The following 3 patches applied to 0.13.69 in this order, combined:
https://github.com/gdraheim/zziplib/commit/9411bde3e4a70a81ff3ffd256b71927b2d90dcbb.patch
https://github.com/gdraheim/zziplib/commit/d2e5d5c53212e54a97ad64b793a4389193fec687.patch
https://github.com/gdraheim/zziplib/commit/0e1dadb05c1473b9df2d7b8f298dab801778ef99.patch

diff --git a/test/test.zip b/test/test.zip
index 2c992ea..952d475 100644
Binary files a/test/test.zip and b/test/test.zip differ
diff --git a/zzip/zip.c b/zzip/zip.c
index 14e2e06..f97a40a 100644
--- a/zzip/zip.c
+++ b/zzip/zip.c
@@ -472,9 +472,15 @@ __zzip_parse_root_directory(int fd,
         } else
         {
             if (io->fd.seeks(fd, zz_rootseek + zz_offset, SEEK_SET) < 0)
+	    {
+	    	free(hdr0);
                 return ZZIP_DIR_SEEK;
+	    }
             if (io->fd.read(fd, &dirent, sizeof(dirent)) < __sizeof(dirent))
+	    {
+	    	free(hdr0);
                 return ZZIP_DIR_READ;
+	    }
             d = &dirent;
         }
 
@@ -574,11 +580,18 @@ __zzip_parse_root_directory(int fd,
 
         if (hdr_return)
             *hdr_return = hdr0;
+	else
+	{
+	    /* If it is not assigned to *hdr_return, it will never be free()'d */
+	    free(hdr0);
+	}
     }                           /* else zero (sane) entries */
+    else
+        free(hdr0);
 #  ifndef ZZIP_ALLOW_MODULO_ENTRIES
-    return (entries != zz_entries ? ZZIP_CORRUPTED : 0);
+    return (entries != zz_entries) ? ZZIP_CORRUPTED : 0;
 #  else
-    return ((entries & (unsigned)0xFFFF) != zz_entries ? ZZIP_CORRUPTED : 0);
+    return ((entries & (unsigned)0xFFFF) != zz_entries) ? ZZIP_CORRUPTED : 0;
 #  endif
 }
 
55ab6649c32ef838762058ae95c5b'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=8320c72587255ab6649c32ef838762058ae95c5b'>root</a>/<a href='/guix/log/gnu?id=8320c72587255ab6649c32ef838762058ae95c5b'>gnu</a>/<a href='/guix/log/gnu/packages?id=8320c72587255ab6649c32ef838762058ae95c5b'>packages</a>/<a href='/guix/log/gnu/packages/tex.scm?id=8320c72587255ab6649c32ef838762058ae95c5b'>tex.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/tex.scm?id=8320c72587255ab6649c32ef838762058ae95c5b&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-01-06 16:31:54 +0100'>2020-01-06</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=6a7c4636d4dec47eefa03c95da5a1315bd0e0413'>Adjust module autoloads.</a><span class='msg-avail'>...</span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-11-13 12:49:23 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=2ada1259e9e9df93eabce101cc23f970cd3ac7d9'>gnu: texlive-latex-pdfx: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:23 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=97656fc9377da92ae93a8357ddc6df7562a20196'>gnu: texlive-latex-xmpincl: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:23 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=e34a17e41019c7a45e755f94881fb631420d16df'>gnu: texlive-latex-changepage: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:23 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=44d0717c9b98f081b137dcb7e42e86041123c760'>gnu: texlive-latex-mflogo: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:22 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=4c08aa57400424b09ee506290e05a8f3869d143f'>gnu: texlive-standalone: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:22 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=dc08ede8b55da537daa80a8829ac85982d6902c0'>gnu: texlive-booktabs: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-13 12:49:22 +0200'>2019-11-13</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=04f46e5dbe6607980b98098e2fc64d6afb9a44c8'>gnu: texlive-latex-xkeyval: Declare source file-name.</a><span class='msg-avail'>...</span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2019-11-12 04:05:29 +0100'>2019-11-12</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=cb72994e208bb8d974da908ade59c17707043f87'>gnu: lyx: Download over HTTPS.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2019-11-12 04:05:29 +0100'>2019-11-12</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=b3701ca198684b318d3ff632616ae1158534b491'>gnu: lyx: Use Python 3.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2019-11-12 03:33:06 +0100'>2019-11-12</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=8c183d95af545874b5831758e153e0db620298e1'>gnu: lyx: Update to 2.3.3.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2019-11-12 03:33:05 +0100'>2019-11-12</span></td><td><a href='/guix/commit/gnu/packages/tex.scm?id=3a4b8f446440eae2001b529ec26c88e214a0ae75'>gnu: lyx: Don't use NAME in source URI.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>