CVS commit: pkgsrc/archivers/gzip

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Sun Aug 23 18:46:56 UTC 2026

Modified Files:
        pkgsrc/archivers/gzip: Makefile distinfo
Added Files:
        pkgsrc/archivers/gzip/patches: patch-lib_utimens.h patch-unlzh.c

Log Message:
gzip: update to 1.14nb1.

Based on wip/gzip by drixter@ and myself.

Add patch for CVE-2026-41992, thus bump to nb1 immediately.

* Noteworthy changes in release 1.14 (2025-04-09) [stable]

** Bug fixes
  'gzip -d' no longer omits the last partial output buffer when the
  input ends unexpectedly on an IBM Z platform.
  [bug introduced in gzip-1.11]
  'gzip -l' no longer misreports lengths of multimember inputs.
  [bug introduced in gzip-1.12]
  'gzip -S' now rejects suffixes containing '/'.
  [bug present since the beginning]

** Changes in behavior
  The GZIP environment variable is now silently ignored except for the
  options -1 (--fast) through -9 (--best), --rsyncable, and --synchronous.
  This brings gzip into line with more-cautious compressors like zstd
  that limit environment variables' effect to relatively innocuous
  performance issues.  You can continue to use scripts to specify
  whatever gzip options you like.
  'zmore' is no longer installed on platforms lacking 'more'.

** Performance improvements
  gzip now decompresses significantly faster by computing CRCs via a
  slice by 8 algorithm, and faster yet on x86-64 platforms that
  support pclmul instructions.

* Noteworthy changes in release 1.13 (2023-08-19) [stable]

** Changes in behavior
  zless now diagnoses gzip failures, if using less 623 or later.
  When SIGPIPE is ignored, gzip now exits with status 2 (warning)
  instead of status 1 (error) when writing to a broken pipe.  This is
  more useful with programs like 'less' that treat gzip exit status 2
  as a non-failure.

** Bug fixes
  'gzip -d' no longer fails to report invalid compressed data
  that uses a dictionary distance outside the input window.
  [bug present since the beginning]
  Port to C23, which does not allow K&R-style function definitions
  with parameters, and which does not define __alignas_is_defined.


To generate a diff of this commit:
cvs rdiff -u -r1.39 -r1.40 pkgsrc/archivers/gzip/Makefile
cvs rdiff -u -r1.13 -r1.14 pkgsrc/archivers/gzip/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/archivers/gzip/patches/patch-lib_utimens.h \
    pkgsrc/archivers/gzip/patches/patch-unlzh.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/archivers/gzip/Makefile
diff -u pkgsrc/archivers/gzip/Makefile:1.39 pkgsrc/archivers/gzip/Makefile:1.40
--- pkgsrc/archivers/gzip/Makefile:1.39 Mon Jan 27 19:12:38 2025
+++ pkgsrc/archivers/gzip/Makefile      Sun Aug 23 18:46:55 2026
@@ -1,13 +1,14 @@
-# $NetBSD: Makefile,v 1.39 2025/01/27 19:12:38 rillig Exp $
+# $NetBSD: Makefile,v 1.40 2026/08/23 18:46:55 wiz Exp $
 
-DISTNAME=      gzip-1.12
+DISTNAME=      gzip-1.14
+PKGREVISION=   1
 CATEGORIES=    archivers
+# does not provide uncompressed tarball, needed due to bootstrapping
 #MASTER_SITES= ${MASTER_SITE_GNU:=gzip/}
 MASTER_SITES=  ${MASTER_SITE_LOCAL}
-#EXTRACT_SUFX= .tar.xz
 EXTRACT_SUFX=  .tar
 
-MAINTAINER=    pkgsrc-users%NetBSD.org@localhost
+MAINTAINER=    drixter%e-utp.net@localhost
 HOMEPAGE=      https://www.gnu.org/software/gzip/gzip.html
 COMMENT=       Compress or expand files
 LICENSE=       gnu-gpl-v3

