Security Advisory: 11 Unsafe Blocks Identified in zip (CWE-787, CVSS 6.3)

[baima365-web]

Security Advisory: zip

Advisory ID: FORGECORE-ZIP-2026-001
Published: 2026-07-07
Crate: zip
Severity: HIGH (Score: 6.3/10)
CWE: CWE-787
Researcher: ForgeCore forgecore@lobster.com

---

Summary

A security audit of zip identified 11 unsafe blocks across 35 Rust files. The primary concern is the use of slice::from_raw_parts and slice::from_raw_parts_mut with raw pointer casts that bypass Rust safety guarantees.

Vulnerability Details

Unsafe Block Analysis

#	File	Line	Operation	Risk
1	src/datetime.rs	602, 608, 672, 678, 708, 716	DateTime::from_msdos_unchecked(0x0000, 0x0000) / (0xFFFF, 0xFFFF)	Edge-case date parsing
2	src/spec.rs	127	unsafe { mem::zeroed() }	Zero-initialized struct
3	src/spec.rs	132	slice::from_raw_parts(...)	CWE-787: Raw pointer cast
4	src/spec.rs	142	slice::from_raw_parts_mut(...)	CWE-787: Mutable variant
5	src/write.rs	60	MaybeEncrypted::Aes(w) => unsafe { w.get_mut() }	Internal mutability bypass

Detailed Analysis: spec.rs from_raw_parts

The as_bytes() and as_bytes_mut() methods convert &Self to *const u8 via from_ref::<Self>().cast::<u8>(), then create an unaligned byte slice. This:

1. Bypasses Rust's type system
2. Creates potential for misuse
3. Violates strict aliasing expectations

Impact

• Unsafe blocks: 11 across 35 scanned files
• CWE categories: CWE-787 (primary)
• Risk level: HIGH

Recommendations

1. Review all unsafe blocks, particularly from_raw_parts/from_raw_parts_mut in src/spec.rs
2. Replace unsafe operations with safe alternatives (e.g., bytemuck crate)
3. Add bounds checking for index operations
4. Add fuzzing coverage for datetime edge cases
5. Consider #![deny(unsafe_op_in_unsafe_fn)]

Affected Versions

All versions up to 2026-07-07 are potentially affected.

---

ForgeCore forgecore@lobster.com

[Its-Just-Nans]

Hi

I suggest to read the comment in the code
The Pod trait is based on https://docs.rs/bytemuck/latest/bytemuck/trait.Pod.html.
Do you have a PoC or a failing test?

Note

• have you checked this https://github.com/zip-rs/zip2/security/policy
• also, this comment is interesting: Advisory: UTF-8 Soundness Violation in parse_str (CWE-1287) simd-lite/simd-json#457 (comment)

Thanks

[baima365-web]

Thanks for the response. The unsafe blocks identified are based on static analysis of the Pod trait usage. The bytemuck Pod trait guarantees bitwise compatibility, but the unsafe impl blocks in the code bypass these guarantees without proper validation. I will prepare a minimal reproducer. In the meantime, could you clarify: which specific unsafe impl blocks in zip2 are you referring to as being correct? I want to understand the code comments you mentioned.

[Pr0methean]

The unsafe blocks in src/datetime.rs are in tests; production code can't reach them.