Permalink
Browse files

Compress-Raw-Zlib: sync with CPAN version 2.075

https://rt.cpan.org/Ticket/Display.html?id=123245 reports a security
vulnerability in versions zlib 1.2.8 thru 1.2.10 of the zlib library.  Zlib is
bundled with Compress-Raw-Zlib, so any vulnerability reappears once
Compress-Raw-Zlib is shipped with Perl 5.  The vulnerability is present in
production releases up to and including perl-5.26.1.

To address this vulnerability, this commit upgrades us to the latest CPAN version.
  • Loading branch information...
Paul Marquess authored and jkeenan committed Nov 14, 2017
1 parent 6623aa6 commit 6b93e4bc22a7c06508c3d2ed4590fe8bc2cb4989
View
@@ -214,7 +214,7 @@ package Maintainers;
},
'Compress::Raw::Zlib' => {
'DISTRIBUTION' => 'PMQS/Compress-Raw-Zlib-2.074.tar.gz',
'DISTRIBUTION' => 'PMQS/Compress-Raw-Zlib-2.075.tar.gz',
'FILES' => q[cpan/Compress-Raw-Zlib],
'EXCLUDED' => [
@@ -180,8 +180,7 @@ typedef di_stream * inflateStream ;
typedef di_stream * Compress__Raw__Zlib__inflateStream ;
typedef di_stream * Compress__Raw__Zlib__inflateScanStream ;
#define ZMALLOC(to, typ) ((to = (typ *)safemalloc(sizeof(typ))), \
Zero(to,1,typ))
#define ZMALLOC(to, typ) (to = (typ *)safecalloc(sizeof(typ), 1))
/* Figure out the Operating System */
#ifdef MSDOS
@@ -506,7 +505,8 @@ DispStream(s, message)
voidpf my_zcalloc (voidpf opaque, unsigned items, unsigned size)
{
PERL_UNUSED_VAR(opaque);
return safemalloc(items * size);
return safecalloc(items, size);
/* return safemalloc(items* size); */
}
@@ -833,6 +833,9 @@ Zip_crc32(buf, crc=crcInitial, offset=0)
#endif
buf = (Byte*)SvPVbyte(sv, len) ;
if (offset > len)
croak("Offset out of range in Compress::Raw::Zlib::crc32");
if (items < 2)
crc = crcInitial;
else if (SvOK(ST(1)))
@@ -1193,6 +1196,7 @@ flush(s, output, f=Z_FINISH)
uLong availableout = NO_INIT
CODE:
bufinc = s->bufsize;
/* retrieve the output buffer */
@@ -19,7 +19,6 @@
BUILD_ZLIB = True
INCLUDE = ./zlib-src
LIB = ./zlib-src
OLD_ZLIB = False
GZIP_OS_CODE = AUTO_DETECT
@@ -10,7 +10,7 @@ use warnings ;
use bytes ;
our ($VERSION, $XS_VERSION, @ISA, @EXPORT, %EXPORT_TAGS, @EXPORT_OK, $AUTOLOAD, %DEFLATE_CONSTANTS, @DEFLATE_CONSTANTS);
$VERSION = '2.074';
$VERSION = '2.075';
$XS_VERSION = $VERSION;
$VERSION = eval $VERSION;
@@ -645,7 +645,7 @@ Compress::Raw::Zlib - Low-Level Interface to zlib compression library
The I<Compress::Raw::Zlib> module provides a Perl interface to the I<zlib>
compression library (see L</AUTHOR> for details about where to get
I<zlib>).
I<zlib>).
=head1 Compress::Raw::Zlib::Deflate
@@ -656,7 +656,7 @@ Here is a definition of the interface available:
=head2 B<($d, $status) = new Compress::Raw::Zlib::Deflate( [OPT] ) >
Initialises a deflation object.
Initialises a deflation object.
If you are familiar with the I<zlib> library, it combines the
features of the I<zlib> functions C<deflateInit>, C<deflateInit2>
@@ -727,7 +727,7 @@ The default is C<Z_DEFAULT_STRATEGY>.
When a dictionary is specified I<Compress::Raw::Zlib> will automatically
call C<deflateSetDictionary> directly after calling C<deflateInit>. The
Adler32 value for the dictionary can be obtained by calling the method
Adler32 value for the dictionary can be obtained by calling the method
C<$d-E<gt>dict_adler()>.
The default is no dictionary.
@@ -775,7 +775,7 @@ Here is an example of using the C<Compress::Raw::Zlib::Deflate> optional
parameter list to override the default buffer size and compression
level. All other options will take their default values.
my $d = new Compress::Raw::Zlib::Deflate ( -Bufsize => 300,
my $d = new Compress::Raw::Zlib::Deflate ( -Bufsize => 300,
-Level => Z_BEST_SPEED ) ;
=head2 B<$status = $d-E<gt>deflate($input, $output)>
@@ -853,7 +853,7 @@ C<Z_DEFAULT_COMPRESSION>.
=item B<-Strategy>
Defines the strategy used to tune the compression. The valid values are
C<Z_DEFAULT_STRATEGY>, C<Z_FILTERED> and C<Z_HUFFMAN_ONLY>.
C<Z_DEFAULT_STRATEGY>, C<Z_FILTERED> and C<Z_HUFFMAN_ONLY>.
=item B<-BufSize>
@@ -878,14 +878,14 @@ Returns the adler32 value for the dictionary.
=head2 B<$d-E<gt>crc32()>
