Program: CWE-22
Project: CVE-2018-1002209
Buggy source:
QuaZIP changes

* 0.7.5
        * Fixed target_link_libraries call in CMakeLists
        * Worked around a Qt 4.6 bug (QTBUG-15421) screwing up hidden
          files handling in JlCompress::compressDir()
        * Removed Q_FOREACH uses to avoid conflicts (SF patch #32)

* 2017-02-05 0.7.4
        * Static analysis patch from Intel Deutschland GmbH
        * Replaced UNUSED with QUAZIP_UNUSED to avoid name clashes
        * Minor bug fixes

* 2017-02-05 0.7.3
        * Symlink handling
        * Static linking exception for LGPL
        * Minor bug fixes

* 2016-03-29 0.7.2
        * New JlCompress methods (QIODevice*-based API by Lukasz Kwiecinski)
        * Implemented QuaZioDevice::atEnd() and bytesAvailable()--these might
          break ABI, but pretty unlikely.

* 2015-01-07 0.7.1
        * Fixed licensing issues (bug #45).
        * Added the convenience method QuaZipFileInfo::isEncrypted().

* 2014-07-24 0.7
        * It is now possible to write ZIP files to sequential devices
          like sockets (only in mdCreate mode, so no self-extract, sorry).
        * A few zip64 fixes.
        * Several bug fixes and portability improvements.

* 2014-02-09 0.6.2
        * QuaZipNewInfo / QuaZipFileInfo64 now provide API to access/set
          NTFS time stamps - useful even on non-NTFS systems if you 
          need more precise dates and times than default ones.
        * QuaZipNewInfo may now be initialized from QuaZipFileInfo64.
        * No more crashes when using QSaveFile as QIODevice for ZIP.
        * The new QuaZip::setAutoClose() method allows to leave the
          QIODevice open when you close the QuaZip instance.
        * qztest now depends on quazip, no longer breaking the build.

* 2014-01-26 0.6.1
        * Improved zip64 support.
        * A LOT more tests thanks to g++ --coverage / lcov.
        * JlCompress extraction methods now create files with default
          permissions if they are zero in the original archive.
        * Some QuaZipDir fixes (thanks to the new tests).

* 2014-01-22 0.6
        * Minizip updated to 1.1 (with all the necessary modifications
          re-done), and that means that...
        * the long-awaited zip64 support is now available!
        * A few rather minor fixes.

* 2014-01-19 0.5.2
        * Some minor bug fixes.
        * API to access file permissions subfield of the external
          attributes.
        * MS VS 2012 Express support.
        * API to set the default codec used to encode/decode file names
          (mainly for use by various wrappers such as JlCompress, when
          you don't have direct access to the underlying QuaZip instance).

* 2013-03-02 0.5.1
        * Lots of QuaZipDir fixes, thanks to all bug reporters.
        * Full Qt Creator support.
        * MS VS 2010 Express support.
        * Qt5 support (didn't need any source code changes anyway).
        * Lots of minor bug fixes.

* 2012-09-07 0.5
        * Added run_moc.bat files for building under Windows in case Qt
          integration is not available (e. g. VS 2008 Express).
        * Added the QuaZipDir class to simplify ZIP navigation in terms
          of directories.
        * Added the QuaGzipFile class for working with GZIP archives. It
          was added as a bonus since it has nothing to do with the main
          purpose of the library. It probably won't get any major
          improvements, although minor bug fixes are possible.
        * Added the QuaZIODevice class for working with zlib
          compression. It has nothing to do with the ZIP format, and
          therefore the same notice as for the QuaGzipFile applies.
        * The global comment is no longer erased when adding files to
          an archive.
        * Many bug fixes.

* 2012-01-14 0.4.4
        * Fixed isSequential() test that was causing open() failures on
          Unix.
        * Fixed sub-directory compressing in JlCompress.
        * Added MS VS 2008 solution, compatible with the binary Qt
          distribution (tested on MS VS 2008 Express, had to run MOC
          manually due to the lack of plugin in Express).
        * Fixed extracting directories in JlCompress.
        * Fixed JlCompress.h includes in the test suite, which used
          lowercase names thus breaking on case-sensitive systems.
        * Implemented missing QuaZipFile::getZip() that was only
          declared.
        * Fixed reopening closed files.
        * Fixed possible memory leak in case of open error.

* 2011-09-09 0.4.3
        * New test suite using QTestLib.
        * Fixed bytesAvailable(), pos() and atEnd().
        * Added ZIP v1.0 support and disabling data descriptor for
          compatibility with some older software.
        * Fixed DLL export/import issues for some symbols.
        * Added QUAZIP_STATIC macro for compiling as a static library or
          directly including the source.
        * Added getFileNameList() and getFileInfoList() convenience
          functions.
        * Added some buffering to JlCompress to improve performance.

