[PR #427] [MERGED] From zlib: Reject overflows of zip header fields in minizip. #490

New issue

Closed

opened 2026-05-05 12:17:18 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 12:17:18 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/jmcnamara/libxlsxwriter/pull/427
Author: @jayaddison
Created: 12/24/2023
Status: ✅ Merged
Merged: 12/24/2023
Merged by: @jmcnamara

Base: main ← Head: security/CVE-2023-45853

📝 Commits (1)

6aaf223 Reject overflows of zip header fields in minizip.

📊 Changes

1 file changed (+11 additions, -0 deletions)

View changed files

📝 third_party/minizip/zip.c (+11 -0)

📄 Description

With the minizip code in the codebase updated by #420, it's fairly straightforward to cherry-pick a fixup for CVE-2023-45853.

If-and-when a release of zlib v1.3.1 (that contains minizip in the contrib directory) appears, it could be worthwhile to update to that; since that hasn't appeared yet I think it may make sense to apply this here directly.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/jmcnamara/libxlsxwriter/pull/427 **Author:** [@jayaddison](https://github.com/jayaddison) **Created:** 12/24/2023 **Status:** ✅ Merged **Merged:** 12/24/2023 **Merged by:** [@jmcnamara](https://github.com/jmcnamara) **Base:** `main` ← **Head:** `security/CVE-2023-45853` --- ### 📝 Commits (1) - [`6aaf223`](https://github.com/jmcnamara/libxlsxwriter/commit/6aaf2231e60d1ba4c0f291700795a8642d44398a) Reject overflows of zip header fields in minizip. ### 📊 Changes **1 file changed** (+11 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `third_party/minizip/zip.c` (+11 -0) </details> ### 📄 Description With the `minizip` code in the codebase updated by #420, it's fairly straightforward to cherry-pick a fixup for CVE-2023-45853. If-and-when a release of `zlib` v1.3.1 (that contains `minizip` in the `contrib` directory) appears, it could be worthwhile to update to that; since that hasn't appeared yet I think it may make sense to apply this here directly. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>