From 05cae50612c26a8cff85db451db4b6a930569624 Mon Sep 17 00:00:00 2001 From: "alexey.lysiuk" Date: Sun, 28 Jul 2019 11:01:16 +0300 Subject: [PATCH] - updated bzip2 to version 1.0.8 https://www.sourceware.org/bzip2/ https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz --- libraries/bzip2/CHANGES | 20 ++++++++++++++++++-- libraries/bzip2/LICENSE | 4 ++-- libraries/bzip2/README | 9 +++++---- libraries/bzip2/blocksort.c | 4 ++-- libraries/bzip2/bzlib.c | 8 ++++---- libraries/bzip2/bzlib.h | 4 ++-- libraries/bzip2/bzlib_private.h | 6 +++--- libraries/bzip2/compress.c | 6 +++--- libraries/bzip2/crctable.c | 4 ++-- libraries/bzip2/decompress.c | 14 ++++++++++---- libraries/bzip2/huffman.c | 4 ++-- libraries/bzip2/randtable.c | 4 ++-- 12 files changed, 55 insertions(+), 32 deletions(-) diff --git a/libraries/bzip2/CHANGES b/libraries/bzip2/CHANGES index d9b4c05c5..30afead25 100644 --- a/libraries/bzip2/CHANGES +++ b/libraries/bzip2/CHANGES @@ -2,8 +2,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -338,3 +338,19 @@ Security fix only. Fixes CERT-FI 20469 as it applies to bzip2. * bzip2recover: Fix use after free issue with outFile (CVE-2016-3189) * Make sure nSelectors is not out of range (CVE-2019-12900) + +1.0.8 (13 Jul 19) +~~~~~~~~~~~~~~~~~ + +* Accept as many selectors as the file format allows. + This relaxes the fix for CVE-2019-12900 from 1.0.7 + so that bzip2 allows decompression of bz2 files that + use (too) many selectors again. + +* Fix handling of large (> 4GB) files on Windows. + +* Cleanup of bzdiff and bzgrep scripts so they don't use + any bash extensions and handle multiple archives correctly. + +* There is now a bz2-files testsuite at + https://sourceware.org/git/bzip2-tests.git diff --git a/libraries/bzip2/LICENSE b/libraries/bzip2/LICENSE index 95f9598f8..81a37eab7 100644 --- a/libraries/bzip2/LICENSE +++ b/libraries/bzip2/LICENSE @@ -2,7 +2,7 @@ -------------------------------------------------------------------------- This program, "bzip2", the associated library "libbzip2", and all -documentation, are copyright (C) 1996-2010 Julian R Seward. All +documentation, are copyright (C) 1996-2019 Julian R Seward. All rights reserved. Redistribution and use in source and binary forms, with or without @@ -37,6 +37,6 @@ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Julian Seward, jseward@acm.org -bzip2/libbzip2 version 1.0.7 of 27 June 2019 +bzip2/libbzip2 version 1.0.8 of 13 July 2019 -------------------------------------------------------------------------- diff --git a/libraries/bzip2/README b/libraries/bzip2/README index 64873f982..b9c6099fd 100644 --- a/libraries/bzip2/README +++ b/libraries/bzip2/README @@ -6,8 +6,8 @@ This version is fully compatible with the previous public releases. This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. -bzip2/libbzip2 version 1.0.7 of 27 June 2019 -Copyright (C) 1996-2010 Julian Seward +bzip2/libbzip2 version 1.0.8 of 13 July 2019 +Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in this file. @@ -165,8 +165,8 @@ WHAT'S NEW IN 1.0.x ? See the CHANGES file. -I hope you find bzip2 useful. Feel free to contact me at - jseward@acm.org +I hope you find bzip2 useful. Feel free to contact the developers at + bzip2-devel@sourceware.org if you have any suggestions or queries. Many people mailed me with comments, suggestions and patches after the releases of bzip-0.15, bzip-0.21, and bzip2 versions 0.1pl2, 0.9.0, 0.9.5, 1.0.0, 1.0.1, @@ -193,3 +193,4 @@ Cambridge, UK. 10 December 2007 (bzip2, version 1.0.5) 6 Sept 2010 (bzip2, version 1.0.6) 27 June 2019 (bzip2, version 1.0.7) +13 July 2019 (bzip2, version 1.0.8) diff --git a/libraries/bzip2/blocksort.c b/libraries/bzip2/blocksort.c index 26579017a..92d81fe28 100644 --- a/libraries/bzip2/blocksort.c +++ b/libraries/bzip2/blocksort.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/libraries/bzip2/bzlib.c b/libraries/bzip2/bzlib.c index f9da295c7..21786551b 100644 --- a/libraries/bzip2/bzlib.c +++ b/libraries/bzip2/bzlib.