CVE-2002-1308

An attacker crafts a malformed `.jar` file where the stored `realsize` field is smaller than the actual decompressed data (e.g., patching the size from 24 to 1). When a victim opens a `jar:` URL pointing to this file, the browser allocates a heap buffer based on the forged `realsize` and then decompresses the entry, writing far more data than allocated. This heap-based buffer overflow [CWE-122] can overwrite adjacent heap metadata or function pointers, leading to arbitrary code execution.

The vulnerability resides in `mozilla/modules/libjar/nsZipArchive.cpp` in the `InflateItem` function. The heap overflow occurs at the `memcpy` call around line 1387, where the decompressed data is copied into a buffer allocated using the `realsize` value from the ZIP entry without verifying that the actual decompressed output fits within that buffer. A patch was applied that adds a bounds check before the `memcpy` and returns `ZIP_ERR_CORRUPT` on overflow.

The patch replaces a bare `PR_ASSERT` (which is a no-op in release builds) with a proper runtime bounds check: if `outpos + ZIP_BUFLEN` exceeds `bigBufSize`, the code sets `status = ZIP_ERR_CORRUPT` and breaks out of the loop instead of performing the `memcpy`. This ensures that even if the ZIP entry advertises a smaller `realsize` than the actual decompressed output, the copy is safely aborted and the archive is treated as corrupt.