Re: unzip-5.51d (and 5.51e announcement [fwd])

Cosmin wrote:

> So, if Christian agrees, I will make an "unz551e" release, probably by
> this weekend.

Um...actually, 5.51e was released two days ago.  I'm not sure why Christian's
messages to this list haven't been approved (maybe the "approve" messages
get auto-dumped because it's an "open" list and everyone who wants to post
*must* be subscribed?), but a copy came through the "zip-bug" list.  I'll
append it below.

> I will incorporate Darren's patches,

Note that Christian has asked for discussion on Darren's -W patch, and
regardless of the outcome, I *think* he said he was going to defer it
until whatever comes after 5.51 (since it's not a security fix).

Greg


From: [email protected] (Christian Spieler)
Subject: UnZIp 5.51e BETA available
Date: Mon, 1 Mar 2004 21:20:58 +0100

Hello, Dear Info-Zip community!

After examination of Cosmin's unz551d archive, I was "forced" to
release this quick successor. Cosmin has managed to leave out most of
my changes from 5.51c to 5.51d, including all the important security fixes
and the corrections I had already added to the documentation files.

So, here is it... :

UnZip, version 5.51e BETA, 01 March 2004

The source archive is available at:
     http://home.t-online.de/home/christian.spieler/infozip/unz551e.zip

The ChangeLog (5.51d and 5.51e changes, some entries were previously
missing in my 5.51d release):

Features added (or removed):

5.51d (27 Feb 04):
 - Cygwin is recognized as a target in the Unix port
    [Charles Wilson, Cosmin Truta, SPC]

5.51e (01 Mar 04):
 - Win32 port (list.c, unzpriv.h, win32.c, w32cfg.h): the date in
(non-ZipInfo)
    listings is displayed using the separator given by the system's
locale,
    when available [Cosmin Truta]

Bugs fixed:

5.51d (27 Feb 04):
 - unix/unix.c: added recognition for Cygwin, i586 and i686 to version()
    [Cosmin Truta]
 - unzip.h, unzpriv.h, unix/unzcfg.h: allowed Cygwin to compile as a Unix
port
    [Charles Wilson, Cosmin Truta, SPC]
 - unix/unxcfg.h: added inclusion of <utime.h> for DG/UX to fix setting
    of file time-stamps [Dave Lovelace]
 - macos/source/macstat.c: corrected size in zeroing instruction of stat
buffer
    [Yamaga Tomonori]
 - extract.c: fixed memory leak in SET_DIR_ATTRIB code in case of
premature
    exit (disk full or user break), execute deferred tasks for processed
    entries in this case [SPC]
 - unix/zipgrep: allow grep of filenames with embedded spaces [Greg
Roelofs]
 - win32: update support for newer Cygwin releases [Cosmin Truta]
 - remove support for quoting characters from all ports; this feature was
a
    security hole [SPC]
 - use central directory's entry names for extraction/testing, emit
warning for
    local/central entry name difference (bug report by Jan Echternach)
[SPC]
 - all SYMLINKS-capable ports (AOS/VS, Atari, BeOS, Unix): defer creation
of
    symlinks until all extractions for current archive are finished, to
close
    a security hole (bug report by Jan Echternach)
    (Changed: globals.h, unzpriv.h, extract.c, [system]/[system].c) [SPC]
 - crypt.h: changed default setting for Zip to enable crypt support [SPC]
 - partial documentation updates, as suggested by Greg [SPC]

5.51e (01 Mar 04):
 - unzpriv.h: guarded some definitions of USE_EF_UT_TIME [Cosmin Truta]
 - Cygwin: putenv() must not be called in iz_w32_prepareTZenv() [Cosmin
Truta]
 - unix/unxcfg.h: include <unistd.h> for Cygwin [Cosmin Truta]
 - unix/unix.c: enable old code that sets DIRENT symbol for _POSIX_VERSION
    environments [Cosmin Truta]
 - win32/Makefile.bc: updated the "clean" target [Cosmin Truta]
 - win32/Makefile.gcc: updated CC_CPU_OPT to "-mcpu=pentiumpro";
    fixed the "clean" target [Cosmin Truta]
 - man/unzip.1: added note about the use of the "-:" option [Lon
Hohberger]
 - merged in usable changes (see above) from Cosmin's bogus 5.51d beta
archive
    variant [SPC]
 - win32: guarded "NTSD integration code" (not working, under
construction)
    with preprocessor symbol NTSD_DEV to allow intermediate compilation
and
    testing of the current state [SPC]

==================

I have only tested compilation on Win32 and Linux. The other ports
remainded
unchanged from 5.51d.

More explanation:

1) The License was not modified since 2003-May-08. So, there is no need to
   touch it just because we have now 2004.
   (If I remember correctly, GNU Licence V2 is still (c) 1991)

2) The fixes for the "^V" and "../" security hole have never been applied
to
   the UnZip sources. Instead, the ^V quoting functionality was completely
   removed, because it imposes even more security holes. The supplied
"fix"
   did not close the more subtile variants of this security compromizing
   doorway.
   Last September, we had a short discussion on Zip-Dev regarding this
issue.
   We came to the conclusion that nobody really knows any useful
application
   of this feature. So, the most simple fix was to remove the code
entirely.

3) I removed those contributors of directory traversal fixes from
   "proginfo/Contribs" whose patches did not make it into the code tree.
   In the end, I have fixed the holes myself, using a slightly different
   approach compared to the supplied fixes.

4) Although I was silent for longer periods, I have monitored the mailing
   lists. For those problems that looked important to me, I have applied
   modifications to the source (at least I think I have done it...).
   The beta release 5.51e should be checked against the security issues
   first before anyone tries to merge in patches for issues that may have
   been fixed already.

5) If anyone wants to try out his skills on finishing up the integration
   of the NTSD EA code into the generic "directory attributes restore"
   feature, he is welcome! Those parts of my preliminary changes that
   broke win32 compilation have been temporarily disabled by enclosing
   them with the preprocessor conditional NTSD_DEV.

Best regards,

Christian Spieler