From 7d2917b47f6a3eae9d2f6d38d94b759158ed931c Mon Sep 17 00:00:00 2001 From: krleejihyeong Date: Sun, 23 Aug 2026 12:53:20 +0900 Subject: [PATCH] Fix dangling pointer in mz_zip_set_comment() to prevent double-free/UAF (#1031) zip->comment was freed before validating the new comment length. When the new comment exceeds UINT16_MAX, the function returned early without resetting zip->comment to NULL, leaving a dangling pointer that mz_zip_close() would later free again (double-free / UAF). --- mz_zip.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/mz_zip.c b/mz_zip.c index 82a18d5..4c7beb9 100644 --- a/mz_zip.c +++ b/mz_zip.c @@ -1571,17 +1571,19 @@ int32_t mz_zip_get_comment(void *handle, const char **comment) { int32_t mz_zip_set_comment(void *handle, const char *comment) { mz_zip *zip = (mz_zip *)handle; - int32_t comment_size = 0; + size_t comment_size = 0; + char *new_comment = NULL; if (!zip || !comment) return MZ_PARAM_ERROR; - free(zip->comment); - comment_size = (int32_t)strlen(comment); + comment_size = strlen(comment); if (comment_size > UINT16_MAX) return MZ_PARAM_ERROR; - zip->comment = (char *)calloc(comment_size + 1, sizeof(char)); - if (!zip->comment) + new_comment = (char *)calloc(comment_size + 1, sizeof(char)); + if (!new_comment) return MZ_MEM_ERROR; - strncpy(zip->comment, comment, comment_size); + strncpy(new_comment, comment, comment_size); + free(zip->comment); + zip->comment = new_comment; return MZ_OK; }