Bug#1145629: trixie-pu: package gzip/1.13-1+deb13u1

diff -Nru gzip-1.13/debian/changelog gzip-1.13/debian/changelog
--- gzip-1.13/debian/changelog	2025-01-16 23:18:44.000000000 -0500
+++ gzip-1.13/debian/changelog	2026-08-24 17:59:51.000000000 -0400
@@ -1,3 +1,12 @@
+gzip (1.13-1+deb13u1) trixie; urgency=medium
+
+  * d/p/CVE-2026-41991-a.patch, d/p/CVE-2026-41991-b.patch: use -C if
+    lacking mktemp, closes: #1141442, CVE-2026-41991
+  * d/p/CVE-2026-41992.patch: gzip: don’t mishandle .lzh after .Z,
+    closes: #1141443, CVE-2026-41992
+
+ -- Milan Kupcevic <[email protected]>  Mon, 24 Aug 2026 17:59:51 -0400
+
 gzip (1.13-1) sid; urgency=medium
 
   [ Milan Kupcevic ]
diff -Nru gzip-1.13/debian/patches/CVE-2026-41991-a.patch gzip-1.13/debian/patches/CVE-2026-41991-a.patch
--- gzip-1.13/debian/patches/CVE-2026-41991-a.patch	1969-12-31 19:00:00.000000000 -0500
+++ gzip-1.13/debian/patches/CVE-2026-41991-a.patch	2026-08-24 17:59:51.000000000 -0400
@@ -0,0 +1,65 @@
+From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <[email protected]>
+Date: Thu, 16 Apr 2026 12:11:44 -0700
+Subject: gzexe: use -C if lacking mktemp
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+(Problem reported by Michał Majchrowicz.)
+* gzexe.in: If mktemp is needed but not installed,
+use ‘set -C’ to avoid a race when creating a temporary file.
+* zdiff.in: Use the same pattern here, even though the old
+code was probably OK anyway.
+Origin: backport, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
+Bug-Debian: https://bugs.debian.org/1141442
+---
+ NEWS     | 5 +++++
+ gzexe.in | 1 +
+ zdiff.in | 7 +++----
+ 3 files changed, 9 insertions(+), 4 deletions(-)
+
+#diff --git a/NEWS b/NEWS
+#index c053c57..37325ef 100644
+#--- a/NEWS
+#+++ b/NEWS
+#@@ -15,6 +15,11 @@ GNU gzip NEWS                                    -*- outline -*-
+#   after decompressing a .Z file.
+#   [bug present since the beginning]
+# 
+#+  On old-fashioned or limited platforms lacking mktemp, gzexe and
+#+  zdiff no longer have a race when creating a temporary file.
+#+  [bug present since the beginning]
+#+
+#+
+# ** Changes in behavior
+# 
+#   gzip -l now reports "-Inf%" instead of "0.0%" for the infinite
+--- a/gzexe.in
++++ b/gzexe.in
+@@ -128,6 +128,7 @@ for i do
+     tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
+   else
+     tmp=${dir}gzexe$$
++    (umask 77; set -C; > "$tmp")
+   fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
+     res=$?
+     printf >&2 '%s\n' "$0: cannot copy $file"
+--- a/zdiff.in
++++ b/zdiff.in
+@@ -157,12 +157,11 @@ case $file2 in
+                           *) TMPDIR=/tmp/;;
+                         esac
+                         if type mktemp >/dev/null 2>&1; then
+-                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
+-                            exit 2
++                          tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
+                         else
+-                          set -C
+                           tmp=${TMPDIR}zdiff$$
+-                        fi
++                          (umask 77; set -C; > "$tmp")
++                        fi &&
+                         'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
+                         gzip_status=$(
+                           exec 4>&1
diff -Nru gzip-1.13/debian/patches/CVE-2026-41991-b.patch gzip-1.13/debian/patches/CVE-2026-41991-b.patch
--- gzip-1.13/debian/patches/CVE-2026-41991-b.patch	1969-12-31 19:00:00.000000000 -0500
+++ gzip-1.13/debian/patches/CVE-2026-41991-b.patch	2026-08-24 17:59:51.000000000 -0400
@@ -0,0 +1,96 @@
+From 0dfab98769f932242687becf69470ca8d6d5c9a6 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <[email protected]>
+Date: Thu, 16 Apr 2026 13:23:03 -0700
+Subject: znew: use -C
+
+* znew.in: Also use -C here, when creating a temp.
