Uses outdated mspack with security problems

[Norbert Preining]

Dear all,

src/calibre/utils/lzx contains an old version of mspack that is affected by some security bugs (see https://security-tracker.debian.org/tracker/source-package/libmspack). It would be nice if calibre could use updates mspack files and optionally allow for linking against the system mspack library to make security team's work more easy.

Thanks for consideration

Norbert

[Kovid Goyal (kovid)]

It's on my TODO list.

However, I have injured my wrist, so i am staying away from
excessive keyboarding for a while. In the meantime you are welcome to
send a PR with patches against the calibre copy to fix the known bugs.

[Kovid Goyal (kovid)]

Fixed in branch master. The fix will be in the next release. calibre is usually released every alternate Friday.

 status fixreleased

[Norbert Preining (preining)]

Hi Kovid,

thanks for the quick fix. I have myself made a shot at building against system libmspack and want to try out whether it worked. Building did work. Do you have a sample book where this extension is necessary?

Thanks

Norbert

[Kovid Goyal (kovid)]

It is used for both LIT input and LIT output. Simply convert any file to
LIT and then convert it back.