NanaZip vulnerabilities

NanaZip from version 1.0.88.0 until stable 6.0.1698.0 and preview 6.5.1742.0 has a vulnerability in the Lz4Decode function that rejects only a zero return from LZ4_decompress_safe, while malformed input produces a negative error value. The negative int is converted to unsigned SizeT, leading to out-of-bounds read and potential data leak or crash.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 causes a process crash when testing or extracting WebAssembly, ElectronAsar, Zealfs, Romfs, Ufs, Littlefs, and DotNetSingleFile archives. The issue stems from unconditionally dereferencing the caller-supplied Indices pointer, which can be NULL when the archive engine signals extraction of all items.

NanaZip prior to version 6.5.1749.0 has a vulnerability in its WebAssembly archive handler where an attacker can control buffer allocation sizes. By crafting a file with manipulated NameSize and Information.Size fields, multi-gigabyte memory allocations can be forced, leading to memory exhaustion or process termination.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 allows an attacker to cause memory exhaustion via a crafted UFS/FFS image. Missing validation of the fragment size (fs_fsize) lets a tiny image force multi-gigabyte allocations during open or extraction.

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 allows process crashes via a crafted .NET single-file bundle. The issue stems from missing validation of the extraction buffer size against the actual file size, potentially leading to std::bad_alloc or std::length_error exceptions.