From 6fc63daabd41a4dffbd63045ee72f1f3eb07bf82 Mon Sep 17 00:00:00 2001
From: Christoph Oelckers <c.oelckers@zdoom.fake>
Date: Mon, 13 Apr 2015 22:08:44 +0200
Subject: [PATCH] - fixed: Zips whose central directory cannot be read need to
 print an error message.

---
 src/resourcefiles/file_zip.cpp | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/resourcefiles/file_zip.cpp b/src/resourcefiles/file_zip.cpp
index 5d6ff6c9e..c7e787c70 100644
--- a/src/resourcefiles/file_zip.cpp
+++ b/src/resourcefiles/file_zip.cpp
@@ -168,7 +168,7 @@ bool FZipFile::Open(bool quiet)
 
 	if (centraldir == 0)
 	{
-		if (!quiet) Printf("\n%s: ZIP file corrupt!\n", Filename);
+		if (!quiet) Printf(TEXTCOLOR_RED "\n%s: ZIP file corrupt!\n", Filename);
 		return false;
 	}
 
@@ -180,7 +180,7 @@ bool FZipFile::Open(bool quiet)
 	if (info.NumEntries != info.NumEntriesOnAllDisks ||
 		info.FirstDisk != 0 || info.DiskNumber != 0)
 	{
-		if (!quiet) Printf("\n%s: Multipart Zip files are not supported.\n", Filename);
+		if (!quiet) Printf(TEXTCOLOR_RED "\n%s: Multipart Zip files are not supported.\n", Filename);
 		return false;
 	}
 
@@ -188,9 +188,10 @@ bool FZipFile::Open(bool quiet)
 	Lumps = new FZipLump[NumLumps];
 
 	// Load the entire central directory. Too bad that this contains variable length entries...
-	void *directory = malloc(LittleLong(info.DirectorySize));
+	int dirsize = LittleLong(info.DirectorySize);
+	void *directory = malloc(dirsize);
 	Reader->Seek(LittleLong(info.DirectoryOffset), SEEK_SET);
-	Reader->Read(directory, LittleLong(info.DirectorySize));
+	Reader->Read(directory, dirsize);
 
 	char *dirptr = (char*)directory;
 	FZipLump *lump_p = Lumps;
@@ -204,6 +205,13 @@ bool FZipFile::Open(bool quiet)
 				  LittleShort(zip_fh->NameLength) + 
 				  LittleShort(zip_fh->ExtraLength) + 
 				  LittleShort(zip_fh->CommentLength);
+
+		if (dirptr > ((char*)directory) + dirsize)	// This directory entry goes beyond the end of the file.
+		{
+			free(directory);
+			if (!quiet) Printf(TEXTCOLOR_RED "\n%s: Central directory corrupted.", Filename);
+			return false;
+		}
 		
 		// skip Directories
 		if (name[len - 1] == '/' && LittleLong(zip_fh->UncompressedSize) == 0) 
@@ -221,7 +229,7 @@ bool FZipFile::Open(bool quiet)
 			zip_fh->Method != METHOD_IMPLODE &&
 			zip_fh->Method != METHOD_SHRINK)
 		{
-			if (!quiet) Printf("\n%s: '%s' uses an unsupported compression algorithm (#%d).\n", Filename, name.GetChars(), zip_fh->Method);
+			if (!quiet) Printf(TEXTCOLOR_YELLOW "\n%s: '%s' uses an unsupported compression algorithm (#%d).\n", Filename, name.GetChars(), zip_fh->Method);
 			skipped++;
 			continue;
 		}
@@ -229,7 +237,7 @@ bool FZipFile::Open(bool quiet)
 		zip_fh->Flags = LittleShort(zip_fh->Flags);
 		if (zip_fh->Flags & ZF_ENCRYPTED)
 		{
-			if (!quiet) Printf("\n%s: '%s' is encrypted. Encryption is not supported.\n", Filename, name.GetChars());
+			if (!quiet) Printf(TEXTCOLOR_YELLOW "\n%s: '%s' is encrypted. Encryption is not supported.\n", Filename, name.GetChars());
 			skipped++;
 			continue;
 		}
@@ -260,7 +268,7 @@ bool FZipFile::Open(bool quiet)
 	NumLumps -= skipped;
 	free(directory);
 
-	if (!quiet) Printf(", %d lumps\n", NumLumps);
+	if (!quiet) Printf(TEXTCOLOR_NORMAL ", %d lumps\n", NumLumps);
 	
 	PostProcessArchive(&Lumps[0], sizeof(FZipLump));
 	return true;