The zipRemoveExtraInfoBlock() function in the minizip contrib library shipped with zlib (contrib/minizip/zip.c) 1.2.3.5 through 1.3.2 reads each extra-field block size as a signed 16-bit value and never checks it against the buffer length, so a crafted ZIP extra field (for example from an untrusted archive whose entries are re-used in RAW mode) makes memcpy write past the allocated heap buffer and read past the input, leading to a crash or memory corruption. Fixed in zlib 1.4.