Fix from http://antinode.info/ftp/info-zip/unzip60/list.c
 diff --git a/list.c b/list.c
 index 15e0011..2328788 100644
 --- a/list.c
 +++ b/list.c
 @@ -1,5 +1,5 @@
  /*
 -  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
 +  Copyright (c) 1990-2016 Info-ZIP.  All rights reserved.
  
    See the accompanying file LICENSE, version 2009-Jan-02 or later
    (the contents of which are also included in unzip.h) for terms of use.
 @@ -339,7 +339,18 @@ int list_files(__G)    /* return PK-type error code */
                  G.crec.compression_method == ENHDEFLATED) {
                  methbuf[5] = dtype[(G.crec.general_purpose_bit_flag>>1) & 3];
              } else if (methnum >= NUM_METHODS) {
 -                sprintf(&methbuf[4], "%03u", G.crec.compression_method);
 +                /* 2013-02-26 SMS.
 +                 * http://sourceforge.net/p/infozip/bugs/27/  CVE-2014-9913.
 +                 * Unexpectedly large compression methods overflow
 +                 * &methbuf[].  Use the old, three-digit decimal format
 +                 * for values which fit.  Otherwise, sacrifice the
 +                 * colon, and use four-digit hexadecimal.
 +                 */
 +                if (G.crec.compression_method <= 999) {
 +                    sprintf( &methbuf[ 4], "%03u", G.crec.compression_method);
 +                } else {
 +                    sprintf( &methbuf[ 3], "%04X", G.crec.compression_method);
 +                }
              }
  
  #if 0       /* GRR/Euro:  add this? */