Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

zlib-ng/minizip-ng

              develop @ ff303ab
            

Fixes

CVEs

HIGH

Peak severity

46.7%

Coverage

Highlights

Path Traversal: 7 prior fixes. Scrutinize any change in this area.

mz_os.c: most-fixed (8 issues). Treat as high-risk during review.

13 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Path Traversal: Path validation during archive extraction in mz_os.c has repeatedly failed to handle nested parent directory elements ('..'), backslashes on POSIX systems, and unchecked symlink resolution, leading to arbitrary write capabilities (Zip Slip).

Buffer Overflow: String manipulation APIs like strncat and memory allocators (MZ_ALLOC) in mz_os.c frequently experience bounds calculation errors, integer truncations on long paths, and lack of null-termination. This pattern directly mirrors published CVEs like CVE-2023-48107 and CVE-2023-48106.

Cryptographic Weakness: Failure to explicitly finalize decryption blocks and verify authenticity tags (e.g. AES-GCM tags in OpenSSL) allows ciphertext manipulation and decryption of unauthenticated data.