Re: Info-ZIP maintainer

Cosmin,

> But the fixes are already in unz551c, right?

That would be difficult, insofar as 5.51c was *released* in May 2003.
It fixed only the original bug, and that (possibly) only for one or
a handful of platforms.  The control-character and quoting bugs were
reported in July and August, respectively (according to the links),
and the other one (that I can't find now but that had to do with
following directory symlinks and overwriting files in the target
location) later still.  No clue where the 16-bit text-mode corruption
bug fits in; for most of us, that would be hard to test.

> My question was: are there patches to apply to *unz551c*, besides those
> that I sent in last November?

...and/or fixes to be created, yes.

> Then we can as well release it now. My plan was to make an unz551d
> bundle, containing the patches that Christian approved, during this
> weekend, or let Mike do it. I asked if there are other changes to
> unz551c, to be integrated into unz551d.

And my answer was yes...

> I was proposing to consider unz551d a release candidate, and to release
> unzip 5.51 after 2 or 3 more weeks.

That would be great, assuming all of the holes are addressed.  The
advisories include precise descriptions of the vulnerabilities and
may include sample zipfiles; it's pretty trivial to test and see if
they're fixed.  Ditto for the symlink bug.

> The patches that I am talking about do not add new functionality, they
> only resolve some compatibility issues with Cygwin. Still, if you wish
> to rush up the process, we can leave those for unzip 5.52 or whatever.

I have no problem with including compatibility fixes, too.  We should
wait as long as necessary and no longer.  I consider addressing all of
the security problems on *all* relevant platforms (with the possible
exception of the 16-bit one) a "necessary" item, but then (after two
or three weeks of testing) it should go out.

Greg