Language: PHP
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
  function privReadEndCentralDirZip4G(&$p_central_dir){
    $zip = fopen($this->zipname,'rb');
    $from   = $p_central_dir['offset'];
    $size   = filesize($this->zipname);
    while($from < $size){
      fseek($zip,$from);
      $sign = unpack('Vid',@fread($zip, 4));
      //debug_out($from,$sign,0x02014b50);
      if($sign['id'] == 0x02014b50){
        $p_central_dir['offset'] = $from;
        break;
      }else{
        $from = $from + 0xFFFFFFFF + 1;//
      }
    }
    fclose($zip);
    return 1;
  }