Add hard limit 10MB to reading non data files from zip file

src/DataFile.cpp

@@ -113,13 +113,15 @@ DataFilePrivate::DataFilePrivate(const ZipSerialize &z, string filename, string
         for(size_t size = 0, currentStreamSize = 0;
              (size = r(buf.data(), buf.size())) > 0; currentStreamSize += size)
         {
+            if(currentStreamSize + size > r.size)
+                THROW("ZIP entry actual size exceeds uncompressed_size %lu", r.size);
             if(!fs->write(buf.data(), size))
                 THROW("Failed to write '%s' data to stream. Stream size: %d", m_filename.c_str(), currentStreamSize);
         }
         m_is = std::move(fs);
     }
     else
-        m_is = make_unique<stringstream>(r.operator string());
+        m_is = make_unique<stringstream>(r(MAX_MEM_FILE));
 }
 
 DataFilePrivate::~DataFilePrivate() noexcept = default;

src/util/ZipSerialize.h

@@ -20,6 +20,7 @@
 #pragma once
 
 #include "Exports.h"
+#include "log.h"
 
 #include <memory>
 #include <string>
@@ -34,14 +35,22 @@ class ZipSerialize
 {
 public:
     struct Read {
+        static constexpr size_t maxSize = 10UL*1024*1024;
         size_t operator ()(void *data, size_t size) const;
-        template<class T>
-        constexpr operator T() const
+        template<class T = std::string>
+        T operator ()(size_t maxAlloc = maxSize) const
         {
+            if(size > maxAlloc)
+                THROW("ZIP entry uncompressed size %zu exceeds limit", size);
             T t(size, 0);
             t.resize(operator ()(t.data(), t.size()));
+            char extra{};
+            if(operator ()(&extra, 1) > 0)
+                THROW("ZIP entry actual size exceeds uncompressed_size %zu", size);
             return t;
         }
+        template<class T>
+        constexpr operator T() const { return operator()<T>(); }
         std::unique_ptr<void, int (*)(void*)> d;
         size_t size;
     };