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -43,12 +43,12 @@ void BZ2_bz__AssertH__fail ( int errcode ) fprintf(stderr, "\n\nbzip2/libbzip2: internal error number %d.\n" "This is a bug in bzip2/libbzip2, %s.\n" - "Please report it to me at: jseward@acm.org. If this happened\n" + "Please report it to: bzip2-devel@sourceware.org. If this happened\n" "when you were using some program which uses libbzip2 as a\n" "component, you should also report this bug to the author(s)\n" "of that program. Please make an effort to report this bug;\n" "timely and accurate bug reports eventually lead to higher\n" - "quality software. Thanks. Julian Seward, 10 December 2007.\n\n", + "quality software. Thanks.\n\n", errcode, BZ2_bzlibVersion() ); diff --git a/libraries/bzip2/bzlib.h b/libraries/bzip2/bzlib.h index 8cf07918f..8966a6c58 100644 --- a/libraries/bzip2/bzlib.h +++ b/libraries/bzip2/bzlib.h @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/libraries/bzip2/bzlib_private.h b/libraries/bzip2/bzlib_private.h index 797555222..3755a6f70 100644 --- a/libraries/bzip2/bzlib_private.h +++ b/libraries/bzip2/bzlib_private.h @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -36,7 +36,7 @@ /*-- General stuff. --*/ -#define BZ_VERSION "1.0.7, 27-Jun-2019" +#define BZ_VERSION "1.0.8, 13-Jul-2019" typedef char Char; typedef unsigned char Bool; diff --git a/libraries/bzip2/compress.c b/libraries/bzip2/compress.c index 237620d85..5dfa00231 100644 --- a/libraries/bzip2/compress.c +++ b/libraries/bzip2/compress.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -454,7 +454,7 @@ void sendMTFValues ( EState* s ) AssertH( nGroups < 8, 3002 ); AssertH( nSelectors < 32768 && - nSelectors <= (2 + (900000 / BZ_G_SIZE)), + nSelectors <= BZ_MAX_SELECTORS, 3003 ); diff --git a/libraries/bzip2/crctable.c b/libraries/bzip2/crctable.c index 746efac1c..2b33c2535 100644 --- a/libraries/bzip2/crctable.c +++ b/libraries/bzip2/crctable.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/libraries/bzip2/decompress.c b/libraries/bzip2/decompress.c index 20ce4936c..a1a0bac89 100644 --- a/libraries/bzip2/decompress.c +++ b/libraries/bzip2/decompress.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. @@ -287,7 +287,7 @@ Int32 BZ2_decompress ( DState* s ) GET_BITS(BZ_X_SELECTOR_1, nGroups, 3); if (nGroups < 2 || nGroups > BZ_N_GROUPS) RETURN(BZ_DATA_ERROR); GET_BITS(BZ_X_SELECTOR_2, nSelectors, 15); - if (nSelectors < 1 || nSelectors > BZ_MAX_SELECTORS) RETURN(BZ_DATA_ERROR); + if (nSelectors < 1) RETURN(BZ_DATA_ERROR); for (i = 0; i < nSelectors; i++) { j = 0; while (True) { @@ -296,8 +296,14 @@ Int32 BZ2_decompress ( DState* s ) j++; if (j >= nGroups) RETURN(BZ_DATA_ERROR); } - s->selectorMtf[i] = j; + /* Having more than BZ_MAX_SELECTORS doesn't make much sense + since they will never be used, but some implementations might + "round up" the number of selectors, so just ignore those. */ + if (i < BZ_MAX_SELECTORS) + s->selectorMtf[i] = j; } + if (nSelectors > BZ_MAX_SELECTORS) + nSelectors = BZ_MAX_SELECTORS; /*--- Undo the MTF values for the selectors. ---*/ { diff --git a/libraries/bzip2/huffman.c b/libraries/bzip2/huffman.c index 0fd6fd762..43a1899e4 100644 --- a/libraries/bzip2/huffman.c +++ b/libraries/bzip2/huffman.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file. diff --git a/libraries/bzip2/randtable.c b/libraries/bzip2/randtable.c index 726d62f0c..bdc6d4a4c 100644 --- a/libraries/bzip2/randtable.c +++ b/libraries/bzip2/randtable.c @@ -8,8 +8,8 @@ This file is part of bzip2/libbzip2, a program and library for lossless, block-sorting data compression. - bzip2/libbzip2 version 1.0.7 of 27 June 2019 - Copyright (C) 1996-2010 Julian Seward + bzip2/libbzip2 version 1.0.8 of 13 July 2019 + Copyright (C) 1996-2019 Julian Seward Please read the WARNING, DISCLAIMER and PATENTS sections in the README file.