commit 202dfa5

unzip: Update to 6.0-29

 1@@ -0,0 +1,30 @@
 2+From 705923de022bad2ce0142ccbab68aa57ebe36db1 Mon Sep 17 00:00:00 2001
 3+From: Mark Adler <madler@alumni.caltech.edu>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] Fix bug in UZbunzip2() that incorrectly updated G.incnt
 6+
 7+    Fix bug in UZbunzip2() that incorrectly updated G.incnt.
 8+
 9+    The update assumed a full buffer, which is not always full. This
10+    could result in a false overlapped element detection when a small
11+    bzip2-compressed file was unzipped. This commit remedies that.
12+---
13+ extract.c | 2 +-
14+ 1 file changed, 1 insertion(+), 1 deletion(-)
15+
16+diff --git a/extract.c b/extract.c
17+index ad5daac..6712ed0 100644
18+--- a/extract.c
19++++ b/extract.c
20+@@ -3052,7 +3052,7 @@ __GDEF
21+ #endif
22+ 
23+     G.inptr = (uch *)bstrm.next_in;
24+-    G.incnt = (G.inbuf + INBUFSIZ) - G.inptr;  /* reset for other routines */
25++    G.incnt -= G.inptr - G.inbuf;       /* reset for other routines */
26+ 
27+ uzbunzip_cleanup_exit:
28+     err = BZ2_bzDecompressEnd(&bstrm);
29+-- 
30+2.45.2
31+

 1@@ -0,0 +1,31 @@
 2+From a07b1c0bb82b6dc0f8f224894e49eb9b44a076db Mon Sep 17 00:00:00 2001
 3+From: Mark Adler <madler@alumni.caltech.edu>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] Fix bug in UZinflate() that incorrectly updated G.incnt.
 6+
 7+    Fix bug in UZinflate() that incorrectly updated G.incnt.
 8+
 9+    The update assumed a full buffer, which is not always full. This
10+    could result in a false overlapped element detection when a small
11+    deflate-compressed file was unzipped using an old zlib. This
12+    commit remedies that.
13+---
14+ inflate.c | 2 +-
15+ 1 file changed, 1 insertion(+), 1 deletion(-)
16+
17+diff --git a/inflate.c b/inflate.c
18+index f2f6864..2c37999 100644
19+--- a/inflate.c
20++++ b/inflate.c
21+@@ -700,7 +700,7 @@ int UZinflate(__G__ is_defl64)
22+       G.dstrm.total_out));
23+ 
24+     G.inptr = (uch *)G.dstrm.next_in;
25+-    G.incnt = (G.inbuf + INBUFSIZ) - G.inptr;  /* reset for other routines */
26++    G.incnt -= G.inptr - G.inbuf;       /* reset for other routines */
27+ 
28+ uzinflate_cleanup_exit:
29+     err = inflateReset(&G.dstrm);
30+-- 
31+2.45.2
32+

 1@@ -0,0 +1,24 @@
 2+From 765b05298e4959bea8a77295704c9461fa9218d1 Mon Sep 17 00:00:00 2001
 3+From: Kevin Locke <kevin@kevinlocke.name>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] zipgrep: Avoid test errors when no members present
 6+
 7+---
 8+ unix/zipgrep | 1 +
 9+ 1 file changed, 1 insertion(+)
10+
11+diff --git a/unix/zipgrep b/unix/zipgrep
12+index 69cd6ba..b9d2316 100755
13+--- a/unix/zipgrep
14++++ b/unix/zipgrep
15+@@ -44,6 +44,7 @@ if test -n "$opt"; then
16+   opt="-$opt"
17+ fi
18+ 
19++sts=0
20+ status_grep_global=1
21+ IFS='
22+ '
23+-- 
24+2.45.2
25+

