Decompression-limits retrofit for every miniz ZIP consumer. More...

#include <stddef.h>
#include <stdint.h>
#include "epub_internal.h"
#include "ra8_check.h"
#include "ra8_decomp_limits.h"

Include dependency graph for epub_zip_guard.c:

Functions
ra8_err_t	priv_epub_zip_guard_archive (mz_zip_archive *zip)
	Guard a just-opened ZIP archive against the decompression policy.
ra8_err_t	priv_epub_zip_guard_entry (const mz_zip_archive_file_stat *st)
	Guard one ZIP entry's declared sizes against the policy.

Variables
static const char *const	s_tag_zip_guard = "epub_zip"
	Log tag for ZIP-guard diagnostics.

Detailed Description

Decompression-limits retrofit for every miniz ZIP consumer.

Tag: [Ring 4 / EPUB] {World: NS}

The two checks that bind the pre-existing ZIP-store / DEFLATE paths (EPUB open, chapter / cover / resource extraction, the #231 iterative entry reader, and the comic CBZ backend via epub_miniz_alloc's shared pool) to the unified decompression-limits policy (ra8_decomp_limits.h):

priv_epub_zip_guard_archive caps the central-directory entry count at open (the many-tiny-entries bomb dies before any entry work);
priv_epub_zip_guard_entry checks every entry's declared sizes before inflation (lying headers and declared decompression bombs die at O(1)). miniz itself then bounds the actual inflation to the declared uncompressed size, closing the loop.

Both run the ONE default policy – the same record every other decoder in the content path enforces.

Copyright: Copyright (c) 2026 Brighton Sikarskie SPDX-License-Identifier: MIT

Since: 0.1.0

Definition in file epub_zip_guard.c.

Function Documentation

◆ priv_epub_zip_guard_archive()

ra8_err_t priv_epub_zip_guard_archive ( mz_zip_archive * zip )

nodiscard

Guard a just-opened ZIP archive against the decompression policy.

The archive-level half of the unified decompression-limits retrofit (ra8_decomp_limits.h): rejects an archive whose central directory enumerates more entries than the default policy's max_entries – the many-tiny-entries resource bomb – before any entry is touched. Called once per mz_zip_reader_init* success (both the in-memory and streamed open paths funnel through priv_epub_finish_open).

Parameters

[in] zip Initialised miniz reader (non-NULL).

Returns: ra8_err_t Error code.

Return values

k_ra8_ok	The entry count is within policy.
k_ra8_err_null_ptr	`zip` was NULL.
k_ra8_err_decomp_entries	The central directory exceeds the cap.

Precondition: zip was initialised by an mz_zip_reader_init* call.; The default decompression policy is in force (no per-book override).

Postcondition: No archive state is modified (pure count check).; On breach the caller must destroy the reader (fail-closed).

Note: Thread-safe: pure read of the reader's entry count.

See also: priv_epub_zip_guard_entry()

Since: 0.1.0

Definition at line 40 of file epub_zip_guard.c.

References k_ra8_err_decomp_entries, k_ra8_ok, ra8_decomp_limits_t::max_entries, RA8_CHECK_NULL_PTR, ra8_decomp_limits_default(), RA8_PRIV, and s_tag_zip_guard.

Referenced by priv_epub_finish_open().

◆ priv_epub_zip_guard_entry()

ra8_err_t priv_epub_zip_guard_entry ( const mz_zip_archive_file_stat * st )

nodiscard

Guard one ZIP entry's declared sizes against the policy.

The entry-level half of the retrofit: rejects an entry whose central-directory record declares an uncompressed size over the default policy's per-unit output cap, or over the compression-ratio bound relative to its compressed size (the lying-header / decompression-bomb signatures) – before any inflation starts. Called after every successful mz_zip_reader_file_stat that precedes an extraction.

Parameters

[in] st The entry's stat record (non-NULL).

Returns: ra8_err_t Error code.

Return values

k_ra8_ok	Declared sizes are within policy.
k_ra8_err_null_ptr	`st` was NULL.
k_ra8_err_decomp_output_cap	Declared output exceeds the cap.
k_ra8_err_decomp_ratio	Declared output breaks the ratio.