Copied from Fedora.

http://pkgs.fedoraproject.org/cgit/unzip.git/plain/unzip-6.0-overflow.patch?id=d18f821e

diff --git a/extract.c b/extract.c
index a0a4929..9ef80b3 100644
--- a/extract.c
+++ b/extract.c
@@ -2214,6 +2214,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
     ulg eb_ucsize;
     uch *eb_ucptr;
     int r;
+    ush method;
 
     if (compr_offset < 4)                /* field is not compressed: */
         return PK_OK;                    /* do nothing and signal OK */
@@ -2223,6 +2224,12 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
          eb_size <= (compr_offset + EB_CMPRHEADLEN)))
         return IZ_EF_TRUNC;               /* no compressed data! */
 
+    method = makeword(eb + (EB_HEADSIZE + compr_offset));
+    if ((method == STORED) && (eb_size != compr_offset + EB_CMPRHEADLEN + eb_ucsize))
+        return PK_ERR;            /* compressed & uncompressed
+                                   * should match in STORED
+                                   * method */
+
     if (
 #ifdef INT_16BIT
         (((ulg)(extent)eb_ucsize) != eb_ucsize) ||
class='active' href='/guix/log/.gitignore'>log</a><a href='/guix/tree/.gitignore?id=05a5e222e9e9250dbac61a278762dd47f2eb8897'>tree</a><a href='/guix/commit/.gitignore?id=05a5e222e9e9250dbac61a278762dd47f2eb8897'>commit</a><a href='/guix/diff/.gitignore?id=05a5e222e9e9250dbac61a278762dd47f2eb8897'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/.gitignore'>
<input type='hidden' name='id' value='05a5e222e9e9250dbac61a278762dd47f2eb8897'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=05a5e222e9e9250dbac61a278762dd47f2eb8897'>root</a>/<a href='/guix/log/.gitignore?id=05a5e222e9e9250dbac61a278762dd47f2eb8897'>.gitignore</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/.gitignore?id=05a5e222e9e9250dbac61a278762dd47f2eb8897&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-10-20 19:16:21 +0200'>2020-10-20</span></td><td><a href='/guix/commit/.gitignore?id=e6994bff2ef461a2860e4207095746a5565cbf0e'>gitignore: Ignore generated guile binary and intermediate products.</a><span class='msg-avail'>...</span></td><td>Julien Lepiller</td></tr>
<tr><td><span title='2020-09-17 14:10:42 +0200'>2020-09-17</span></td><td><a href='/guix/commit/.gitignore?id=cabac732deffafc796537658a6c33c6c4aec821e'>guix-install.sh: Support OpenRC.</a><span class='msg-avail'>...</span></td><td>Morgan Smith</td></tr>
<tr><td><span title='2020-07-17 15:23:53 +0200'>2020-07-17</span></td><td><a href='/guix/commit/.gitignore?id=d6b05ba3534b030f8de976e340c19ac8a4118ff4'>gitignore: Don't ignore daemon source code.</a><span class='msg-avail'>...</span></td><td>Jakub Kądziołka</td></tr>
<tr><td><span title='2020-06-28 13:28:25 +0200'>2020-06-28</span></td><td><a href='/guix/commit/.gitignore?id=b9edefbc46da76fea6d56e08462618a398192189'>.gitignore: Ignore 'etc/committer.scm'.</a><span class='msg-avail'>...</span></td><td>Brice Waegeneire</td></tr>
<tr><td><span title='2020-05-16 15:37:41 +0200'>2020-05-16</span></td><td><a href='/guix/commit/.gitignore?id=1a1faa78b0498fbb71f1533beb4b65817c1d3f2a'>etc: Add a systemd unit to bind-mount @storedir@ read-only.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2020-05-14 23:05:42 -0400'>2020-05-14</span></td><td><a href='/guix/commit/.gitignore?id=cb21ae76714f1873d3b3fb40d5135f00ec104b85'>etc: indent-code.el: Use the --quick option.</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2020-03-30 12:24:55 +0200'>2020-03-30</span></td><td><a href='/guix/commit/.gitignore?id=6e27d1088da07380872f0df9f308b674536cefc8'>.gitignore: Ignore test results in tests/services.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2020-03-11 02:45:33 +0100'>2020-03-11</span></td><td><a href='/guix/commit/.gitignore?id=73fbe04107d38f4561636c74d28d7a4935cbb1ef'>Add system start-up files for guix-daemon.</a><span class='msg-avail'>...</span></td><td>Danny Milosavljevic</td></tr>
<tr><td><span title='2019-09-24 10:11:38 +0200'>2019-09-24</span></td><td><a href='/guix/commit/.gitignore?id=11da634a6e64afa2904542e2174aa2a185f9ac3a'>Merge branch 'master' into core-updates</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-09-18 11:38:14 +0200'>2019-09-18</span></td><td><a href='/guix/commit/.gitignore?id=7bc46ecc34ceb042ff890e5d306d0a2a736e891d'>doc: Add Guix Cookbook.</a><span class='msg-avail'>...</span></td><td>Ricardo Wurmus</td></tr>
<tr><td><span title='2019-06-14 22:09:38 +0200'>2019-06-14</span></td><td><a href='/guix/commit/.gitignore?id=92d00ca4661e186022732a47956a2bc0ef16be96'>build: Remove 'gnu/packages/bootstrap' and its binaries.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-04-26 11:21:32 +0200'>2019-04-26</span></td><td><a href='/guix/commit/.gitignore?id=9ca5ff882e2ac4eaab02eb0fde545bd784af478b'>bootstrap: Break automake dependency on generated files.</a><span class='msg-avail'>...</span></td><td>Miguel Ángel Arruga Vivas</td></tr>
<tr><td><span title='2018-11-20 01:42:43 +0100'>2018-11-20</span></td><td><a href='/guix/commit/.gitignore?id=975b7966f592993bce04e3c153f52f2ece402f21'>.gitignore: Re-add 'authenticate' script.</a><span class='msg-avail'>...</span></td><td>Marius Bakke</td></tr>
<tr><td><span title='2018-06-14 11:17:00 +0200'>2018-06-14</span></td><td><a href='/guix/commit/.gitignore?id=ea0a06cee2ba05451f94714a4f913db02efbe92c'>Remove 'guix-register' and its traces.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-06-12 15:23:34 +0200'>2018-06-12</span></td><td><a href='/guix/commit/.gitignore?id=5909bdc88735c2c1bd9f44eb6a1b518785144292'>.gitignore: Add doc/stamp-[0-9].</a></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-04-19 21:30:30 +0200'>2018-04-19</span></td><td><a href='/guix/commit/.gitignore?id=b9fe8fd662180e64156d2b95a671242c20f0acfc'>gnu: doc: Allow documentation to be translated.</a><span class='msg-avail'>...</span></td><td>Julien Lepiller</td></tr>