systems.
- Fix memory leaks on error paths in _zip_dirent_read where partial
  allocations (filename, extrafield, comment) were not freed on
  subsequent allocation failures (related to CVE-2017-12858).
- Replace deprecated stricmp with portable strcasecmp in
  zip_name_locate.

Note: CVE-2011-0421 was already patched in the bundled copy.
CVE-2017-14107 does not apply (no ZIP64 support in 0.6.1).
CVE-2017-12858 and CVE-2019-17582 manifest differently in 0.6.1
(memory leak, not double-free/use-after-free) and are addressed
by the error-path cleanup above.

Reference: open-watcom#1369

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…-2015-2331 (#1616)

* libzip: backport security fixes for CVE-2012-1162, CVE-2012-1163, CVE-2015-2331

Backport fixes for multiple security vulnerabilities to bundled
libzip 0.6.1. A full library upgrade is not feasible due to breaking
API changes in libzip 0.11+.

Fixes:
- CVE-2012-1162: heap buffer overflow in _zip_readcdir when nentry
  is 0 but central directory data is present. Initialize directory
  entries before reading to prevent use of uninitialized memory.
- CVE-2012-1163: integer overflow in central directory size
  calculation. Validate cd->size + cd->comment_len + EOCDLEN does
  not wrap. Add overflow guards before size*nentry allocations.
- CVE-2015-2331: integer overflow in _zip_cdir_new when computing
  allocation size for large nentry values on 32-bit systems.
- Fix memory leaks on error paths in _zip_dirent_read where partial
  allocations (filename, extrafield, comment) were not freed on
  subsequent allocation failures (related to CVE-2017-12858).
- Replace deprecated stricmp with portable strcasecmp in
  zip_name_locate.

Note: CVE-2011-0421 was already patched in the bundled copy.
CVE-2017-14107 does not apply (no ZIP64 support in 0.6.1).
CVE-2017-12858 and CVE-2019-17582 manifest differently in 0.6.1
(memory leak, not double-free/use-after-free) and are addressed
by the error-path cleanup above.

Reference: #1369

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* Fix build: replace SIZE_MAX with portable (size_t)-1, revert strcasecmp

SIZE_MAX from <stddef.h> is not available in the Watcom C compiler.
Use (size_t)-1 which is equivalent and C89-portable.

Revert stricmp -> strcasecmp change: stricmp is the Watcom-native
function, and clibext.h already maps stricmp to strcasecmp on UNIX
platforms. Using strcasecmp directly would break the Watcom build.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* libzip: add installer-like extraction test

Add extractall.c regression test that simulates the OW installer
workflow: open archive, enumerate all entries, stat and extract
each one, verify sizes match.

Three subtests:
- Full extraction of test.zip (3 entries, stored)
- Enumeration and stat of broken.zip (5 entries, mixed methods
  with intentional CRC/zlib errors)
- Round-trip: create archive, add file from buffer, close, reopen
  with consistency check, extract and verify data integrity

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* libzip: use INT_MAX for overflow checks, cast nentry to unsigned at allocation

Keep overflow arithmetic in int domain for 16/32/64-bit portability,
as requested by maintainer review on PR #1616.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>