Returns the crc32 value for the uncompressed data to date.
Returns the crc32 value for the uncompressed data to date.
If the C<CRC32> option is not enabled in the constructor for this object,
this method will always return 0;
=head2 B<$d-E<gt>adler32()>
Returns the adler32 value for the uncompressed data to date.
Returns the adler32 value for the uncompressed data to date.
=head2 B<$d-E<gt>msg()>
@@ -902,11 +902,11 @@ Returns the total number of compressed bytes output from deflate.
=head2 B<$d-E<gt>get_Strategy()>
Returns the deflation strategy currently used. Valid values are
C<Z_DEFAULT_STRATEGY>, C<Z_FILTERED> and C<Z_HUFFMAN_ONLY>.
C<Z_DEFAULT_STRATEGY>, C<Z_FILTERED> and C<Z_HUFFMAN_ONLY>.
=head2 B<$d-E<gt>get_Level()>
Returns the compression level being used.
Returns the compression level being used.
=head2 B<$d-E<gt>get_BufSize()>
@@ -954,7 +954,7 @@ Here is a definition of the interface:
=head2 B< ($i, $status) = new Compress::Raw::Zlib::Inflate( [OPT] ) >
Initialises an inflation object.
Initialises an inflation object.
In a list context it returns the inflation object, C<$i>, and the
I<zlib> status code (C<$status>). In a scalar context it returns the
@@ -1049,7 +1049,7 @@ This option defaults to true.
The C<LimitOutput> option changes the behavior of the C<< $i->inflate >>
method so that the amount of memory used by the output buffer can be
limited.
limited.
When C<LimitOutput> is used the size of the output buffer used will either
be the value of the C<Bufsize> option or the amount of memory already
@@ -1082,7 +1082,7 @@ data to C<$output>. The C<$input> and C<$output> parameters can either be
scalars or scalar references.
Returns C<Z_OK> if successful and C<Z_STREAM_END> if the end of the
compressed data has been successfully reached.
compressed data has been successfully reached.
If not successful C<$status> will hold the I<zlib> error code.
@@ -1104,7 +1104,7 @@ this object, the uncompressed data will be appended to C<$output>. If
it is false, C<$output> will be truncated before any uncompressed data
is written to it.
The C<$eof> parameter needs a bit of explanation.
The C<$eof> parameter needs a bit of explanation.
Prior to version 1.2.0, zlib assumed that there was at least one trailing
byte immediately after the compressed data stream when it was carrying out
@@ -1118,7 +1118,7 @@ conditions apply
=over 5
=item 1
=item 1
You are either using a copy of zlib that is older than version 1.2.0 or you
want your application code to be able to run with as many different
@@ -1137,7 +1137,7 @@ There is no data immediately after the compressed data stream.
=back
If B<all> of these are the case, then you need to set the C<$eof> parameter
to true on the final call (and only the final call) to C<$i-E<gt>inflate>.
to true on the final call (and only the final call) to C<$i-E<gt>inflate>.
If you have built this module with zlib >= 1.2.0, the C<$eof> parameter is
ignored. You can still set it if you want, but it won't be used behind the
@@ -1166,7 +1166,7 @@ was created by calling C<Compress::Deflate::flush> with C<Z_FULL_FLUSH>.
This method will reset the inflation object C<$i>. It can be used when you
are uncompressing multiple data streams and want to use the same object to
uncompress each of them.
uncompress each of them.
Returns C<Z_OK> if successful.
@@ -1304,14 +1304,14 @@ Returns the version of the zlib library.
=head2 my $flags = Compress::Raw::Zlib::zlibCompileFlags();
Returns the flags indicating compile-time options that were used to build
Returns the flags indicating compile-time options that were used to build
the zlib library. See the zlib documentation for a description of the flags
returned by C<zlibCompileFlags>.
Note that when the zlib sources are built along with this module the
C<sprintf> flags (bits 24, 25 and 26) should be ignored.
If you are using zlib 1.2.0 or older, C<zlibCompileFlags> will return 0.
If you are using zlib 1.2.0 or older, C<zlibCompileFlags> will return 0.
=head1 The LimitOutput option.
@@ -1345,7 +1345,7 @@ source and uncompressing as you go the code will look something like this
