Compute in 32-bit integer type and cast result to 16-bit.
Found by clang -fsanitize=undefined.

lib/zip_source_pkware.c

diff --git a/lib/zip_source_pkware.c b/lib/zip_source_pkware.c
index ce281ac..ee52fc1 100644
--- a/lib/zip_source_pkware.c
+++ b/lib/zip_source_pkware.c
@@ -107,7 +107,7 @@
 	if (!update_only) {
 	    /* decrypt next byte */
 	    tmp = (zip_uint16_t)(ctx->key[2] | 2);
-	    tmp = (zip_uint16_t)((tmp * (tmp ^ 1)) >> 8);
+	    tmp = (zip_uint16_t)(((zip_uint32_t)tmp * (tmp ^ 1)) >> 8);
 	    b ^= (Bytef)tmp;
 	}