CVS commit: pkgsrc/archivers/xz

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu Sep 10 07:11:01 UTC 2026

Modified Files:
        pkgsrc/archivers/xz: Makefile distinfo

Log Message:
xz: updated to 5.8.4

5.8.4 (2026-09-09)

IMPORTANT: This includes a fix for a security issue that affects all
XZ Utils versions since 5.0.0. This and a few other fixes have also
been committed to the old stable branches (v5.2, v5.4, and v5.6) in
the xz Git repository. Those fixes are marked below. No new 5.2.x,
5.4.x, or 5.6.x releases will be made.

* liblzma:

    - lzma_alone_decoder(), lzma_lzip_decoder(),
      lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
      invalid memory access after memory allocation has failed and
      the application reinitializes the existing decoder to decode
      a different file. This bug could at least result in a crash.
      This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
      (Also in v5.2, v5.4, and v5.6.)

    - lzma_stream_buffer_decode(): Fix wrong error code and,
      in debug builds, assertion failure. LZMA_BUF_ERROR could
      be returned with truncated inputs while LZMA_DATA_ERROR
      is the correct one in this function.
      (Also in v5.2, v5.4, and v5.6.)

    - Fix a performance issue in the typical use case of
      lzma_index_cat(). Internally liblzma calls it from
      lzma_file_info_decoder(), so that was affected too. The
      problem occurred if the input .xz file was created by
      concatenating a large number of .xz files. A crafted file
      could make "xz --list" very slow or effectively hang.
      Normal decompression doesn't use these functions and
      thus wasn't affected.
      (Also in v5.2, v5.4, and v5.6.)

    - Fix a theoretical integer overflow in lzma_index_cat().
      (Also in v5.2, v5.4, and v5.6.)

    - Fix bogus memory usage report in lzma_index_decoder() when
      the .xz Index is obviously invalid. A huge bogus value could
      cause an integer overflow in lzma_file_info_decoder()'s
      memory usage reporting due to a missing overflow check,
      making lzma_memused() report an incorrect tiny value. This
      bug didn't affect the memory usage limiter in these two
      decoders; only the reporting via lzma_memused() was affected.
      (Also in v5.2, v5.4, and v5.6.)

    - Fix a too low memory usage report in lzma_index_decoder()
      if lzma_memused() is called after a part of the Index has
      already been decoded. The typical use case is to call
      lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
      which did work correctly.

    - Fix copying of check type in lzma_index_dup(). Calling
      lzma_index_checks() on the duplicated lzma_index returned
      return garbage a result. lzma_index_dup() is rarely used;
      liblzma doesn't use it internally and xz itself doesn't use
      it either.
      (Also in v5.2, v5.4, and v5.6.)

    - lzma_file_info_decoder() and lzma_index_decoder(): Reject
      an obviously-invalid Number of Records field earlier.
      (Partially also in v5.2, v5.4, and v5.6.)

    - Fix a missing synchronization in the threaded .xz decoder. It
      could make lzma_get_progress() return incorrect progress info.
      (Also in v5.4 and v5.6.)

    - Detect certain kinds of corrupt inputs slightly earlier in
      the LZMA2 decoder.

    - ARM64 and LoongArch: Don't use aligned reads on unaligned
      buffers. This makes the code work on strict-align processors
      and fixes a sanitizer error in other cases. (Since 5.7.1alpha)

* xz:

    - Fix a use-after-free when showing an error message if --files
      or --files0 was specified in the environment variables XZ_OPT
      or XZ_DEFAULTS.
      (Also in v5.2, v5.4, and v5.6.)

    - Fix a use-after-free bug when --verbose is used and
      standard error isn't a terminal. (Since 5.7.1alpha)

    - Make it an error if the totals in "xz --list" exceed the range
      of 64-bit integers.
      (Also in v5.2, v5.4, and v5.6.)

* xz and xzdec on Linux:

    - Add support for Landlock ABI version 9.

    - Use fallback macros for Landlock ABI version 2, 3, and 5
      (but not 4) if <linux/landlock.h> is older than ABI version 5.
      This makes the binary slightly more protected if it is run on
      a kernel that supports newer ABIs than <linux/landlock.h>.

