Symlink archive entries had their stored target passed directly to
mz_os_make_symlink without checking containment, so a malicious
archive could create a link pointing outside the extraction root.
Add mz_path_is_symlink_target_safe to verify a link target resolves
within the destination directory, and apply it to both the UNIX1
extrafield and entry-content link targets. Reject symlink entries
outright when no destination base is set, since the target cannot be
validated without one.
Assisted-By: Claude Opus 4.8
These test files were conditionally added to the test target by CMake,
so their in-source guards never ran in the excluded configurations.
Compile them unconditionally and let the ifdef guards select the tests.
test_compat.cc keeps its MZ_COMPAT gate in CMake since the compatibility
layer is only built then, but its compression requirement moves into the
source.
Assisted-By: Claude Opus 4.8
The stream tests compress then decompress, but the deflate path returns
MZ_SUPPORT_ERROR when built with MZ_ZIP_NO_COMPRESSION, so the round
trip cannot run. Guard the tests on that macro, and exclude only the
inflate-and-compare half when MZ_ZIP_NO_DECOMPRESSION is set.
Assisted-By: Claude Opus 4.8
The Apple crypto backend defaults MZ_TARGET_APPSTORE to 1, which
makes mz_crypt_aes_set_key return MZ_SUPPORT_ERROR for GCM mode
because the GCM CommonCrypto APIs are private and rejected by App
Store review. The test was hard-coded to expect MZ_OK and failed on
the default macOS build.
Skip the test when the runtime reports MZ_SUPPORT_ERROR; otherwise
proceed and verify correctness as before.
gtest_minizip fails under MSAN with use-of-uninitialized-value in
std::basic_string's small-string-optimization union during static
TEST() registration, because system libstdc++ (and Ubuntu's libc++)
are not built with MSAN. We follow zlib-ng's approach.
