libarchive: merge from vendor branchLibarchive 3.7.7Security fixes: #2158 rpm: calculate huge header sizes correctly #2160 util: fix out of boundary access in mktemp functions #2168 uu: stop p
libarchive: merge from vendor branchLibarchive 3.7.7Security fixes: #2158 rpm: calculate huge header sizes correctly #2160 util: fix out of boundary access in mktemp functions #2168 uu: stop processing if lines are too long #2174 lzop: prevent integer overflow #2172 rar4: protect copy_from_lzss_window_to_unp() (CVE-2024-20696) #2175 unzip: unify EOF handling #2179 rar4: fix out of boundary access with large files #2203 rar4: fix OOB access with unicode filenames #2210 rar4: add boundary checks to rgb filter #2248 rar4: fix OOB in delta filter #2249 rar4: fix OOB in audio filter #2256 fix multiple vulnerabilities identified by SAST #2258 cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing #2265 rar5: clear 'data ready' cache on window buffer reallocs #2269 rar4: fix CVE-2024-26256 (CVE-2024-26256) #2330 iso: be more cautious about parsing ISO-9660 timestamps #2343 tar: clean up linkpath between entries #2364 tar: don't crash on truncated tar archives #2366 gzip: prevent a hang when processing a malformed gzip inside a gzip #2377 tar: fix two leaks in tar header parsingImportant bugfixes: #2096 rar5: report encrypted entries #2150 xar: fix another infinite loop and expat error handling #2173 shar: check strdup return value #2161 lha: fix integer truncation on 32-bit systems #2338 tar: fix memory leaks when processing symlinks or parsing pax headers #2245 7zip: fix issue when skipping first file in 7zip archive that is a multiple of 65536 bytes #2252 7-zip: read/write symlink paths as UTF-8 #2259 rar5: don't try to read rediculously long names #2290 ar: fix archive entries having no type #2360 tar: fix truncation of entry pathnames in specific archivesCVE: CVE-2024-20696, CVE-2024-26256(cherry picked from commit bd66c1b43e33540205dbc1187c2f2a15c58b57ba)
show more ...
Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Update/fix Makefile.depend for userland
libarchive: import changes from upstreamLibarchive 3.6.0New features:PR #1614: tar: new option "--no-read-sparse"PR #1503: RAR reader: filter supportPR #1585: RAR5 reader: self-extracting arch
libarchive: import changes from upstreamLibarchive 3.6.0New features:PR #1614: tar: new option "--no-read-sparse"PR #1503: RAR reader: filter supportPR #1585: RAR5 reader: self-extracting archive supportNew features (not used in FreeBSD base):PR #1567: tar: threads support for zstd (#1567)PR #1518: ZIP reader: zstd decompression supportSecurity Fixes:PR #1491, #1492, #1493, CVE-2021-36976: fix invalid memory access and out of bounds read in RAR5 readerPR #1566, #1618, CVE-2021-31566: extended fix for following symlinks when processing the fixup listOther notable bugfixes and improvements:PR #1620: tar: respect "--ignore-zeros" in c, r and u modesPR #1625: reduced size of application binariesMFC after: 2 weeksRelnotes: yes
bsdcat,cpio,tar: derive version string from archive.hReviewed by: mmMFC after: 2 weeksDifferential Revision: https://reviews.freebsd.org/D27823
bsdcat,cpio,tar: Bump version number to 3.5.1Matches import of libarchive 3.5.1
MFV r368207:Update libarchive to 3.5.0Relevant vendor changes: Issue #1258: add archive_read_support_filter_by_code() PR #1347: mtree digest reader support Issue #1381: skip hardlinks pointi
MFV r368207:Update libarchive to 3.5.0Relevant vendor changes: Issue #1258: add archive_read_support_filter_by_code() PR #1347: mtree digest reader support Issue #1381: skip hardlinks pointing to itself on extraction PR #1387: fix writing of cpio archives with hardlinks without file type PR #1388: fix rdev field in cpio format for device nodes PR #1389: completed support for UTF-8 encoding conversion PR #1405: more formats in archive_read_support_format_by_code() PR #1408: fix uninitialized size in rar5_read_data PR #1409: system extended attribute support PR #1435: support for decompression of symbolic links in zipx archives Issue #1456: memory leak after unsuccessful archive_write_open_filenameMFC after: 1 week
MFV r361280:Update libarchive to 3.4.3Relevant vendor changes: PR #1352: support negative zstd compression levels PR #1359: improve zstd version checking PR #1348: support RHT.security.selin
MFV r361280:Update libarchive to 3.4.3Relevant vendor changes: PR #1352: support negative zstd compression levels PR #1359: improve zstd version checking PR #1348: support RHT.security.selinux from GNU tar PR #1357: support for archives compressed with pzstd PR #1367: fix issues in acl tests PR #1372: child handling cleanup PR #1378: fix memory leak from passphrase callback
MFV r357783:Update libarchive to 3.4.2Relevant vendor changes: PR #1289: atomic extraction support (bsdtar -x --safe-writes) PR #1308: big endian fix for UTF16 support in LHA reader PR #1326
MFV r357783:Update libarchive to 3.4.2Relevant vendor changes: PR #1289: atomic extraction support (bsdtar -x --safe-writes) PR #1308: big endian fix for UTF16 support in LHA reader PR #1326: reject RAR5 files that declare invalid header flags Issue #987: fix support 7z archive entries with Delta filter Issue #1317: fix compression output buffer handling in XAR writer Issue #1319: fix uname or gname longer than 32 characters in pax writer Issue #1325: fix use after free when archiving hardlinks in ISO9660 or XAR Use localtime_r() and gmtime_r() instead of localtime() and gmtime()X-MFC-With: r356212,r356365,r356416MFC after: 1 week
MFV r356163,r356197:Update libarchive to 3.4.1Relevant vendor changes since last update: Issue #351: Refactor and implement private state logic for write filters PR #1252: RAR5 reader - verify
MFV r356163,r356197:Update libarchive to 3.4.1Relevant vendor changes since last update: Issue #351: Refactor and implement private state logic for write filters PR #1252: RAR5 reader - verify window size for solid files (OSS-Fuzz 15482) PR #1255: zip writer - don't append unused NUL for directories PR #1260: Fix sparse file offset overflow on 32-bit systems PR #1263: UNICODE filename support for reading lha/lzh format Issue #1276: Bugfix and optimize archive_wstring_append_from_mbs() PR #1288: Add the "xattrhdr" option to pax write options PR #1295: 7z reader - fix reading archives with digests in PackInfo PR #1296: RAR5 reader - verify window size for multivolume archives PR #1297: ZIP reader - support LZMA_STREAM_END marker in 'lzma alone' files Issue #1298: Fix a heap-buffer-overflow in archive_string_append_from_wcs() OSS-Fuzz 19360, 19362: LHA reader - plug two memory leaks on error Fix possible off-by-one when dealing with readlink(2)MFC after: 2 weeks
There is no SMALLER define anymore hereStop defining SMALLER. Since we replaced cpio with libarchive version,there's no options to make it smaller. Also, the comment about theFreeBSD installer is
There is no SMALLER define anymore hereStop defining SMALLER. Since we replaced cpio with libarchive version,there's no options to make it smaller. Also, the comment about theFreeBSD installer is obsolete. Remove them both.
MFV r348971,r348977:Sync libarchive with vendor.Relevant vendor changes: - check_symlinks_fsobj() without chdir() and fchdir() - bsdtar.1 manpage fixes - patches from OpenBSD to libarchive_f
MFV r348971,r348977:Sync libarchive with vendor.Relevant vendor changes: - check_symlinks_fsobj() without chdir() and fchdir() - bsdtar.1 manpage fixes - patches from OpenBSD to libarchive_fe/passphrase.c - version bumped to 3.4.0MFC after: 2 weeks
MFV r338519:Update libarchive to 3.3.3As all important changes have already been merged from libarchive gitthis is just version number bump, documentation update and somepolishing for cpio tests
MFV r338519:Update libarchive to 3.3.3As all important changes have already been merged from libarchive gitthis is just version number bump, documentation update and somepolishing for cpio tests. Other source code changes are not relevant toFreeBSD.Approved by: re (gjb)MFC after: 1 week
DIRDEPS_BUILD: Update dependencies.Sponsored by: Dell EMC Isilon
MFV r324145,324147:Sync libarchive with vendor.Relevant vendor changes: PR #905: Support for Zstandard read and write filters PR #922: Avoid overflow when reading corrupt cpio archive Issue
MFV r324145,324147:Sync libarchive with vendor.Relevant vendor changes: PR #905: Support for Zstandard read and write filters PR #922: Avoid overflow when reading corrupt cpio archive Issue #935: heap-based buffer overflow in xml_data (CVE-2017-14166) OSS-Fuzz 2936: Place a limit on the mtree line length OSS-Fuzz 2394: Ensure that the ZIP AES extension header is large enough OSS-Fuzz 573: Read off-by-one error in RAR archives (CVE-2017-14502)MFC after: 1 weekSecurity: CVE-2017-14166, CVE-2017-14502
Add HAS_TESTS to all Makefiles that are currently using the`SUBDIR.${MK_TESTS}+= tests` idiom.This is a follow up to r321912.
Convert traditional ${MK_TESTS} conditional idiom for including testdirectories to SUBDIR.${MK_TESTS} idiomThis is being done to pave the way for future work (and homogenity) in^/projects/make-ch
Convert traditional ${MK_TESTS} conditional idiom for including testdirectories to SUBDIR.${MK_TESTS} idiomThis is being done to pave the way for future work (and homogenity) in^/projects/make-check-sandbox .No functional change intended.MFC after: 1 weeks
MFV r320924:Bump libarchive to 3.3.2Vendor changes: PR #901: don't depend on stdin in a testcaseMFC after: 1 week
MFV r315633, 315635:Sync libarchive with vendorVendor changes/bugfixes (FreeBSD-related): PR 867 (bsdcpio): show numeric uid/gid when names are not found PR 870 (seekable zip): accept files w
MFV r315633, 315635:Sync libarchive with vendorVendor changes/bugfixes (FreeBSD-related): PR 867 (bsdcpio): show numeric uid/gid when names are not found PR 870 (seekable zip): accept files with valid ZIP64 EOCD headers PR 880 (pax): Fix handling of "size" pax header keyword PR 887 (crypto): Discard 3072 bytes instead of 1024 of first keystream OSS-Fuzz issue 806 (mtree): rework mtree_atol10 integer parser Break ACL read/write code into platform-specific source files Unbreak static dependency on libbz2MFC after: 1 week
Adopt SRCTOP in usr.binPrefer ${SRCTOP}/foo over ${.CURDIR}/../../foo and ${SRCTOP}/usr.bin/fooover ${.CURDIR}/../foo for paths in Makefiles.Differential Revision: https://reviews.freebsd.org/D9
Adopt SRCTOP in usr.binPrefer ${SRCTOP}/foo over ${.CURDIR}/../../foo and ${SRCTOP}/usr.bin/fooover ${.CURDIR}/../foo for paths in Makefiles.Differential Revision: https://reviews.freebsd.org/D9932Sponsored by: NetflixSilence on: arch@ (twice)
MFV r314565,314567,314570:Update libarchive to version 3.3.1 (and sync with latest vendor dist)Notable vendor changes: PR #501: improvements in ACL path handling PR #724: fix hang when reading
MFV r314565,314567,314570:Update libarchive to version 3.3.1 (and sync with latest vendor dist)Notable vendor changes: PR #501: improvements in ACL path handling PR #724: fix hang when reading malformed cpio files PR #864: fix out of bounds read with malformed GNU tar archives Documentation, style, test suite improvements and typo fixes.New options to bsdtar that enable or disable reading and/or writing of: Access Control Lists (--acls, --no-acls) Extended file flags (--fflags, --no-fflags) Extended attributes (--xattrs, --no-xattrs) Mac OS X metadata (Mac OS X only) (--mac-metadata, --no-mac-metadata)MFC after: 2 weeks
MFV r307859:Update libarchive to 3.2.2
MFV r302003,r302037,r302038,r302056:Update libarchive to 3.2.1 (bugfix and security fix release)List of vendor fixes:- fix exploitable heap overflow vulnerability in Rar decompression (vendor
MFV r302003,r302037,r302038,r302056:Update libarchive to 3.2.1 (bugfix and security fix release)List of vendor fixes:- fix exploitable heap overflow vulnerability in Rar decompression (vendor issue 719, CVE-2016-4302, TALOS-2016-0154)- fix exploitable stack based buffer overflow vulnebarility in mtree parse_device functionality (vendor PR 715, CVE-2016-4301, TALOS-2016-0153)- fix exploitable heap overflow vulnerability in 7-zip read_SubStreamsInfo (vendor issue 718, CVE-2016-4300, TALOS-2016-152)- fix integer overflow when computing location of volume descriptor (vendor issue 717)- fix buffer overflow when reading a crafred rar archive (vendor issue 521)- fix possible buffer overflow when reading ISO9660 archives on machines where sizeof(int) < sizeof(size_t) (vendor issue 711)- tar and cpio should fail if an input file named on the command line is missing (vendor issue 708)- fix incorrect writing of gnutar filenames that are exactly 512 bytes long (vendor issue 682)- allow tests to be run from paths that are equal or longer than 128 characters (vendor issue 657)- add memory allocation errors in archive_entry_xattr.c (vendor PR 603)- remove dead code in archive_entry_xattr_add_entry() (vendor PR 716)- fix broken decryption of ZIP files (vendor issue 553)- manpage style, typo and description fixesPost-3.2.1 vendor fixes:- fix typo in cpio version reporting (Vendor PR 725, 726)- fix argument range of ctype functions in libarchive_fe/passphrase.c- fix ctype use and avoid empty loop bodies in WARC readerMFC after: 1 weekSecurity: CVE-2016-4300, CVE-2016-4301, CVE-2016-4302Approved by: re (kib)
MFV r299425:Update libarchive to 3.2.0New features:- new bsdcat command-line utility- LZ4 compression (in src only via external utility from ports)- Warc format support- 'Raw' format writer-
MFV r299425:Update libarchive to 3.2.0New features:- new bsdcat command-line utility- LZ4 compression (in src only via external utility from ports)- Warc format support- 'Raw' format writer- Zip: Support archives >4GB, entries >4GB- Zip: Support encrypting and decrypting entries- Zip: Support experimental streaming extension- Identify encrypted entries in several formats- New --clear-nochange-flags option to bsdtar tries to remove noschg and similar flags before deleting files- New --ignore-zeros option to bsdtar to handle concatenated tar archives- Use multi-threaded LZMA decompression if liblzma supports it- Expose version info for libraries used by libarchivePatched files (fixed compiler warnings):contrib/libarchive/cat/bsdcat.c (vendor PR #702)contrib/libarchive/cat/bsdcat.h (vendor PR #702)contrib/libarchive/libarchive/archive_read_support_format_mtree.c (PR #701)contrib/libarchive/libarchive_fe/err.c (vendor PR #703)MFC after: 1 monthRelnotes: yes
Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installedafter r298107Summary of changes:- Replace all instances of FILES/TESTS with ${PACKAGE}FILES. This ensures that na
Merge ^/user/ngie/release-pkg-fix-tests to unbreak how test files are installedafter r298107Summary of changes:- Replace all instances of FILES/TESTS with ${PACKAGE}FILES. This ensures that namespacing is kept with FILES appropriately, and that this shouldn't need to be repeated if the namespace changes -- only the definition of PACKAGE needs to be changed- Allow PACKAGE to be overridden by callers instead of forcing it to always be `tests`. In the event we get to the point where things can be split up enough in the base system, it would make more sense to group the tests with the blocks they're a part of, e.g. byacc with byacc-tests, etc- Remove PACKAGE definitions where possible, i.e. where FILES wasn't used previously.- Remove unnecessary TESTSPACKAGE definitions; this has been elided into bsd.tests.mk- Remove unnecessary BINDIRs used previously with ${PACKAGE}FILES; ${PACKAGE}FILESDIR is now automatically defined in bsd.test.mk.- Fix installation of files under data/ subdirectories in lib/libc/tests/hash and lib/libc/tests/net/getaddrinfo- Remove unnecessary .include <bsd.own.mk>s (some opportunistic cleanup)Document the proposed changes in share/examples/tests/tests/... via examplesso it's clear that ${PACKAGES}FILES is the suggested way forward in terms ofreplacing FILES. share/mk/bsd.README didn't seem like the appropriate methodof communicating that info.MFC after: never probablyX-MFC with: r298107PR: 209114Relnotes: yesTested with: buildworld, installworld, checkworld; buildworld, packageworldSponsored by: EMC / Isilon Storage Division
1234