* Scripts:

    - xzgrep: Fix handling of the ' char at the end of a command
      line option. For example, the following tricked xzgrep to
      run "id": xzgrep "-e'" "-e;id;'" somefile
      (Also in v5.2, v5.4, and v5.6.)

    - xzdiff: Use the C locale (LC_ALL=C) with "sed" and "expr"
      to ensure safe behavior with invalid multibyte sequences.
      An equivalent improvement was made in xzgrep in 5.2.6
      (2022-08-12), but it was forgotten from xzdiff.
      (Also in v5.2, v5.4, and v5.6.)

* Tests:

    - Improve a few tests and fuzz targets.

    - Add new test files:
        * bad-0-index-1.xz (32 bytes)
        * bad-1-index-huge-uncomp.xz (72 bytes)

* Man pages:

    - Improve the rendering with OpenBSD's mandoc(1).

    - Reduce indentation of the tables to avoid overlong lines
      in translated versions of the xz man page.

* Translations:

    - In translated man pages, workaround an issue with non-ASCII
      characters in tables.

    - Fix syntax errors in a few man page translations.

    - Update Arabic and German man page translations.

    - Update Brazilian Portuguese, Croatian, Dutch, German, Italian,
      Korean, Polish, Portuguese, Romanian, and Ukrainian message
      translations.


To generate a diff of this commit:
cvs rdiff -u -r1.57 -r1.58 pkgsrc/archivers/xz/Makefile
cvs rdiff -u -r1.43 -r1.44 pkgsrc/archivers/xz/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/archivers/xz/Makefile
diff -u pkgsrc/archivers/xz/Makefile:1.57 pkgsrc/archivers/xz/Makefile:1.58
--- pkgsrc/archivers/xz/Makefile:1.57   Tue Mar 31 19:16:09 2026
+++ pkgsrc/archivers/xz/Makefile        Thu Sep 10 07:11:01 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.57 2026/03/31 19:16:09 wiz Exp $
+# $NetBSD: Makefile,v 1.58 2026/09/10 07:11:01 adam Exp $
 
-DISTNAME=      xz-5.8.3
+DISTNAME=      xz-5.8.4
 CATEGORIES=    archivers
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=tukaani-project/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}

Index: pkgsrc/archivers/xz/distinfo
diff -u pkgsrc/archivers/xz/distinfo:1.43 pkgsrc/archivers/xz/distinfo:1.44
--- pkgsrc/archivers/xz/distinfo:1.43   Tue Mar 31 19:16:09 2026
+++ pkgsrc/archivers/xz/distinfo        Thu Sep 10 07:11:01 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.43 2026/03/31 19:16:09 wiz Exp $
+$NetBSD: distinfo,v 1.44 2026/09/10 07:11:01 adam Exp $
 
-BLAKE2s (xz-5.8.3.tar.bz2) = c7a28b97929d5f617b1ff283338295e424e83738f6c980f28b0d2b511079adcc
-SHA512 (xz-5.8.3.tar.bz2) = 4111da87631b8d3bd49d19ef6fc7afa0d71ec7194b34b372c123a45d1308324ddbfbf6c9d64d0cb8bb1334cd1ec54ca4108822cef0a9205b0221793f773e15c5
-Size (xz-5.8.3.tar.bz2) = 2028831 bytes
+BLAKE2s (xz-5.8.4.tar.bz2) = b14dc4df8b8754bd5bac9cd373a8b30856545804b9af238f11a1140ef7edbcbc
+SHA512 (xz-5.8.4.tar.bz2) = 99710bf7d9790dc7b71c85f77f40d58a490c9a1552509d53d5d190d09987b9f0161ce9ea6aa63bd9d207fd7f030c329310774e1838df490a1a5932c7b3d886e1
+Size (xz-5.8.4.tar.bz2) = 2061621 bytes
 SHA1 (patch-src_xz_Makefile.in) = b9360c7b2b34159028fb8b84339aa2faf3922287