Affected: zip-rs zip2

zip is a zip library for Rust that supports reading and writing simple ZIP files. From 1.3.0 until 9.0.0, ZipArchive::extract in src/read/mod.rs calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, causing the infallible allocation path to abort the process before the entry is validated. The failure cannot be contained with catch_unwind or a worker thread, allowing repeated denial of service in archive-processing applications. This issue is fixed in version 9.0.0.

Affected: crates.io: zip

`ZipArchive::extract()` sizes the symlink-target buffer from the uncompressed size declared in the central directory record, before reading a single byte of entry data:

```rust let mut target = Vec::with_capacity(file.size() as usize); ```

Both inputs are attacker-controlled. `ZipFile::size()` returns `uncompressed_size` verbatim from the central directory, widened to a full `u64` by a ZIP64 extended-information extra field, and is never cross-checked against the compressed size, the remaining archive length, or any platform-appropriate bound for a symlink target. `ZipFile::is_symlink()` is decided entirely by the `S_IFLNK` bit of the external-attributes field.

`Vec::with_capacity()` is infallible: when the reservation is refused it calls `handle_alloc_error()` and aborts the process. This is not a Rust panic. It is not caught by `catch_unwind()`, is unaffected by `panic = "unwind"`, and is not contained by running the call on a worker thread.

A 112-byte archive is sufficient. One `Stored` entry flagged `S_IFLNK` with a ZIP64 field declaring `uncompressed_size = 2^62` and a zero-byte payload makes `extract()` fail with:

``` memory allocation of 4611686018427387904 bytes failed Aborted (core dumped) # exit 134 ```

The declared value only needs to exceed the host's address space, not its RAM: `Vec::with_capacity()` maps address space without touching pages, so resident memory stays flat and the abort happens on the refused reservation itself. Under a `ulimit -v`…