Function cbm_extract_binary_from_zip

src/cli/cli.c:6312–6360

}

unsigned char *cbm_extract_binary_from_zip(const unsigned char *data, int data_len, int *out_len) {
    if (!data || data_len <= 0 || !out_len) {
        return NULL;
    }
    *out_len = 0;

    int pos = 0;
    while (pos + ZIP_HDR_SZ <= data_len) {
        if (data[pos] != ZIP_SIG_0 || data[pos + CLI_SKIP_ONE] != ZIP_SIG_1 ||
            data[pos + CLI_PAIR_LEN] != ZIP_SIG_2 || data[pos + CLI_JSON_INDENT] != ZIP_SIG_3) {
            break;
        }

        uint16_t method = zip_read_u16le(data + pos + ZIP_OFF_METHOD);
        uint32_t comp_size = zip_read_u32le(data + pos + ZIP_OFF_COMP);
        uint32_t uncomp_size = zip_read_u32le(data + pos + ZIP_OFF_UNCOMP);
        uint16_t name_len = zip_read_u16le(data + pos + ZIP_OFF_NAMELEN);
        uint16_t extra_len = zip_read_u16le(data + pos + ZIP_OFF_EXTRALEN);

        int header_end = pos + ZIP_HDR_SZ + name_len + extra_len;
        if (header_end > data_len || comp_size > (uint32_t)(data_len - header_end)) {
            break;
        }

        char fname[CLI_BUF_512] = {0};
        int fn_copy = name_len < (int)sizeof(fname) - CLI_SKIP_ONE
                          ? name_len
                          : (int)sizeof(fname) - CLI_SKIP_ONE;
        memcpy(fname, data + pos + 30, (size_t)fn_copy);
        fname[fn_copy] = '\0';

        if (strstr(fname, "..")) {
            pos = header_end + (int)comp_size;
            continue;
        }

        const char *basename = strrchr(fname, '/');
        basename = basename ? basename + CLI_SKIP_ONE : fname;

        if (strcmp(basename, "codebase-memory-mcp") == 0 ||
            strcmp(basename, "codebase-memory-mcp.exe") == 0) {
            return zip_extract_entry(data + header_end, method, comp_size, uncomp_size, out_len);
        }

        pos = header_end + (int)comp_size;
    }

    return NULL;
}

#endif /* CBM_CLI_ENABLE_TEST_API — tar.gz / zip extraction */