* 2011-08-10 0.4.2
        * Cmake patch (thanks to Bernhard Rosenkraenzer).
        * Symbian patch (thanks to Hamish Willee).
        * Documented the multiple files limitation of QuaZipFile.
        * Fixed relative paths handling in JlCompress.
        * Fixed linking to MinGW zlib.

* 2011-05-26 0.4.1
        * License statement updated to avoid confusion. GPL license
        removed for the very same reason.
        * Parts of original package are now clearly marked as modified,
        just as their license requires.

* 2011-05-23 0.4
        * QuaZip and QuaZipFile classes now use the Pimpl idiom. This
        means that future releases will probably be binary compatible
        with this one, but it also means that this one is binary
        incompatible with the old ones.
        * IO API has been rewritten using QIODevice instead of standard
        C library. Among other things it means that QuaZip now supports
        files up to 4 GB in size instead of 2 GB.
        * Added QuaZip methods allowing access to ZIP files represented
        by any seekable QIODevice implementation (QBuffer is a good
        example).

* 2010-07-23 0.3
        * Fixed getComment() for global comments.
        * Added some useful classes for calculating checksums (thanks to
        Adam Walczak).
        * Added some utility classes for working with whole directories
        (thanks to Roberto Pompermaier). It would be nice if someone
        documents these in English, though.
        * Probably fixed some problems with passwords (thanks to Vasiliy
        Sorokin). I didn't test it, though.

* 2008-09-17 0.2.3
        * Fixed license notices in sources.

* SVN
        * Fixed a small bug in QuaZipFile::atEnd().

* 2007-01-16 0.2.2
        * Added LGPL as alternative license.
        * Added FAQ documentation page.

* 2006-03-21 0.2.1
        * Fixed setCommentCodec() bug.
        * Fixed bug that set month 1-12 instead of 0-11, as specified in
          zip.h.
        * Added workaround for Qt's bug that caused wrong timestamps.
        * Few documentation fixes and cosmetic changes.

* 2005-07-08 0.2
        * Write support.
        * Extended QuaZipFile API, including size(), *pos() functions.
        * Support for comments encoding/decoding.

* 2005-07-01 0.1
        * Initial version.


Fixed version (ground truth):
QuaZIP changes

* Current
        * Fixed the Zip Slip vulnerability in JlCompress

* 0.7.5
        * Fixed target_link_libraries call in CMakeLists
        * Worked around a Qt 4.6 bug (QTBUG-15421) screwing up hidden
          files handling in JlCompress::compressDir()
        * Removed Q_FOREACH uses to avoid conflicts (SF patch #32)

* 2017-02-05 0.7.4
        * Static analysis patch from Intel Deutschland GmbH
        * Replaced UNUSED with QUAZIP_UNUSED to avoid name clashes
        * Minor bug fixes

* 2017-02-05 0.7.3
        * Symlink handling
        * Static linking exception for LGPL
        * Minor bug fixes

* 2016-03-29 0.7.2
        * New JlCompress methods (QIODevice*-based API by Lukasz Kwiecinski)
        * Implemented QuaZioDevice::atEnd() and bytesAvailable()--these might
          break ABI, but pretty unlikely.

* 2015-01-07 0.7.1
        * Fixed licensing issues (bug #45).
        * Added the convenience method QuaZipFileInfo::isEncrypted().

* 2014-07-24 0.7
        * It is now possible to write ZIP files to sequential devices
          like sockets (only in mdCreate mode, so no self-extract, sorry).
        * A few zip64 fixes.
        * Several bug fixes and portability improvements.

* 2014-02-09 0.6.2
        * QuaZipNewInfo / QuaZipFileInfo64 now provide API to access/set
          NTFS time stamps - useful even on non-NTFS systems if you 
          need more precise dates and times than default ones.
        * QuaZipNewInfo may now be initialized from QuaZipFileInfo64.
        * No more crashes when using QSaveFile as QIODevice for ZIP.
        * The new QuaZip::setAutoClose() method allows to leave the
          QIODevice open when you close the QuaZip instance.
        * qztest now depends on quazip, no longer breaking the build.

* 2014-01-26 0.6.1
        * Improved zip64 support.
        * A LOT more tests thanks to g++ --coverage / lcov.
        * JlCompress extraction methods now create files with default
          permissions if they are zero in the original archive.
        * Some QuaZipDir fixes (thanks to the new tests).

* 2014-01-22 0.6
        * Minizip updated to 1.1 (with all the necessary modifications
          re-done), and that means that...
        * the long-awaited zip64 support is now available!
        * A few rather minor fixes.

