xz.git - XZ Utils

Age	Commit message (Collapse)	Author	Files	Lines
2022-03-29	xzgrep: Fix escaping of malicious filenames (ZDI-CAN-16587).	Lasse Collin	1	-8/+12
	Malicious filenames can make xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. xzgrep from XZ Utils versions up to and including 5.2.5 are affected. 5.3.1alpha and 5.3.2alpha are affected as well. This patch works for all of them. This bug was inherited from gzip's zgrep. gzip 1.12 includes a fix for zgrep. The issue with the old sed script is that with multiple newlines, the N-command will read the second line of input, then the s-commands will be skipped because it's not the end of the file yet, then a new sed cycle starts and the pattern space is printed and emptied. So only the last line or two get escaped. One way to fix this would be to read all lines into the pattern space first. However, the included fix is even simpler: All lines except the last line get a backslash appended at the end. To ensure that shell command substitution doesn't eat a possible trailing newline, a colon is appended to the filename before escaping. The colon is later used to separate the filename from the grep output so it is fine to add it here instead of a few lines later. The old code also wasn't POSIX compliant as it used \n in the replacement section of the s-command. Using \<newline> is the POSIX compatible method. LC_ALL=C was added to the two critical sed commands. POSIX sed manual recommends it when using sed to manipulate pathnames because in other locales invalid multibyte sequences might cause issues with some sed implementations. In case of GNU sed, these particular sed scripts wouldn't have such problems but some other scripts could have, see: info '(sed)Locale Considerations' This vulnerability was discovered by: cleemy desu wayo working with Trend Micro Zero Day Initiative Thanks to Jim Meyering and Paul Eggert discussing the different ways to fix this and for coordinating the patch release schedule with gzip.
2021-11-13	xzgrep: use `grep -E/-F` instead of `egrep` and `fgrep`	Ville Skyttä	1	-2/+2
	`egrep` and `fgrep` have been deprecated in GNU grep since 2007, and in current post 3.7 Git they have been made to emit obsolescence warnings: https://git.savannah.gnu.org/cgit/grep.git/commit/?id=a9515624709865d480e3142fd959bccd1c9372d1
2021-01-11	Scripts: Fix exit status of xzgrep.	Lasse Collin	1	-7/+13
	Omit the -q option from xz, gzip, and bzip2. With xz this shouldn't matter. With gzip it's important because -q makes gzip replace SIGPIPE with exit status 2. With bzip2 it's important because with -q bzip2 is completely silent if input is corrupt while other decompressors still give an error message. Avoiding exit status 2 from gzip is important because bzip2 uses exit status 2 to indicate corrupt input. Before this commit xzgrep didn't recognize corrupt .bz2 files because xzgrep was treating exit status 2 as SIGPIPE for gzip compatibility. zstd still needs -q because otherwise it is noisy in normal operation. The code to detect real SIGPIPE didn't check if the exit status was due to a signal (>= 128) and so could ignore some other exit status too.
2020-12-05	Scripts: Add zstd support to xzgrep.	Adam Borowski	1	-0/+1
	Thanks to Adam Borowski.
2019-09-24	Scripts: Put /usr/xpg4/bin to the beginning of PATH on Solaris.	Lasse Collin	1	-0/+1
	This adds a configure option --enable-path-for-scripts=PREFIX which defaults to empty except on Solaris it is /usr/xpg4/bin to make POSIX grep and others available. The Solaris case had been documented in INSTALL with a manual fix but it's better to do this automatically since it is needed on most Solaris systems anyway. Thanks to Daniel Richard G.
2019-05-11	spelling	Antoine Cœur	1	-1/+1

2014-10-09	xzgrep: Avoid passing both -q and -l to grep.	Lasse Collin	1	-2/+4
	The behavior of grep -ql varies: - GNU grep behaves like grep -q. - OpenBSD grep behaves like grep -l. POSIX doesn't make it 100 % clear what behavior is expected. Anyway, using both -q and -l at the same time makes no sense so both options simply should never be used at the same time. Thanks to Christian Weisgerber.
2014-06-11	xzgrep: exit 0 when at least one file matches.	Lasse Collin	1	-2/+13
	Mimic the original grep behavior and return exit_success when at least one xz compressed file matches given pattern. Original bugreport: https://bugzilla.redhat.com/show_bug.cgi?id=1108085 Thanks to Pavel Raiskup for the patch.
2013-04-05	xzgrep: make the '-h' option to be --no-filename equivalent	Jeff Bastian	1	-1/+1
	* src/scripts/xzgrep.in: Accept the '-h' option in argument parsing.
2012-02-22	Fix exit status of xzgrep when grepping binary files.	Lasse Collin	1	-1/+2
	When grepping binary files, grep may exit before it has read all the input. In this case, gzip -q returns 2 (eating SIGPIPE), but xz and bzip2 show SIGPIPE as the exit status (e.g. 141). This causes wrong exit status when grepping xz- or bzip2-compressed binary files. The fix checks for the special exit status that indicates SIGPIPE. It uses kill -l which should be supported everywhere since it is in both SUSv2 (1997) and POSIX.1-2008. Thanks to James Buren for the bug report.
2011-04-18	xzgrep: fix typo in $0 parsing	Martin Väth	1	-2/+2
	Reported-by: Diego Elio Pettenò <flameeyes@gentoo.org> Signed-off-by: Martin Väth <vaeth@mathematik.uni-wuerzburg.de> Signed-off-by: Mike Frysinger <vapier@gentoo.org>
2011-03-24	Scripts: Better fix for xzgrep.	Lasse Collin	1	-2/+6
	Now it uses "grep -q". Thanks to Gregory Margo.
2011-03-24	Scripts: Fix xzgrep -l.	Lasse Collin	1	-2/+2
	It didn't work at all. It tried to use the -q option for grep, but it appended it after "--". This works around it by redirecting to /dev/null. The downside is that this can be slower with big files compared to proper use of "grep -q". Thanks to Gregory Margo.
2011-03-19	Scripts: Add lzop (.lzo) support to xzdiff and xzgrep.	Lasse Collin	1	-2/+3

2010-03-07	Fix xzgrep to not break if filenames have spaces or quotes.	Lasse Collin	1	-1/+1
	Thanks to someone who reported the bug on IRC.
2009-07-05	Major update to the xzgrep and other scripts based on	Lasse Collin	1	-0/+196
	the latest versions found from gzip CVS repository. configure will try to find a POSIX shell to be used by the scripts. This should ease portability on systems which have pre-POSIX /bin/sh. xzgrep and xzdiff support .xz, .lzma, .gz, and .bz2 files. xzmore and xzless support only .xz and .lzma files. The name of the xz executable used in these scripts is now correct even if --program-transform-name has been used.