die "inflation failed\n"
unless $status == Z_STREAM_END ;
The points to note are
The points to note are
=over 5
@@ -1377,7 +1377,7 @@ compressed data stream contains the same pattern repeated thousands of
times, a relatively small compressed data stream can uncompress into
hundreds of megabytes. Remember C<inflate> will keep allocating memory
until I<all> the uncompressed data has been written to the output buffer -
the size of C<$output> is unbounded.
the size of C<$output> is unbounded.
The C<LimitOutput> option is designed to help with this use-case.
@@ -1567,7 +1567,7 @@ L<File::GlobMapper|File::GlobMapper>, L<Archive::Zip|Archive::Zip>,
L<Archive::Tar|Archive::Tar>,
L<IO::Zlib|IO::Zlib>
For RFC 1950, 1951 and 1952 see
For RFC 1950, 1951 and 1952 see
L<http://www.faqs.org/rfcs/rfc1950.html>,
L<http://www.faqs.org/rfcs/rfc1951.html> and
L<http://www.faqs.org/rfcs/rfc1952.html>
@@ -1582,7 +1582,7 @@ The primary site for gzip is L<http://www.gzip.org>.
=head1 AUTHOR
This module was written by Paul Marquess, C<pmqs@cpan.org>.
This module was written by Paul Marquess, C<pmqs@cpan.org>.
=head1 MODIFICATION HISTORY
@@ -24,13 +24,13 @@ BEGIN
my $count = 0 ;
if ($] < 5.005) {
$count = 232 ;
$count = 237 ;
}
elsif ($] >= 5.006) {
$count = 320 ;
$count = 325 ;
}
else {
$count = 275 ;
$count = 280 ;
}
plan tests => $count + $extra;
@@ -947,6 +947,33 @@ SKIP:
is $X, "", "no output from second flush";
}
{
title "crc32";
is eval('Compress::Raw::Zlib::crc32("A" x 0x100, 0, 0x100); 0x1234'), 0x1234;
is $@, '';
is eval('Compress::Raw::Zlib::crc32("A" x 0x100, 0, 0x101); 0x1234'), undef;
like $@, mkErr("^Offset out of range in Compress::Raw::Zlib::crc32") ;
}
if (0)
{
title "RT #122695: sync flush appending extra empty uncompressed block";
my $hello = "I am a HAL 9000 computer" ;
my ($err, $x, $X, $status);
ok( ($x, $err) = new Compress::Raw::Zlib::Deflate ( ), "Create deflate object" );
isa_ok $x, "Compress::Raw::Zlib::deflateStream" ;
cmp_ok $err, '==', Z_OK, "status is Z_OK" ;
cmp_ok $x->flush($X, Z_SYNC_FLUSH), '==', Z_OK, "flush returned Z_OK" ;
cmp_ok $x->flush($X, Z_SYNC_FLUSH), '==', Z_OK, "second flush returned Z_OK" ;
is $X, "", "no output from second flush";
}
exit if $] < 5.006 ;
title 'Looping Append test with substr output - substr the end of the string';
@@ -1,17 +1,15 @@
/* adler32.c -- compute the Adler-32 checksum of a data stream
* Copyright (C) 1995-2011 Mark Adler
* Copyright (C) 1995-2011, 2016 Mark Adler
* For conditions of distribution and use, see copyright notice in zlib.h
*/
/* @(#) $Id$ */
#include "zutil.h"
#define local static
local uLong adler32_combine_ OF((uLong adler1, uLong adler2, z_off64_t len2));
#define BASE 65521 /* largest prime smaller than 65536 */
#define BASE 65521U /* largest prime smaller than 65536 */
#define NMAX 5552
/* NMAX is the largest n such that 255n(n+1)/2 + (n+1)(BASE-1) <= 2^32-1 */
@@ -62,10 +60,10 @@ local uLong adler32_combine_ OF((uLong adler1, uLong adler2, z_off64_t len2));
#endif
/* ========================================================================= */
uLong ZEXPORT adler32(
uLong ZEXPORT adler32_z(
uLong adler,
const Bytef *buf,
uInt len)
z_size_t len)
{
unsigned long sum2;
unsigned n;
@@ -132,6 +130,15 @@ uLong ZEXPORT adler32(
return adler | (sum2 << 16);
}
/* ========================================================================= */
uLong ZEXPORT adler32(
uLong adler,
const Bytef *buf,
uInt len)
{
return adler32_z(adler, buf, len);
}
/* ========================================================================= */
local uLong adler32_combine_(
uLong adler1,
@@ -156,7 +163,7 @@ local uLong adler32_combine_(
sum2 += ((adler1 >> 16) & 0xffff) + ((adler2 >> 16) & 0xffff) + BASE - rem;
if (sum1 >= BASE) sum1 -= BASE;
if (sum1 >= BASE) sum1 -= BASE;
if (sum2 >= (BASE << 1)) sum2 -= (BASE << 1);
if (sum2 >= ((unsigned long)BASE << 1)) sum2 -= ((unsigned long)BASE << 1);
if (sum2 >= BASE) sum2 -= BASE;
return sum1 | (sum2 << 16);
}
Oops, something went wrong.

0 comments on commit 6b93e4b

Please sign in to comment.