Let's say I have a "corrupted" zip file from a potentially suspicious source, and that at least one person has attempted to extract it. Conventional wisdom used to be that bad stuff™ didn't happen from unzipping a file, but could from interpreting the zipped files it contained. Clearly that isn't true for some versions of 7-Zip, one of which was used1 for the failed extraction.
How can I tell if this particular zip file is booby trapped?
I think it ought to be possible to edit the source of an old version of 7-Zip and write some error handling around the exploitable portions to alert you of a heap overflow and (if desired) dump the subsequent data into a raw file.
1 As I understand it, p7zip
is the backend for Keka which hasn't been updated in years.