From 88beddab179b0cf29e1b9752ac5719a40b4f28c1 Mon Sep 17 00:00:00 2001 From: Raul Metsma Date: Wed, 27 May 2026 12:22:50 +0300 Subject: [PATCH] Add hard limit to zip file count IB-8941 Signed-off-by: Raul Metsma --- .github/workflows/build.yml | 2 -- src/util/ZipSerialize.cpp | 3 +++ 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 68482f2a9..6d233b6e9 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -112,8 +112,6 @@ jobs: export VCPKG_ROOT=$VCPKG_INSTALLATION_ROOT export ANDROID_NDK_HOME=$ANDROID_NDK_LATEST_HOME export ANDROID_NDK_ROOT=$ANDROID_NDK_LATEST_HOME - git -C $VCPKG_INSTALLATION_ROOT fetch origin f77737496dabd44c63ecc599dc0f4d6cff30d0d5 - git -C $VCPKG_INSTALLATION_ROOT reset --hard f77737496dabd44c63ecc599dc0f4d6cff30d0d5 cmake --preset ${{ matrix.target }} "-GUnix Makefiles" -DCMAKE_BUILD_TYPE=RelWithDebInfo cmake --build --preset ${{ matrix.target }} cmake --build --preset ${{ matrix.target }} --target install/strip diff --git a/src/util/ZipSerialize.cpp b/src/util/ZipSerialize.cpp index f8ca53fbc..8eaacf202 100644 --- a/src/util/ZipSerialize.cpp +++ b/src/util/ZipSerialize.cpp @@ -77,11 +77,14 @@ vector ZipSerialize::list() const if(!d) THROW("Zip file is not open"); + constexpr size_t maxEntries = 1000; vector list; for(int unzResult = unzGoToFirstFile(d.get()); unzResult != UNZ_END_OF_LIST_OF_FILE; unzResult = unzGoToNextFile(d.get())) { if(unzResult != UNZ_OK) THROW("Failed to go to the next file inside ZIP container. ZLib error: %d", unzResult); + if(list.size() >= maxEntries) + THROW("ZIP container exceeds maximum entry count of %zu", maxEntries); unz_file_info fileInfo{}; unzResult = unzGetCurrentFileInfo(d.get(), &fileInfo, nullptr, 0, nullptr, 0, nullptr, 0);