IO::Uncompress::Unzip CVE-2025-15649

IO::Uncompress::Unzip is a core Perl decompression module distributed as part of the IO-Compress distribution by PMQS (cpe:2.3:a:pmqs:io::uncompress::unzip:*:*:*:*:*:*:*:*). The vulnerability resides in _dosToUnixTime(), which decodes the 32-bit MS-DOS timestamp stored in each ZIP local-file-header entry and converts it via Perl's Time::Local::timelocal(). The MS-DOS date format encodes year, month, day, hour, minute, and second in bit fields; crafted or corrupt ZIP archives can encode field values that exceed the ranges timelocal() accepts (e.g., month > 11, day > 31, hour > 23). When such a value is decoded, timelocal() throws a fatal Perl exception rather than returning an error code. Because the call site wraps no eval guard, the exception unwinds past IO::Uncompress::Unzip->new(), breaking the module's documented error-handling contract. The root cause is CWE-248 (Uncaught Exception): the library's internal error-propagation model diverges from Perl idiomatic practice when integrating with a function that uses exception-based signalling. The fix confirmed in the commit at fd28c1d2 adds an eval {} block around the timelocal() call and returns 0 when $dt is zero or unparseable, restoring the expected behavior.