  1@@ -0,0 +1,185 @@
  2+From 7c5862de85894d5387c855b5df6e5509c97f5bdf Mon Sep 17 00:00:00 2001
  3+From: "Steven M. Schweda" <sms@antinode.info>
  4+Date: Mon, 28 Apr 2025 12:57:34 -0700
  5+Subject: [PATCH] Fix for CVE-2022-0529 and CVE-2022-0530
  6+
  7+---
  8+ fileio.c  | 34 +++++++++++++++++++++++++---------
  9+ process.c | 55 ++++++++++++++++++++++++++++++++++++++++++++-----------
 10+ 2 files changed, 69 insertions(+), 20 deletions(-)
 11+
 12+diff --git a/fileio.c b/fileio.c
 13+index 6290824..50a74fc 100644
 14+--- a/fileio.c
 15++++ b/fileio.c
 16+@@ -171,8 +171,10 @@ static ZCONST char Far ReadError[] = "error:  zipfile read error\n";
 17+ static ZCONST char Far FilenameTooLongTrunc[] =
 18+   "warning:  filename too long--truncating.\n";
 19+ #ifdef UNICODE_SUPPORT
 20++   static ZCONST char Far UFilenameCorrupt[] =
 21++     "error: Unicode filename corrupt.\n";
 22+    static ZCONST char Far UFilenameTooLongTrunc[] =
 23+-     "warning:  Converted unicode filename too long--truncating.\n";
 24++     "warning:  Converted Unicode filename too long--truncating.\n";
 25+ #endif
 26+ static ZCONST char Far ExtraFieldTooLong[] =
 27+   "warning:  extra field too long (%d).  Ignoring...\n";
 28+@@ -2361,16 +2363,30 @@ int do_string(__G__ length, option)   /* return PK-type error code */
 29+                   /* convert UTF-8 to local character set */
 30+                   fn = utf8_to_local_string(G.unipath_filename,
 31+                                             G.unicode_escape_all);
 32+-                  /* make sure filename is short enough */
 33+-                  if (strlen(fn) >= FILNAMSIZ) {
 34+-                    fn[FILNAMSIZ - 1] = '\0';
 35++
 36++                  /* 2022-07-22 SMS, et al.  CVE-2022-0530
 37++                   * Detect conversion failure, emit message.
 38++                   * Continue with unconverted name.
 39++                   */
 40++                  if (fn == NULL)
 41++                  {
 42+                     Info(slide, 0x401, ((char *)slide,
 43+-                      LoadFarString(UFilenameTooLongTrunc)));
 44+-                    error = PK_WARN;
 45++                     LoadFarString(UFilenameCorrupt)));
 46++                    error = PK_ERR;
 47++                  }
 48++                  else
 49++                  {
 50++                    /* make sure filename is short enough */
 51++                    if (strlen(fn) >= FILNAMSIZ) {
 52++                      fn[FILNAMSIZ - 1] = '\0';
 53++                      Info(slide, 0x401, ((char *)slide,
 54++                        LoadFarString(UFilenameTooLongTrunc)));
 55++                      error = PK_WARN;
 56++                    }
 57++                    /* replace filename with converted UTF-8 */
 58++                    strcpy(G.filename, fn);
 59++                    free(fn);
 60+                   }
 61+-                  /* replace filename with converted UTF-8 */
 62+-                  strcpy(G.filename, fn);
 63+-                  free(fn);
 64+                 }
 65+ # endif /* UNICODE_WCHAR */
 66+                 if (G.unipath_filename != G.filename_full)
 67+diff --git a/process.c b/process.c
 68+index d2a846e..a7d5b87 100644
 69+--- a/process.c
 70++++ b/process.c
 71+@@ -222,6 +222,8 @@ static ZCONST char Far ZipfileCommTrunc1[] =
 72+      "\nwarning:  Unicode Path version > 1\n";
 73+    static ZCONST char Far UnicodeMismatchError[] =
 74+      "\nwarning:  Unicode Path checksum invalid\n";
 75++   static ZCONST char Far UFilenameTooLongTrunc[] =
 76++     "warning:  filename too long (P1) -- truncating.\n";
 77+ #endif
 78+ 
 79+ 
 80+@@ -1915,7 +1917,7 @@ int getZip64Data(__G__ ef_buf, ef_len)
 81+     Sets both local header and central header fields.  Not terribly clever,
 82+     but it means that this procedure is only called in one place.
 83+ 
 84+-    2014-12-05 SMS.
 85++    2014-12-05 SMS.  (oCERT.org report.)  CVE-2014-8141.
 86+     Added checks to ensure that enough data are available before calling
 87+     makeint64() or makelong().  Replaced various sizeof() values with
 88+     simple ("4" or "8") constants.  (The Zip64 structures do not depend
 89+@@ -1947,9 +1949,10 @@ int getZip64Data(__G__ ef_buf, ef_len)
 90+               ef_len - EB_HEADSIZE));
 91+             break;
 92+         }
 93++
 94+         if (eb_id == EF_PKSZ64)
 95+         {
 96+-          int offset = EB_HEADSIZE;
 97++          unsigned offset = EB_HEADSIZE;
 98+ 
 99+           if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
100+           {
101+@@ -2046,7 +2049,7 @@ int getUnicodeData(__G__ ef_buf, ef_len)
102+         }
103+         if (eb_id == EF_UNIPATH) {
104+ 
105+-          int offset = EB_HEADSIZE;
106++          unsigned offset = EB_HEADSIZE;
107+           ush ULen = eb_len - 5;
108+           ulg chksum = CRCVAL_INITIAL;
109+ 
110+@@ -2504,16 +2507,17 @@ char *wide_to_local_string(wide_string, escape_all)
111+   int state_dependent;
112+   int wsize = 0;
113+   int max_bytes = MB_CUR_MAX;
114+-  char buf[9];
115++  char buf[ MB_CUR_MAX+ 1];             /* ("+1" not really needed?) */
116+   char *buffer = NULL;
117+   char *local_string = NULL;
118++  size_t buffer_size;                   /* CVE-2022-0529 */
119+ 
120+   for (wsize = 0; wide_string[wsize]; wsize++) ;
121+ 
122+   if (max_bytes < MAX_ESCAPE_BYTES)
123+     max_bytes = MAX_ESCAPE_BYTES;
124+-
125+-  if ((buffer = (char *)malloc(wsize * max_bytes + 1)) == NULL) {
126++  buffer_size = wsize * max_bytes + 1;          /* Reused below. */
127++  if ((buffer = (char *)malloc( buffer_size)) == NULL) {
128+     return NULL;
129+   }
130+ 
131+@@ -2551,8 +2555,28 @@ char *wide_to_local_string(wide_string, escape_all)
132+     } else {
133+       /* no MB for this wide */
134+         /* use escape for wide character */
135+-        char *escape_string = wide_to_escape_string(wide_string[i]);
136+-        strcat(buffer, escape_string);
137++        size_t buffer_len;
138++        size_t escape_string_len;
139++        char *escape_string;
140++        int err_msg = 0;
141++
142++        escape_string = wide_to_escape_string(wide_string[i]);
143++        buffer_len = strlen( buffer);
144++        escape_string_len = strlen( escape_string);
145++
146++        /* Append escape string, as space allows. */
147++        /* 2022-07-18 SMS, et al.  CVE-2022-0529 */
148++        if (escape_string_len > buffer_size- buffer_len- 1)
149++        {
150++            escape_string_len = buffer_size- buffer_len- 1;
151++            if (err_msg == 0)
152++            {
153++                err_msg = 1;
154++                Info(slide, 0x401, ((char *)slide,
155++                 LoadFarString( UFilenameTooLongTrunc)));
156++            }
157++        }
158++        strncat( buffer, escape_string, escape_string_len);
159+         free(escape_string);
160+     }
161+   }
162+@@ -2604,9 +2628,18 @@ char *utf8_to_local_string(utf8_string, escape_all)
163+   ZCONST char *utf8_string;
164+   int escape_all;
165+ {
166+-  zwchar *wide = utf8_to_wide_string(utf8_string);
167+-  char *loc = wide_to_local_string(wide, escape_all);
168+-  free(wide);
169++  zwchar *wide;
170++  char *loc = NULL;
171++
172++  wide = utf8_to_wide_string( utf8_string);
173++
174++  /* 2022-07-25 SMS, et al.  CVE-2022-0530 */
175++  if (wide != NULL)
176++  {
177++    loc = wide_to_local_string( wide, escape_all);
178++    free( wide);
179++  }
180++
181+   return loc;
182+ }
183+ 
184+-- 
185+2.45.2
186+

 1@@ -0,0 +1,26 @@
 2+From 94b2d0b50a3a231ef91319e8e633b7ea62f0e2db Mon Sep 17 00:00:00 2001
 3+From: Roy Tam <roytam@gmail.com>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] Handle Microsoft ZIP64 files by ignoring invalid "Total
 6+ number of disks" field
 7+
 8+---
 9+ process.c | 2 +-
10+ 1 file changed, 1 insertion(+), 1 deletion(-)
11+
12+diff --git a/process.c b/process.c
13+index a7d5b87..b385f1e 100644
14+--- a/process.c
15++++ b/process.c
16+@@ -1281,7 +1281,7 @@ static int find_ecrec64(__G__ searchlen)         /* return PK-class error */
17+     fprintf(stdout,"\nnumber of disks (ECR) %u, (ECLOC64) %lu\n",
18+             G.ecrec.number_this_disk, ecloc64_total_disks); fflush(stdout);
19+ #endif
20+-    if ((G.ecrec.number_this_disk != 0xFFFF) &&
21++    if ((G.ecrec.number_this_disk != 0xFFFF) && ecloc64_total_disks &&
22+         (G.ecrec.number_this_disk != ecloc64_total_disks - 1)) {
23+       /* Note: For some unknown reason, the developers at PKWARE decided to
24+          store the "zip64 total disks" value as a counter starting from 1,
25+-- 
26+2.45.2
27+

 1@@ -0,0 +1,25 @@
 2+From 7fb1835d3ec1654edd2b1b88575cc9eedb1b0f03 Mon Sep 17 00:00:00 2001
 3+From: Santiago Vila <sanvila@debian.org>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] Drop conflicting declarations of gmtime() and localtime()
 6+
 7+---
 8+ unix/unxcfg.h | 2 +-
 9+ 1 file changed, 1 insertion(+), 1 deletion(-)
10+
11+diff --git a/unix/unxcfg.h b/unix/unxcfg.h
12+index c98c3b9..a3ad576 100644
13+--- a/unix/unxcfg.h
14++++ b/unix/unxcfg.h
15+@@ -118,7 +118,7 @@ typedef struct stat z_stat;
16+ #  endif
17+ #else
18+ #  include <time.h>
19+-   struct tm *gmtime(), *localtime();
20++/*   struct tm *gmtime(), *localtime(); */
21+ #endif
22+ 
23+ #if (defined(BSD4_4) || (defined(SYSV) && defined(MODERN)))
24+-- 
25+2.45.2
26+

 1@@ -0,0 +1,27 @@
 2+From 39d270017e54c35683eab58de5059eda6d697c97 Mon Sep 17 00:00:00 2001
 3+From: Vincent Lefevre <vincent@vinc17.net>
 4+Date: Mon, 28 Apr 2025 12:57:34 -0700
 5+Subject: [PATCH] Do not escape shell-special characters in "pat"
 6+
 7+---
 8+ unix/zipgrep | 4 ----
 9+ 1 file changed, 4 deletions(-)
10+
11+diff --git a/unix/zipgrep b/unix/zipgrep
12+index b9d2316..3ac7612 100755
13+--- a/unix/zipgrep
14++++ b/unix/zipgrep
15+@@ -49,10 +49,6 @@ status_grep_global=1
16+ IFS='
17+ '
18+ 
19+-# Escape shell-special characters in "pat".
20+-pat=` echo "$pat" | \
21+- sed -e 's/\\\\/\\\\\\\\/g' -e 's/|/\\\|/g' -e 's/&/\\\&/g' `
22+-
23+ # Use "unzip -Z1" to get a listing of the specified members from the
24+ # specified archive.  Escape any backslashes in a file name.
25+ for i in `unzip -Z1 "$zipfile" ${1+"$@"} | sed -e 's/\\\\/\\\\\\\\/g' `; do
26+-- 
27+2.45.2
28+

1@@ -1 +1 @@
2-6.0-25 r0
3+6.0-29 r0