On Sat, Sep 5, 2026 at 12:04 AM Paul Eggert <[email protected]> wrote:
> On 2026-09-01 01:47, Jim Meyering wrote: > > Here's what I hope is a final snapshot before 1.15. > > Some bad news and some good news. Darren Carreras recently reminded me of > a security bug in gzip he privately told me about on August 1, which I > hadn't gotten around to fixing. The good news is that I have a fix > somewhere in the attached patches. The bad news is that the fix is not > simple and is combined with fixes to other bugs that I discovered while > fixing the security isssue. > > Ordinarily I would just install this patch series, but if you want a new > 1.15 release now I can wait until after 1.15 is published. Not every patch > in this series is essential to fixing gzip bugs, but I'd rather not spend a > lot of time to try to separate out just the essential bits. Thanks for preparing all of that, and in the nick of time. Quick feedback: I expect to push all of that with some minor tweaks, then make a new snapshot right away. The things I'm changing. I applied all 14, then ran this once up front: git fp --stdout -14 > /t/orig Made some corrections and then ran it again to create /t/new2. The attached is the output of diff -u0 -I '^\(From\|index\) ' -wbB /t/orig /t/new2
gz14.diff
Description: Binary data
