FreeBSD source tree https://cgit-dev.freebsd.org/src/atom?h=releng%2F13.5 2025-08-07T23:50:06Z 2025-08-07T23:50:06Z Martin Matuska mm@FreeBSD.org 2025-06-01T20:16:26Z urn:sha1:798b7b161a71282aff73d532ffe381b65dd04251 libarchive 3.8.1 New features: #2088 7-zip reader: improve self-extracting archive detection #2137 zip writer: added XZ, LZMA, ZSTD and BZIP2 support #2403 zip writer: added LZMA + RISCV BCJ filter #2601 bsdtar: support --mtime and --clamp-mtime #2602 libarchive: mbedtls 3.x compatibility Security fixes: #2422 tar reader: Handle truncation in the middle of a GNU long linkname (CVE-2024-57970) #2532 tar reader: fix unchecked return value in list_item_verbose() (CVE-2025-25724) #2532 unzip: fix null pointer dereference (CVE-2025-1632) #2568 warc: prevent signed integer overflow (CVE-2025-5916) #2584 rar: do not skip past EOF while reading (CVE-2025-5918) #2588 tar: fix overflow in build_ustar_entry (CVE-2025-5917) #2598 rar: fix double free with over 4 billion nodes (CVE-2025-5914) #2599 rar: fix heap-buffer-overflow (CVE-2025-5915) Important bugfixes: #2399 7-zip reader: add SPARC filter support for non-LZMA compressors #2405 tar reader: ignore ustar size when pax size is present #2435 tar writer: fix bug when -s/a/b/ used more than once with b flag #2459 7-zip reader: add POWERPC filter support for non-LZMA compressors #2519 libarchive: handle ARCHIVE_FILTER_LZOP in archive_read_append_filter #2539 libarchive: add missing seeker function to archive_read_open_FILE() #2544 gzip: allow setting the original filename for gzip compressed files #2564 libarchive: improve lseek handling #2582 rar: support large headers on 32 bit systems #2587 bsdtar: don't hardlink negative inode files together #2596 rar: support large headers on 32 bit systems #2606 libarchive: support @-prefixed Unix epoch timestamps as date strings #2634 tar: Support negative time values with pax #2637 tar: Keep block alignment after pax error #2642 libarchive: fix FILE_skip regression #2643 tar: Handle extra bytes after sparse entries #2649 compress: Prevent call stack overflow #2651 iso9660: always check archive_string_ensure return value CVE: CVE-2024-57970, CVE-2025-1632, CVE-2025-25724, CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, CVE-2025-5917, CVE-2025-5918 PR: 286944 (exp-run on main, libarchive 3.8.0) Approved by: so Security: FreeBSD-SA-25:07.libarchive (cherry picked from commit 2e113ef82465598b8c26e0ca415fbe90677fbd47) (cherry picked from commit f47afeb2ce1eb04a787a4b8c1a6d7752940268da) 2025-02-13T15:12:02Z Dag-Erling Smørgrav des@FreeBSD.org 2025-01-30T21:10:29Z urn:sha1:1aaec1978a29410ec50124454ad80317b44ab2d6 findsym() is intended for use while parsing input, so it should not be called from addsym2() or indirectsym(), which are called before any input is processed. MFC after: 1 week Sponsored by: Klara, Inc. Reviewed by: kevans Differential Revision: https://reviews.freebsd.org/D48733 Approved by: re (cperciva) (cherry picked from commit c63af363c2458aebc30c01cd0b93b4b902580019) (cherry picked from commit 931b0990297e2c6307b41bda95c5225cdf48403c) 2025-01-24T05:21:00Z Colin Percival cperciva@FreeBSD.org 2025-01-24T05:21:00Z urn:sha1:13639d5f710b9a578543ac86efd03cbba546666c This marks the start of the FreeBSD 13.5 release cycle; the stable/13 tree is now in "code slush". Developers are encouraged to prioritize fixing bugs (and/or merging bug fixes from HEAD) over new features at this time. Commit approval from re@ is not required but if new features introduce problems they may be removed from the release. Approved by: re (implicit) Sponsored by: Amazon 2025-01-17T18:48:19Z Mark Johnston markj@FreeBSD.org 2024-12-23T19:06:11Z urn:sha1:9c348f73a8568769b1a746efd9ccbca2f4ef7252 Based on the test case from PR 271817 by Mohamed Akram. PR: 271817 MFC after: 2 weeks (cherry picked from commit 003818aca4cdda47adef808a56d48003aa514029) 2025-01-17T18:48:01Z Valeriy Ushakov uwe@netbsd.org 2024-12-17T22:27:01Z urn:sha1:5ea64bfc9a6f8582b952580c7cdf754e7ab4a078 The "c" command should start the next cycle as clarified in POSIX 2024. This is also consistent with historical and gnu sed behavior. This patch is from OpenBSD by way of NetBSD with a tweak to the man page date by me. Confirmed the test case in the bug now works. PR: 271817 Obtained from: NetBSD (1.39 uwe), OpenBSD (1.39 millert) Sponsored by: Netflix (cherry picked from commit a2d78713171cf138b5ae50d61f82df1af7574c95) 2025-01-14T14:43:05Z Mohamed Akram mohd.akram@outlook.com 2024-12-23T19:06:09Z urn:sha1:91af1b8001d34a1563d861f1da81deaa121adca8 Add a regression test. PR: 271791 Obtained from: OpenBSD (1.38 millert) MFC after: 2 weeks (cherry picked from commit 5982237f1e5a30b6b7d67b307b4d3685b00718bf) 2025-01-11T02:48:31Z Kyle Evans kevans@FreeBSD.org 2025-01-02T02:15:36Z urn:sha1:0d946859c99408ab42c9f3934ee9c9f149e3e36b The shar(1) program is simple, but the fundamental idea of a sh archive is risky at best and one that we probably shouldn't be promoting as prominently as a program in $PATH and a manpage. Let's deprecate and remove it, since the same functionality can easily be found in tar(1) instead. Reviewed by: emaste, philip Reviewed by: allanjude, brooks, delphij, des, imp, rpokala (previous) (cherry picked from commit f68ee0e7a1e8732f725cad4ac708ec49093782d4) (cherry picked from commit 2832af7b4ea256b18ef4dbf2ff97a50765f0609a) 2024-12-28T18:17:30Z Alexander Ziaee concussious@runbox.com 2024-09-14T23:26:16Z urn:sha1:317cf8a1f83255811d35776674395a47a6d7f0b0 Preserve over 40 years of "call UNIX" BSD heritage while answering "one line about what it does" e.g. "how do I get a serial console?" "% apropos serial" MFC after: 3 days Reported by: imp Reviewed by: imp Pull Request: https://github.com/freebsd/freebsd-src/pull/1423 (cherry picked from commit 4d12c7b9df660b15580ff3b07ef5570d1cab958a) 2024-12-28T18:00:58Z Warner Losh imp@FreeBSD.org 2024-12-28T17:59:59Z urn:sha1:e1deab42d259d3cb8d67e696ed83b66549df9b75 PR: 265479 MFC After: 3 days (cherry picked from commit 6feb6b4ffc0514f59da98992dffd88da472a4397) Sponsored by: Netflix 2024-12-27T15:50:16Z Yoshiaki Kasahara ykasap@gmail.com 2024-12-06T18:27:32Z urn:sha1:8b82dcb87ebae3c712b6af5bb455b32fc901bd36 This was made conditional to support cross-builds, but the relevant header wasn't included so it was never enabled for native builds. PR: 278124 Fixes: c3a6ea5ba6b5 Allow compiling usr.bin/find on Linux and Mac (cherry picked from commit 984add354edef8a6b4983a33f89ff62532a1556b)