* 2014-01-19 0.5.2
        * Some minor bug fixes.
        * API to access file permissions subfield of the external
          attributes.
        * MS VS 2012 Express support.
        * API to set the default codec used to encode/decode file names
          (mainly for use by various wrappers such as JlCompress, when
          you don't have direct access to the underlying QuaZip instance).

* 2013-03-02 0.5.1
        * Lots of QuaZipDir fixes, thanks to all bug reporters.
        * Full Qt Creator support.
        * MS VS 2010 Express support.
        * Qt5 support (didn't need any source code changes anyway).
        * Lots of minor bug fixes.

* 2012-09-07 0.5
        * Added run_moc.bat files for building under Windows in case Qt
          integration is not available (e. g. VS 2008 Express).
        * Added the QuaZipDir class to simplify ZIP navigation in terms
          of directories.
        * Added the QuaGzipFile class for working with GZIP archives. It
          was added as a bonus since it has nothing to do with the main
          purpose of the library. It probably won't get any major
          improvements, although minor bug fixes are possible.
        * Added the QuaZIODevice class for working with zlib
          compression. It has nothing to do with the ZIP format, and
          therefore the same notice as for the QuaGzipFile applies.
        * The global comment is no longer erased when adding files to
          an archive.
        * Many bug fixes.

* 2012-01-14 0.4.4
        * Fixed isSequential() test that was causing open() failures on
          Unix.
        * Fixed sub-directory compressing in JlCompress.
        * Added MS VS 2008 solution, compatible with the binary Qt
          distribution (tested on MS VS 2008 Express, had to run MOC
          manually due to the lack of plugin in Express).
        * Fixed extracting directories in JlCompress.
        * Fixed JlCompress.h includes in the test suite, which used
          lowercase names thus breaking on case-sensitive systems.
        * Implemented missing QuaZipFile::getZip() that was only
          declared.
        * Fixed reopening closed files.
        * Fixed possible memory leak in case of open error.

* 2011-09-09 0.4.3
        * New test suite using QTestLib.
        * Fixed bytesAvailable(), pos() and atEnd().
        * Added ZIP v1.0 support and disabling data descriptor for
          compatibility with some older software.
        * Fixed DLL export/import issues for some symbols.
        * Added QUAZIP_STATIC macro for compiling as a static library or
          directly including the source.
        * Added getFileNameList() and getFileInfoList() convenience
          functions.
        * Added some buffering to JlCompress to improve performance.

* 2011-08-10 0.4.2
        * Cmake patch (thanks to Bernhard Rosenkraenzer).
        * Symbian patch (thanks to Hamish Willee).
        * Documented the multiple files limitation of QuaZipFile.
        * Fixed relative paths handling in JlCompress.
        * Fixed linking to MinGW zlib.

* 2011-05-26 0.4.1
        * License statement updated to avoid confusion. GPL license
        removed for the very same reason.
        * Parts of original package are now clearly marked as modified,
        just as their license requires.

* 2011-05-23 0.4
        * QuaZip and QuaZipFile classes now use the Pimpl idiom. This
        means that future releases will probably be binary compatible
        with this one, but it also means that this one is binary
        incompatible with the old ones.
        * IO API has been rewritten using QIODevice instead of standard
        C library. Among other things it means that QuaZip now supports
        files up to 4 GB in size instead of 2 GB.
        * Added QuaZip methods allowing access to ZIP files represented
        by any seekable QIODevice implementation (QBuffer is a good
        example).

* 2010-07-23 0.3
        * Fixed getComment() for global comments.
        * Added some useful classes for calculating checksums (thanks to
        Adam Walczak).
        * Added some utility classes for working with whole directories
        (thanks to Roberto Pompermaier). It would be nice if someone
        documents these in English, though.
        * Probably fixed some problems with passwords (thanks to Vasiliy
        Sorokin). I didn't test it, though.

* 2008-09-17 0.2.3
        * Fixed license notices in sources.

* SVN
        * Fixed a small bug in QuaZipFile::atEnd().

* 2007-01-16 0.2.2
        * Added LGPL as alternative license.
        * Added FAQ documentation page.

* 2006-03-21 0.2.1
        * Fixed setCommentCodec() bug.
        * Fixed bug that set month 1-12 instead of 0-11, as specified in
          zip.h.
        * Added workaround for Qt's bug that caused wrong timestamps.
        * Few documentation fixes and cosmetic changes.

* 2005-07-08 0.2
        * Write support.
        * Extended QuaZipFile API, including size(), *pos() functions.
        * Support for comments encoding/decoding.

* 2005-07-01 0.1
        * Initial version.