You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
#include<libzippp.h>intmain()
{
constchar* static_buffer = "my zip file, which is in a buffer that should not be deleted";
auto archive = libzippp::ZipArchive::fromBuffer(static_buffer, strlen(static_buffer));
delete archive; // Oh no! free(static_buffer) is called
}
This will crash during the delete because free is called on static_buffer. It doesn't matter that the "zip archive" in the buffer is invalid, this is just an example. Imagine that you have a pointer to a zip file in a memory mapped file, or you are managing the lifetime of the buffer yourself.
It appears this was bug was introduced in https://github.com/ctabin/libzippp/pull/38/files#diff-b5a89cdf6ac4efa657b832a52b38d47fR102. The libzip documentation for
zip_source_buffer_create
reads: "If freep is non-zero, the buffer will be freed when it is no longer needed."As a result, this causes a crash/undefined behavior if it is not valid to delete the buffer when the ZipArchive is deleted.
The text was updated successfully, but these errors were encountered: