rpms/gzip
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git gzip-1.12-2.el9_8

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-08-31 12:04:58 -04:00
parent 5091f428f1
commit 342579d254
4 changed files with 108 additions and 191 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
SOURCES/CVE-2026-41991.patch Normal file
View File

@ -0,0 +1,54 @@
From 4e6f8b24ab823146ab8776f0b7fe486ab34d4269 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Thu, 16 Apr 2026 12:11:44 -0700
Subject: gzexe: use -C if lacking mktemp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
(Problem reported by Michał Majchrowicz.)
* gzexe.in: If mktemp is needed but not installed,
use ‘set -C’ to avoid a race when creating a temporary file.
* zdiff.in: Use the same pattern here, even though the old
code was probably OK anyway.
---
NEWS | 5 +++++
gzexe.in | 1 +
zdiff.in | 7 +++----
3 files changed, 9 insertions(+), 4 deletions(-)
diff --git a/gzexe.in b/gzexe.in
index ea4ef94..f3d46cc 100644
--- a/gzexe.in
+++ b/gzexe.in
@@ -127,6 +127,7 @@ for i do
tmp=`mktemp "${dir}gzexeXXXXXXXXX"`
else
tmp=${dir}gzexe$$
+ (umask 77; set -C; > "$tmp")
fi && { cp -p "$file" "$tmp" 2>/dev/null || cp "$file" "$tmp"; } || {
res=$?
printf >&2 '%s\n' "$0: cannot copy $file"
diff --git a/zdiff.in b/zdiff.in
index 289e466..53266df 100644
--- a/zdiff.in
+++ b/zdiff.in
@@ -156,12 +156,11 @@ case $file2 in
*) TMPDIR=/tmp/;;
esac
if type mktemp >/dev/null 2>&1; then
- tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"` ||
- exit 2
+ tmp=`mktemp "${TMPDIR}zdiffXXXXXXXXX"`
else
- set -C
tmp=${TMPDIR}zdiff$$
- fi
+ (umask 77; set -C; > "$tmp")
+ fi &&
'gzip' -cdfq -- "$file2" > "$tmp" || exit 2
gzip_status=$(
exec 4>&1
--
cgit v1.2.3

36
SOURCES/CVE-2026-41992.patch Normal file
View File

@ -0,0 +1,36 @@
From 63dbf6b3b9e6e781df1a6a64e609b10e23969681 Mon Sep 17 00:00:00 2001
From: Paul Eggert <eggert@cs.ucla.edu>
Date: Wed, 15 Apr 2026 12:00:17 -0700
Subject: gzip: don’t mishandle .lzh after .Z
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Michał Majchrowicz.
* unlzh.c (read_c_len): Clear left and right when n == 0.
---
NEWS | 4 ++++
THANKS | 1 +
unlzh.c | 6 ++++++
3 files changed, 11 insertions(+)
diff --git a/unlzh.c b/unlzh.c
index 2522764..c3e92ff 100644
--- a/unlzh.c
+++ b/unlzh.c
@@ -313,6 +307,12 @@ decode_p ()
local void huf_decode_start()
{
+ /* Needed in case LEFT and RIGHT are reused from a previous
+ LZW decompression. It may be overkill to clear all of both
+ arrays, but nobody has had time to analyze this carefully. */
+ memzero (left, (2 * NC - 1) * sizeof *left);
+ memzero (right, (2 * NC - 1) * sizeof *right);
+
init_getbits(); blocksize = 0;
}
--
cgit v1.3

189
SOURCES/gnulib.patch
View File

@ -1,189 +0,0 @@
From 1831628c0630ae96a43586b2a25ca51cbdba3e53 Mon Sep 17 00:00:00 2001
From: Paul Eggert <address@hidden>
Date: Mon, 5 Mar 2018 10:56:29 -0800
Subject: [PATCH] fflush: adjust to glibc 2.28 libio.h removal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Problem reported by Daniel P. Berrangé in:
https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
* lib/fbufmode.c (fbufmode):
* lib/fflush.c (clear_ungetc_buffer_preserving_position)
(disable_seek_optimization, rpl_fflush):
* lib/fpending.c (__fpending):
* lib/fpurge.c (fpurge):
* lib/freadable.c (freadable):
* lib/freadahead.c (freadahead):
* lib/freading.c (freading):
* lib/freadptr.c (freadptr):
* lib/freadseek.c (freadptrinc):
* lib/fseeko.c (fseeko):
* lib/fseterr.c (fseterr):
* lib/fwritable.c (fwritable):
* lib/fwriting.c (fwriting):
Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
* lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
Define if not already defined.
---
ChangeLog | 23 +++++++++++++++++++++++
lib/fbufmode.c | 2 +-
lib/fflush.c | 6 +++---
lib/fpending.c | 2 +-
lib/fpurge.c | 2 +-
lib/freadable.c | 2 +-
lib/freadahead.c | 2 +-
lib/freading.c | 2 +-
lib/freadptr.c | 2 +-
lib/freadseek.c | 2 +-
lib/fseeko.c | 4 ++--
lib/fseterr.c | 2 +-
lib/fwritable.c | 2 +-
lib/fwriting.c | 2 +-
lib/stdio-impl.h | 6 ++++++
15 files changed, 45 insertions(+), 16 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 667f91663..beb835670 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,26 @@
+2018-03-05 Paul Eggert <address@hidden>
+
+ fflush: adjust to glibc 2.28 libio.h removal
+ Problem reported by Daniel P. Berrangé in:
+ https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
+ * lib/fbufmode.c (fbufmode):
+ * lib/fflush.c (clear_ungetc_buffer_preserving_position)
+ (disable_seek_optimization, rpl_fflush):
+ * lib/fpending.c (__fpending):
+ * lib/fpurge.c (fpurge):
+ * lib/freadable.c (freadable):
+ * lib/freadahead.c (freadahead):
+ * lib/freading.c (freading):
+ * lib/freadptr.c (freadptr):
+ * lib/freadseek.c (freadptrinc):
+ * lib/fseeko.c (fseeko):
+ * lib/fseterr.c (fseterr):
+ * lib/fwritable.c (fwritable):
+ * lib/fwriting.c (fwriting):
+ Check _IO_EOF_SEEN instead of _IO_ftrylockfile.
+ * lib/stdio-impl.h (_IO_IN_BACKUP) [_IO_EOF_SEEN]:
+ Define if not already defined.
+
2018-01-07 Jim Meyering <meyering@fb.com>
version 1.9
* NEWS: Record release date.
diff --git a/lib/fflush.c b/lib/fflush.c
index 983ade0ff..a6edfa105 100644
--- a/lib/fflush.c
+++ b/lib/fflush.c
@@ -33,7 +33,7 @@
#undef fflush
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
/* Clear the stream's ungetc buffer, preserving the value of ftello (fp). */
static void
@@ -72,7 +72,7 @@ clear_ungetc_buffer (FILE *fp)
#endif
-#if ! (defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
+#if ! (defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */)
# if (defined __sferror || defined __DragonFly__ || defined __ANDROID__) && defined __SNPT
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
@@ -148,7 +148,7 @@ rpl_fflush (FILE *stream)
if (stream == NULL || ! freading (stream))
return fflush (stream);
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
clear_ungetc_buffer_preserving_position (stream);
diff --git a/lib/fpurge.c b/lib/fpurge.c
index b1d417c7a..3aedcc373 100644
--- a/lib/fpurge.c
+++ b/lib/fpurge.c
@@ -62,7 +62,7 @@ fpurge (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_IO_read_end = fp->_IO_read_ptr;
fp->_IO_write_ptr = fp->_IO_write_base;
/* Avoid memory leak when there is an active ungetc buffer. */
diff --git a/lib/freading.c b/lib/freading.c
index 73c28acdd..c24d0c88a 100644
--- a/lib/freading.c
+++ b/lib/freading.c
@@ -31,7 +31,7 @@ freading (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-# if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+# if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
return ((fp->_flags & _IO_NO_WRITES) != 0
|| ((fp->_flags & (_IO_NO_READS | _IO_CURRENTLY_PUTTING)) == 0
&& fp->_IO_read_base != NULL));
diff --git a/lib/fseeko.c b/lib/fseeko.c
index 0101ab55f..193f4e8ce 100644
--- a/lib/fseeko.c
+++ b/lib/fseeko.c
@@ -47,7 +47,7 @@ fseeko (FILE *fp, off_t offset, int whence)
#endif
/* These tests are based on fpurge.c. */
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
if (fp->_IO_read_end == fp->_IO_read_ptr
&& fp->_IO_write_ptr == fp->_IO_write_base
&& fp->_IO_save_base == NULL)
@@ -123,7 +123,7 @@ fseeko (FILE *fp, off_t offset, int whence)
return -1;
}
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_flags &= ~_IO_EOF_SEEN;
fp->_offset = pos;
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
diff --git a/lib/fseterr.c b/lib/fseterr.c
index 82649c3ac..adb637256 100644
--- a/lib/fseterr.c
+++ b/lib/fseterr.c
@@ -29,7 +29,7 @@ fseterr (FILE *fp)
/* Most systems provide FILE as a struct and the necessary bitmask in
<stdio.h>, because they need it for implementing getc() and putc() as
fast macros. */
-#if defined _IO_ftrylockfile || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
+#if defined _IO_EOF_SEEN || __GNU_LIBRARY__ == 1 /* GNU libc, BeOS, Haiku, Linux libc5 */
fp->_flags |= _IO_ERR_SEEN;
#elif defined __sferror || defined __DragonFly__ || defined __ANDROID__
/* FreeBSD, NetBSD, OpenBSD, DragonFly, Mac OS X, Cygwin, Minix 3, Android */
diff --git a/lib/stdio-impl.h b/lib/stdio-impl.h
index 78d896e9f..05c5752a2 100644
--- a/lib/stdio-impl.h
+++ b/lib/stdio-impl.h
@@ -18,6 +18,12 @@
the same implementation of stdio extension API, except that some fields
have different naming conventions, or their access requires some casts. */
+/* Glibc 2.28 made _IO_IN_BACKUP private. For now, work around this
+ problem by defining it ourselves. FIXME: Do not rely on glibc
+ internals. */
+#if !defined _IO_IN_BACKUP && defined _IO_EOF_SEEN
+# define _IO_IN_BACKUP 0x100
+#endif
/* BSD stdio derived implementations. */
--
2.14.3

20
SPECS/gzip.spec
View File

@ -1,7 +1,7 @@
Summary: The GNU data compression program
Name: gzip
Version: 1.12
Release: 1%{?dist}
Release: 2%{?dist}
# info pages are under GFDL license
License: GPLv3+ and GFDL
Source0: http://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
@ -11,8 +11,16 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt
Source100: colorzgrep.csh
Source101: colorzgrep.sh
Patch1: gnulib.patch
#Patch1: gnulib.patch
Patch2: gzexe.patch
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
Patch3: CVE-2026-41991.patch
# Regarding the following two links:
# The second one reverts the first one and then applies the changes,
# since the first one is not being used here, the reverting part has been removed
#https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
#http://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d
Patch4: CVE-2026-41992.patch
# Fixed in upstream code.
# http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
@ -42,6 +50,8 @@ very commonly used data compression program.
%setup -q
#%patch1 -p1 -b .gnulib
%patch2 -p1 -b .gzexe
%patch3 -p1
%patch4 -p1
cp %{SOURCE1} .
autoreconf
@ -90,6 +100,12 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
%{profiledir}/*
%changelog
* Fri Aug 14 2026 Jakub Martisko <jamartis@redhat.com> - 1.12-2
- Fix an issue with a temporary file creations when mktemp is missing (41991)
- Fix a global buffer overflow vulnerability in the LZH decompression logic (41992)
Resolves: CVE-2026-41991
Resolves: CVE-2026-41992
* Fri Apr 22 2022 Jakub Martisko <jamartis@redhat.com> - 1.12-1
- Rebase to gzip 1.12
- Resolves an arbitrary-file-write vulnerability in zgrep