+Origin: upstream, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=0dfab98769f932242687becf69470ca8d6d5c9a6
+Bug-Debian: https://bugs.debian.org/1141442
+---
+ NEWS    |  4 ++--
+ znew.in | 23 +++++++++++++++++------
+ 2 files changed, 19 insertions(+), 8 deletions(-)
+
+#diff --git a/NEWS b/NEWS
+#index 37325ef..3bcefa2 100644
+#--- a/NEWS
+#+++ b/NEWS
+#@@ -15,8 +15,8 @@ GNU gzip NEWS                                    -*- outline -*-
+#   after decompressing a .Z file.
+#   [bug present since the beginning]
+# 
+#-  On old-fashioned or limited platforms lacking mktemp, gzexe and
+#-  zdiff no longer have a race when creating a temporary file.
+#+  On old-fashioned or limited platforms lacking mktemp, gzexe, zdiff
+#+  and znew no longer have a race when creating a temporary file.
+#   [bug present since the beginning]
+# 
+# 
+#diff --git a/znew.in b/znew.in
+#index 6d4ea2c..40a2f5d 100644
+--- a/znew.in
++++ b/znew.in
+@@ -89,6 +89,8 @@ if test -n "$opt"; then
+   opt="-$opt"
+ fi
+ 
++mktemp_status=
++
+ for i do
+   n=`printf '%s\n' "$i" | sed 's/.Z$//'`
+   if test ! -f "$n.Z" ; then
+@@ -107,7 +109,16 @@ for i do
+     fi
+   else
+     if test $check -eq 1; then
+-      if cp -p "$n.Z" "$n.$$"; then
++      if test -z "$mktemp_status"; then
++        command -v mktemp >/dev/null 2>&1
++        mktemp_status=$?
++      fi
++      if if test $mktemp_status -eq 0; then
++           tmp=`mktemp "$n.XXXXXXXXX"`
++         else
++           tmp=$n.$$
++           (umask 77; set -C; > "$tmp")
++         fi && cp -p "$n.Z" "$tmp"; then
+         :
+       else
+         printf '%s\n' "cannot backup $n.Z"
+@@ -117,7 +128,7 @@ for i do
+     if 'gzip' -d "$n.Z"; then
+       :
+     else
+-      test $check -eq 1 && mv "$n.$$" "$n.Z"
++      test $check -eq 1 && mv "$tmp" "$n.Z"
+       printf '%s\n' "error while uncompressing $n.Z"
+       res=1; continue
+     fi
+@@ -125,7 +136,7 @@ for i do
+       :
+     else
+       if test $check -eq 1; then
+-        mv "$n.$$" "$n.Z" && rm -f "$n"
++        mv "$tmp" "$n.Z" && rm -f "$n"
+         printf '%s\n' "error while recompressing $n"
+       else
+         # compress $n  (might be dangerous if disk full)
+@@ -140,15 +151,15 @@ for i do
+     if test $pipe -eq 1; then
+       rm -f "$n$ext"
+     else
+-      mv "$n.$$" "$n.Z" && rm -f "$n$ext"
++      mv "$tmp" "$n.Z" && rm -f "$n$ext"
+     fi
+     printf '%s\n' "$n.Z smaller than $n$ext -- unchanged"
+ 
+   elif test $check -eq 1; then
+     if 'gzip' -t "$n$ext" ; then
+-      rm -f "$n.$$" "$n.Z"
++      rm -f "$tmp" "$n.Z"
+     else
+-      test $pipe -eq 0 && mv "$n.$$" "$n.Z"
++      test $pipe -eq 0 && mv "$tmp" "$n.Z"
+       rm -f "$n$ext"
+       printf '%s\n' "error while testing $n$ext, $n.Z unchanged"
+       res=1; continue
diff -Nru gzip-1.13/debian/patches/CVE-2026-41992.patch gzip-1.13/debian/patches/CVE-2026-41992.patch
--- gzip-1.13/debian/patches/CVE-2026-41992.patch	1969-12-31 19:00:00.000000000 -0500
+++ gzip-1.13/debian/patches/CVE-2026-41992.patch	2026-08-24 17:59:51.000000000 -0400
@@ -0,0 +1,60 @@
+From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <[email protected]>
+Date: Wed, 15 Apr 2026 12:00:17 -0700
+Subject: gzip: don’t mishandle .lzh after .Z
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Problem reported by Michał Majchrowicz.
+* unlzh.c (read_c_len): Clear left and right when n == 0.
+Origin: upstream, https://cgit.git.savannah.gnu.org/cgit/gzip.git/patch/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
+Bug-Debian: https://bugs.debian.org/1141443
+---
+ NEWS    | 4 ++++
+ THANKS  | 1 +
+ unlzh.c | 6 ++++++
+ 3 files changed, 11 insertions(+)
+
+#diff --git a/NEWS b/NEWS
+#index 45ac0af..c053c57 100644
+#--- a/NEWS
+#+++ b/NEWS
+#@@ -11,6 +11,10 @@ GNU gzip NEWS                                    -*- outline -*-
+#   A use of uninitialized memory on some malformed inputs has been fixed.
+#   [bug present since the beginning]
+# 
+#+  A buffer overflow has been fixed when decompressing an .lzh file
+#+  after decompressing a .Z file.
+#+  [bug present since the beginning]
+#+
+# ** Changes in behavior
+# 
+#   gzip -l now reports "-Inf%" instead of "0.0%" for the infinite
+#diff --git a/THANKS b/THANKS
+#index 4e545d9..a7d25e4 100644
+#--- a/THANKS
+#+++ b/THANKS
+#@@ -187,6 +187,7 @@ Richard Lloyd           [email protected]
+# Mohamed Maatallah	[email protected]
+# David J. MacKenzie	[email protected]
+# John R MacMillan        [email protected]
+#+Michał Majchrowicz	[email protected]
+# Ron Male                [email protected]
+# Jakub Martisko		[email protected]
+# Don R. Maszle           [email protected]
+--- a/unlzh.c
++++ b/unlzh.c
+@@ -239,6 +239,12 @@ read_c_len ()
+         c = getbits(CBIT);
+         for (i = 0; i < NC; i++) c_len[i] = 0;
+         for (i = 0; i < 4096; i++) c_table[i] = c;
++
++        /* Needed in case LEFT and RIGHT are reused from a previous
++           LZW decompression.  It may be overkill to clear all of both
++           arrays, but nobody has had time to analyze this carefully.  */
++        memzero(left, (2 * NC - 1) * sizeof *left);
++        memzero(right, (2 * NC - 1) * sizeof *left);
+     } else {
+         i = 0;
+         while (i < n) {
diff -Nru gzip-1.13/debian/patches/series gzip-1.13/debian/patches/series
--- gzip-1.13/debian/patches/series	2025-01-16 23:18:44.000000000 -0500
+++ gzip-1.13/debian/patches/series	2026-08-24 17:59:51.000000000 -0400
@@ -1,2 +1,5 @@
 gzip_reproducible_build.diff
 disable-Werror.patch
+CVE-2026-41991-a.patch
+CVE-2026-41991-b.patch
+CVE-2026-41992.patch