From a0ae9725865758fc8479a5fb6b0c7763a862051c Mon Sep 17 00:00:00 2001
From: anupamme <mediratta@gmail.com>
Date: Tue, 4 Aug 2026 00:19:04 +0000
Subject: [PATCH 1/2] fix: V-001 security vulnerability

Automated security fix generated by OrbisAI Security
---
 TKLiveSync/unzip.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/TKLiveSync/unzip.cpp b/TKLiveSync/unzip.cpp
index 84471e32..5cca4fca 100644
--- a/TKLiveSync/unzip.cpp
+++ b/TKLiveSync/unzip.cpp
@@ -46,7 +46,7 @@ int64_t unzip(const char* syncZipPath, const char* destination)
         assetFullname.append("/");
         assetFullname.append(name);
 
-        strcpy(pathcopy, name);
+        snprintf(pathcopy, PATH_MAX, "%s", name);
         auto path = dirname(pathcopy);
         std::string dirFullname(destination);
         dirFullname.append("/");

From da985c208c14ed0dfe7b6bfd9f2ca843f86dba26 Mon Sep 17 00:00:00 2001
From: Anupam Mediratta <mediratta@gmail.com>
Date: Thu, 6 Aug 2026 12:56:09 +0530
Subject: [PATCH 2/2] fix: eliminate fixed-size buffer in unzip.cpp to prevent
 path truncation

Replace heap-allocated PATH_MAX buffer + strcpy/dirname with std::string
find_last_of to avoid silent truncation of long ZIP entry names that could
cause the directory path to diverge from assetFullname.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 TKLiveSync/unzip.cpp | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/TKLiveSync/unzip.cpp b/TKLiveSync/unzip.cpp
index 5cca4fca..d3e4e0a2 100644
--- a/TKLiveSync/unzip.cpp
+++ b/TKLiveSync/unzip.cpp
@@ -1,7 +1,6 @@
 #include "unzip.h"
 #include "libzip/zip.h"
 #include <assert.h>
-#include <libgen.h>
 #include <limits.h>
 #include <string>
 #include <sys/stat.h>
@@ -36,7 +35,6 @@ int64_t unzip(const char* syncZipPath, const char* destination)
     struct zip_stat sb;
     struct zip_file* zf;
     char buf[65536];
-    auto pathcopy = new char[PATH_MAX];
 
     for (zip_int64_t i = 0; i < num; i++) {
         zip_stat_index(z, i, ZIP_STAT_MTIME, &sb);
@@ -46,12 +44,15 @@ int64_t unzip(const char* syncZipPath, const char* destination)
         assetFullname.append("/");
         assetFullname.append(name);
 
-        snprintf(pathcopy, PATH_MAX, "%s", name);
-        auto path = dirname(pathcopy);
-        std::string dirFullname(destination);
-        dirFullname.append("/");
-        dirFullname.append(path);
-        mkdir_rec(dirFullname.c_str());
+        std::string entryName{ name };
+        auto separator = entryName.find_last_of('/');
+
+        if (separator != std::string::npos) {
+            std::string dirFullname{ destination };
+            dirFullname.append("/");
+            dirFullname.append(entryName.substr(0, separator));
+            mkdir_rec(dirFullname.c_str());
+        }
 
         zf = zip_fopen_index(z, i, 0);
         assert(zf != nullptr);
@@ -72,7 +73,6 @@ int64_t unzip(const char* syncZipPath, const char* destination)
 
         zip_fclose(zf);
     }
-    delete[] pathcopy;
     zip_close(z);
 
     return num;