CVE-2024-45436: Ollama can extract members of a ZIP archive outside of the parent directory

The vulnerability stems from the original implementation of extractFromZipFile which directly used zip.File.Name without path sanitization. The commit diff shows the addition of a path validation check using strings.HasPrefix(n, p) to prevent parent directory escapes. The CVE description specifically names this function, and the patch adds both the security check and corresponding test cases to validate() the fix. The vulnerable version joined user-controlled ZIP entry names with the target directory without normalization, enabling directory traversal attacks.