Zip is not inherently insecure anymore than any other URL parsing and archive handling is. Technically it's many orders of magnitude better solution for the ran

Zip is not inherently insecure anymore than any other URL parsing and archive handling is. Technically it's many orders of magnitude better solution for the random access (due to the existence of the central directory as I've already mentioned) than tar-gz, if it's done right. Out of every archive format a pathological case can be constructed, just like it can from the relative file names etc, but such attempts can be simply rejected during the processing once some thresholds are reached. The original article demonstrates that JPG reading implementation can be bad enough, and the same can be said for every format, even text based. It simply has to be done right (including fuzzing at the end).