--- unzoo.c	2002-05-06 17:34:00.000000000 +0200
+++ unzoo-4.4/unzoo.c	2005-05-11 11:44:47.151745616 +0200
@@ -2573,6 +2582,23 @@
             continue;
         }
 
+        /* check the path for directory traversal                          */
+        char patu [sizeof(Entry.diru) + sizeof(Entry.namu) + 1];
+        strcpy( patu, Entry.diru );
+        strcat( patu, Entry.namu );
+        if ( *patu == '/' && !strlen( pre ) ) {
+            printf("unzoo: not extracting '%s', directory traversal\n", patl);
+            continue;
+        }
+        if ( !strncmp( patu, "../", 3 )) {
+            printf("unzoo: not extracting '%s', directory traversal\n", patl);
+            continue;
+        }
+        if ( strstr( patu, "/../" )) {
+            printf("unzoo: not extracting '%s', directory traversal\n", patl);
+            continue;
+        }
+
         /* check that such a file does not already exist                   */
         strcpy( patl, pre );  strcat( patl, Entry.patl );
         if ( out == 2 && ovr == 0 && OpenReadFile(patl,0L) ) {