[SECURITY] Stack buffer over-read in minizip unzGetCurrentFileInfo() — missing null termination

I would like to report a security vulnerability in contrib/minizip/unzip.c in the zlib source tree. This affects the current upstream code.

=== Summary ===

Stack buffer over-read in contrib/minizip/unzip.c. When unzGetCurrentFileInfo() is called with a buffer smaller than the ZIP entry filename, it fills the buffer but does NOT null-terminate. Subsequent unzLocateFile() calls strlen() on the buffer, reading past the buffer boundary.

=== Root Cause ===

unzip.c:857-863 if (file_info.size_filename < fileNameBufferSize) { *(szFileName + file_info.size_filename) = '\0'; // OK } else uSizeRead = fileNameBufferSize; // BUG: no '\0'

unzip.c:1128 if (strlen(szFileName) >= UNZ_MAXFILENAMEINZIP) // CRASH

When size_filename >= fileNameBufferSize, the code sets uSizeRead but never writes a null terminator. Any subsequent strlen() call on the buffer reads beyond its allocated size.

=== Reproduction ===

Build minizip from current zlib source, then compile and run the attached PoC:

$ gcc -fsanitize=address -g -I/usr/include/minizip
-o poc_minizip_overflow poc_minizip_stack_overflow.c
-lminizip -lz $ ./poc_minizip_overflow poc_minizip_overflow.zip

[] file_info.size_filename: 260 [] filename_buf[255]: 0x42 (not 0x00 — buffer NOT null-terminated!)

==63292==ERROR: AddressSanitizer: stack-buffer-overflow READ of size 257 at 0x7ffe67116ec0 #0 strlen #1 unzLocateFile #2 main (poc_minizip_stack_overflow.c:82) [256, 512) 'filename_buf' <- Memory access at offset 512 overflows

=== Impact ===

• Stack information leak: strlen() reads adjacent stack data
• Denial of Service: SIGSEGV if strlen() crosses an unmapped page
• Affects any application using minizip (file managers, archive tools, email scanners, web applications processing ZIP uploads)

=== Suggested Fix ===

} else { uSizeRead = fileNameBufferSize > 0 ? fileNameBufferSize - 1 : 0; if (fileNameBufferSize > 0) *(szFileName + uSizeRead) = '\0'; }

=== Attachments ===

• poc_minizip_stack_overflow.c — PoC source code
• poc_minizip_overflow.zip — ZIP file with 260-byte filename
• Full ASAN output available on request

This issue has been filed as Debian Bug #1143912 and reported to the Ubuntu security team. I am reporting it here so it can be tracked and fixed upstream. Could you please confirm whether this would be considered a security vulnerability and if a CVE ID will be requested?

poc_minizip_overflow.zip poc_minizip_stack_overflow.c