Index: pkgsrc/archivers/gzip/distinfo
diff -u pkgsrc/archivers/gzip/distinfo:1.13 pkgsrc/archivers/gzip/distinfo:1.14
--- pkgsrc/archivers/gzip/distinfo:1.13 Fri Apr  8 06:24:00 2022
+++ pkgsrc/archivers/gzip/distinfo      Sun Aug 23 18:46:55 2026
@@ -1,5 +1,7 @@
-$NetBSD: distinfo,v 1.13 2022/04/08 06:24:00 wiz Exp $
+$NetBSD: distinfo,v 1.14 2026/08/23 18:46:55 wiz Exp $
 
-BLAKE2s (gzip-1.12.tar) = 1edddfdf2946083367ef0295fb2c8d191a6ddc5777f6a2c48629bd25ad8b6033
-SHA512 (gzip-1.12.tar) = 79a54c63c3442061f3e47de7bdd5bfee2d2d40d1f09b8eabbbabe96295f9eb8fc2e0dd580f6bad528fd0e7e336f6e759ddf52863c0f0da733d1a184e57fde90f
-Size (gzip-1.12.tar) = 6041600 bytes
+BLAKE2s (gzip-1.14.tar) = 85d37d51b9935221ed7121beec44ea6be4ec6b658e11e714c60fe634969514b5
+SHA512 (gzip-1.14.tar) = a2a18dd06695bfcdfc8a2c229f6a4880a1f1287f98bc381aefd07951f9e8d15ce7608b0e4acaa9748431e1fb12710f4ba8bb719c83fcd8d6e449607bb3c04d6d
+Size (gzip-1.14.tar) = 6594560 bytes
+SHA1 (patch-lib_utimens.h) = fba5ec8e9fcb87642247a68ee6a4568a00d4f413
+SHA1 (patch-unlzh.c) = f9c44260e71e60e439045219500c499cbfbc43b5

Added files:

Index: pkgsrc/archivers/gzip/patches/patch-lib_utimens.h
diff -u /dev/null pkgsrc/archivers/gzip/patches/patch-lib_utimens.h:1.1
--- /dev/null   Sun Aug 23 18:46:56 2026
+++ pkgsrc/archivers/gzip/patches/patch-lib_utimens.h   Sun Aug 23 18:46:55 2026
@@ -0,0 +1,19 @@
+$NetBSD: patch-lib_utimens.h,v 1.1 2026/08/23 18:46:55 wiz Exp $
+
+* lib/utimens.h [HAVE_UTIMENS || HAVE_LUTIMENS]: Include <sys/stat.h>
+instead of <sys/time.h> for the declarations of these functions on
+NetBSD.
+
+https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81231
+
+--- lib/utimens.h.orig 2026-06-14 18:08:28.940590875 +0000
++++ lib/utimens.h
+@@ -25,7 +25,7 @@
+ #include <time.h>
+ 
+ #if HAVE_UTIMENS || HAVE_LUTIMENS
+-# include <sys/time.h>
++# include <sys/stat.h>
+ #endif
+ 
+ #ifdef __cplusplus
Index: pkgsrc/archivers/gzip/patches/patch-unlzh.c
diff -u /dev/null pkgsrc/archivers/gzip/patches/patch-unlzh.c:1.1
--- /dev/null   Sun Aug 23 18:46:56 2026
+++ pkgsrc/archivers/gzip/patches/patch-unlzh.c Sun Aug 23 18:46:55 2026
@@ -0,0 +1,20 @@
+$NetBSD: patch-unlzh.c,v 1.1 2026/08/23 18:46:55 wiz Exp $
+
+CVE-2026-41992 gzip 1.14 out-of-bounds memory buffer access
+https://www.openwall.com/lists/oss-security/2026/08/23/1
+
+--- unlzh.c.orig       2024-08-09 22:06:03.000000000 +0000
++++ unlzh.c
+@@ -307,6 +307,12 @@ huf_decode_start ()
+ static void
+ huf_decode_start ()
+ {
++    /* Needed in case LEFT and RIGHT are reused from a previous
++       LZW decompression.  It may be overkill to clear all of both
++       arrays, but nobody has had time to analyze this carefully.  */
++    memzero (left, (2 * NC - 1) * sizeof *left);
++    memzero (right, (2 * NC - 1) * sizeof *right);
++
+     init_getbits();  blocksize = 0;
+ }
+