unzip-5.51d

Fellow infozippers,

I have prepared a fresh unzip-5.51d beta.
You can get it from here:

  http://www.cs.toronto.edu/~cosmin/compr/zip/unz551d.zip

To Christian: I hope you agree with all the changes. I did not change
the maintainer's name, so make sure you agree with everything I've done,
before uploading unz551d.zip to the Info-ZIP site. If something goes
wrong, it'll be your fault ;-)

The first security issue, regarding non-printable characters between
"..", was fixed in unzip-5.51c. The second issue, regarding quoted '/',
is fixed in this bundle. The affected ports are:
Acorn, AosVS, Atari, BeOS, MacOS, Novell, OS/2, QDOS, Tandem, Unix, VMS.

I will greatly appreciate your testing. I've prepared a small test
archive that contains "^V" characters. This unzip is supposed to extract
"unz-test" files in the current dir only, while the older versions might
extract files in "/" and in ".."

  http://www.cs.toronto.edu/~cosmin/compr/zip/unz551-test.zip

I've added Lon Hohberger, ITO Tsuyoshi, jelmer and Charles Wilson to
proginfo/CONTRIBS. I propose to move COPYING.OLD to proginfo/, but
I didn't do it; if you agree to this, we can do it at the next release.

Here are the changelog entries:

Features added (or removed):
5.51d (29 Feb 04):
- Cygwin is recognized as a target in the Unix port
    [Charles Wilson, Cosmin Truta, SPC]
- list.c, unzpriv.h, Win32: the date is displayed using the separator
    given by the system's locale, when available [Cosmin Truta]

5.51d (29 Feb 04):
- unix/unix.c: added recognition for Cygwin, i586 and i686 to version()
    [Cosmin Truta]
- unzip.h, unzpriv.h, unix/unzcfg.h: allowed Cygwin to compile as a Unix 
port
    [Charles Wilson, Cosmin Truta, SPC]
- unzpriv.h: guarded some definitions of USE_EF_UT_TIME [Cosmin Truta]
- Cygwin: putenv() must not be called in iz_w32_prepareTZenv() [Cosmin 
Truta]
- win32/Makefile.bc: updated the "clean" target [Cosmin Truta]
- win32/Makefile.gcc: updated CC_CPU_OPT to "-mcpu=pentiumpro";
    fixed the "clean" target [Cosmin Truta]
- Acorn, AosVS, Atari, BeOS, MacOS, Novell, OS/2, QDOS, Tandem, Unix, VMS:
    fixed hole in directory traversal security code which did not map
    a quoted '/' character to '_', allowing the creation of harmful
    ("../" or leading-"/") paths [ITO Tsuyosi, Cosmin Truta]
- man/unzip.1: added note about the use of the "-:" option [Lon Hohberger]

Enjoy!
Cosmin

[P.S. our www server is experiencing some problems; if you can't get the
zip files now, please try again a little later.]

_________________________________________________________________
STOP MORE SPAM with the new MSN 8 and get 2 months FREE*   
http://join.msn.com/?page=dept/bcomm&pgmarket=en-ca&RU=http%3a%2f%2fjoin.msn.com%2f%3fpage%3dmisc%2fspecialoffers%26pgmarket%3den-ca