Please merge unzip 5.52-11 (main) from Debian unstable (main)

Bug #239686 reported by Thierry Carrez
4
Affects Status Importance Assigned to Milestone
unzip (Ubuntu)
Fix Released
Wishlist
Unassigned

Bug Description

Binary package hint: unzip

Please merge unzip 5.52-11 (main) from Debian unstable (main).

CVE References

Thierry Carrez (ttx)
Changed in unzip:
assignee: nobody → tcarrez
status: New → In Progress
Revision history for this message
Thierry Carrez (ttx) wrote :

Debian -> Ubuntu debdiff

CVE-2008-0888 patch was included in Debian release.

Only remaining deltas are :
 * debian/rules: Configure with large file support
 * support UTF-8 file names
 * unzip.c: Change banner to indicate Ubuntu modification

Revision history for this message
Thierry Carrez (ttx) wrote :

old Ubuntu -> New Ubuntu debdiff

Those are exactly the same, minus the changelog entry.

Changed in unzip:
assignee: tcarrez → nobody
status: In Progress → Confirmed
Revision history for this message
Thierry Carrez (ttx) wrote :

Forwarding remaining patches to Debian/upstream :
* support UTF-8 file names
  * upstream is aware of the problem but has it's own solution (AppNote extension to the ZIP standard) to be included in 6.0
     See https://bugzilla.redhat.com/show_bug.cgi?id=225576#c25
  * Debian has bug 339021 about the problem
* Configure with large file support
  * Was apparently lost in Debian at some point, filed Debian bug 486100 to suggest them to reenable it.

Revision history for this message
Thierry Carrez (ttx) wrote :

Hold on --
In fact large file support was added in Debian version a long time ago and the subsequent Ubuntu merges missed it.

Debian uses :
 CFLAGS = -g -Wall $$(getconf LFS_CFLAGS)
 DEFINES = -DACORN_FTYPE_NFS -DWILD_STOP_AT_DIR

While we use :
 CFLAGS = -g -Wall $$(getconf LFS_CFLAGS)
 DEFINES = -DACORN_FTYPE_NFS -DWILD_STOP_AT_DIR -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64

which is probably redundant (the getconf LFS_CFLAGS should define -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64).

I'll clean up the merge.

Changed in unzip:
status: Confirmed → Incomplete
Revision history for this message
Thierry Carrez (ttx) wrote :

Debian -> Ubuntu debdiff

CVE-2008-0888 patch was included in Debian release.
Configure for large file support was included in debian (since 5.52-9) using a slightly different way (getconf LFS_CFLAGS instead of the defines). I tested builds with a >2gb zip file and it unzipped alright.

Only remaining deltas are :
 * support UTF-8 file names
 * unzip.c: Change banner to indicate Ubuntu modification

Revision history for this message
Thierry Carrez (ttx) wrote :

old Ubuntu -> New Ubuntu debdiff

I had to reverse our large file support patch, otherwise it's clean.

Thierry Carrez (ttx)
Changed in unzip:
status: Incomplete → Confirmed
Revision history for this message
Daniel Holbach (dholbach) wrote : Sponsor Request

Evan: can you please take a look at it?

Thierry Carrez (ttx)
Changed in unzip:
importance: Undecided → Wishlist
Revision history for this message
Bryce Harrington (bryce) wrote :

Oh sorry, I did this one already earlier.

Changed in unzip:
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.