[Midnightbsd-cvs] [MidnightBSD/mports] b5338a: archivers/gzip: fix CVE-2026-41992 (#785)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: b5338ab265cf39601360ceddc5fd1e7cfe1891b6
      https://github.com/MidnightBSD/mports/commit/b5338ab265cf39601360ceddc5fd1e7cfe1891b6
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M archivers/gzip/Makefile
    A archivers/gzip/files/patch-unlzh.c

  Log Message:
  -----------
  archivers/gzip: fix CVE-2026-41992 (#785)

## Summary

- backport the current GNU gzip fix for CVE-2026-41992
- clear shared LZH decoder arrays before each LZH stream so stale LZW
state cannot cause an out-of-bounds read
- bump PORTREVISION for the patched 1.14 package

Upstream disclosure:
https://www.openwall.com/lists/oss-security/2026/08/23/1
Upstream source:
https://cgit.git.savannah.gnu.org/cgit/gzip.git/plain/unlzh.c

## Validation

- BATCH=yes bmake -C archivers/gzip makesum
- BATCH=yes bmake -C archivers/gzip patch
- BATCH=yes bmake -C archivers/gzip
- BATCH=yes bmake -C archivers/gzip fake
- BATCH=yes bmake -C archivers/gzip package
- BATCH=yes bmake -C archivers/gzip check-license
- portlint -AC archivers/gzip
- git diff --check

Package created: Packages/amd64/All/gzip-1.14_1.mport

The upstream check suite reports 28 passed, 1 skipped, and 1 failed. The
unrelated pipe-output test fails because MidnightBSD commands report
broken-pipe exit status differently; the port currently does not wire
this suite into bmake test. Fake QA also reports the existing DOCS files
missing from pkg-plist.

## Summary by Sourcery

Patch gzip 1.14 to prevent an LZH decoder out-of-bounds read caused by
stale shared state.

Bug Fixes:
- Backport the GNU gzip fix for CVE-2026-41992 by resetting shared LZH
decoder state before processing each stream, preventing stale data from
causing out-of-bounds reads.

Build:
- Bump the gzip package PORTREVISION for the security patch.

Signed-off-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications