- update to 4.5.1 (bsc#1190531, CVE-2021-41072):
* This release adds Manpages for Mksquashfs(1), Unsquashfs(1),
Sqfstar(1) and Sqfscat(1).
* The -help text output from the utilities has been improved
and extended as well (but the Manpages are now more
comprehensive).
* CVE-2021-41072 which is a writing outside of destination
exploit, has been fixed.
* The number of hard-links in the filesystem is now also
displayed by Mksquashfs in the output summary.
* The number of hard-links written by Unsquashfs is now
also displayed in the output summary.
* Unsquashfs will now write to a pre-existing destination
directory, rather than aborting.
* Unsquashfs now allows "." to used as the destination, to
extract to the current directory.
* The Unsquashfs progress bar now tracks empty files and
hardlinks, in addition to data blocks.
* -no-hardlinks option has been implemented for Sqfstar.
* More sanity checking for "corrupted" filesystems, including
checks for multiply linked directories and directory loops.
* Options that may cause filesystems to be unmountable have
been moved into a new "experts" category in the Mksquashfs
help text (and Manpage).
* Maximum cpiostyle filename limited to PATH_MAX. This
prevents attempts to overflow the stack, or cause system
calls to fail with a too long pathname.
* Don't always use "max open file limit" when calculating
length of queues, as a very large file limit can cause
Unsquashfs to abort. Instead use the smaller of max open
OBS-URL: https://build.opensuse.org/request/show/963333
OBS-URL: https://build.opensuse.org/package/show/filesystems/squashfs?expand=0&rev=50
- update to 4.5:
* Mksquashfs now supports "Actions".
* New sqfstar command which will create a Squashfs image from a tar archive.
* Tar style handling of source pathnames in Mksquashfs.
* Cpio style handling of source pathnames in Mksquashfs.
* New option to throttle the amount of CPU and I/O.
* Mksquashfs now allows no source directory to be specified.
* New Pseudo file "R" definition which allows a Regular file
o be created with data stored within the Pseudo file.
* Symbolic links are now followed in extract files
* Unsquashfs now supports "exclude" files.
* Max depth traversal option added.
* Unsquashfs can now output a "Pseudo file" representing the
input Squashfs filesystem.
* New -one-file-system option in Mksquashfs.
* New -no-hardlinks option in Mksquashfs.
* Exit code in Unsquashfs changed to distinguish between
non-fatal errors (exit 2), and fatal errors (exit 1).
* Xattr id count added in Unsquashfs "-stat" output.
* Unsquashfs "write outside directory" exploit fixed.
* Error handling in Unsquashfs writer thread fixed.
* Fix failure to truncate destination if appending aborted.
* Prevent Mksquashfs reading the destination file.
OBS-URL: https://build.opensuse.org/request/show/939998
OBS-URL: https://build.opensuse.org/package/show/filesystems/squashfs?expand=0&rev=49
- Version 4.4 - 2019-08-29:
* Reproducible builds, new compressors,
CVE fixes, security hardening and new options
for Mksquashfs/Unsquashfs.
- Overall improvements:
* Mksquashfs now generates reproducible images by default.
* Mkfs time and file timestamps can also be specified.
* Support for the Zstandard (ZSTD) compression algorithm.
* CVE-2015-4645 and CVE-2015-4646 have been fixed.
- Mksquashfs improvements and major bug fixes:
* Pseudo files now support symbolic links.
* New -mkfs-time option.
* New -all-time option.
* New -root-mode option.
* New -quiet option.
* New -noId option.
* New -offset option.
* Update lz4 wrapper to use new functions introduced
in 1.7.0.
* Bug fix, don't allow "/" pseudo filenames.
* Bug fix, allow quoting of pseudo files, to
better handle filenames with spaces.
* Fix compilation with glibc 2.25+.
- Unsquashfs improvements and major bug fixes:
* CVE-2015-4645 and CVE-2015-4646 have been fixed.
* Unsquashfs has been further hardened against corrupted
filestems.
* Unsquashfs is now more strict about error handling.
* New -ignore-errors option.
* New -strict-errors option.
* New -lln[umeric] option.
* New -lc option.
* New -llc option.
* New -mkfs-time option.
* New -UTC option.
* New -offset option.
* New -quiet option.
* Update lz4 wrapper to use new functions introduced
in 1.7.0.
* Bug fix, fatal and non-fatal errors now set the exit
code to 1.
* Bug fix, fix time setting for symlinks.
* Bug fix, try to set sticky-bit when running as a
user process.
* Fix compilation with glibc 2.25+.
- build changes:
* re-created patches to fit squashfs 4.4
* removed 0001-mksquashfs-fix-rare-race-in-fragment-waiting-in-file.patch
(new version includes this change)
* removed 0002-Fix-2GB-limit-of-the-is_fragment-.-function.patch
(new version includes this change)
* removed 0003-Add-offset-function-to-skip-n-bytes.patch
(new version includes this change)
* removed sysmacros.patch
(new version includes this change)
OBS-URL: https://build.opensuse.org/request/show/743375
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/squashfs?expand=0&rev=39
- Version 4.4 - 2019-08-29:
* Reproducible builds, new compressors,
CVE fixes, security hardening and new options
for Mksquashfs/Unsquashfs.
- Overall improvements:
* Mksquashfs now generates reproducible images by default.
* Mkfs time and file timestamps can also be specified.
* Support for the Zstandard (ZSTD) compression algorithm.
* CVE-2015-4645 and CVE-2015-4646 have been fixed.
- Mksquashfs improvements and major bug fixes:
* Pseudo files now support symbolic links.
* New -mkfs-time option.
* New -all-time option.
* New -root-mode option.
* New -quiet option.
* New -noId option.
* New -offset option.
* Update lz4 wrapper to use new functions introduced
in 1.7.0.
* Bug fix, don't allow "/" pseudo filenames.
* Bug fix, allow quoting of pseudo files, to
better handle filenames with spaces.
* Fix compilation with glibc 2.25+.
- Unsquashfs improvements and major bug fixes:
* CVE-2015-4645 and CVE-2015-4646 have been fixed.
* Unsquashfs has been further hardened against corrupted
filestems.
* Unsquashfs is now more strict about error handling.
* New -ignore-errors option.
* New -strict-errors option.
* New -lln[umeric] option.
* New -lc option.
* New -llc option.
* New -mkfs-time option.
* New -UTC option.
* New -offset option.
* New -quiet option.
* Update lz4 wrapper to use new functions introduced
in 1.7.0.
* Bug fix, fatal and non-fatal errors now set the exit
code to 1.
* Bug fix, fix time setting for symlinks.
* Bug fix, try to set sticky-bit when running as a
user process.
* Fix compilation with glibc 2.25+.
- build changes
* re-created patches to fit squashfs 4.4
OBS-URL: https://build.opensuse.org/request/show/741504
OBS-URL: https://build.opensuse.org/package/show/filesystems/squashfs?expand=0&rev=42
- update to 4.3:
- unsquashfs: add checks for corrupted data in opendir functions
- unsquashfs: completely empty filesystems incorrectly generate an error
- unsquashfs: fix open file limit
- mksquashfs: Use linked list to store directory entries rather
- mksquashfs: Remove qsort and add a bottom up linked list merge sort
- mksquashfs: optimise lookup_inode2() for dirs
- pseudo: fix handling of modify pseudo files
- pseudo: fix handling of directory pseudo files
- xattr: Fix ERROR() so that it is synchronised with the progress bar
- mksquashfs/sort: Fix INFO() so that it is synced with the progress bar
- mksquashfs: Add -progress to force progress bar when using -info
- error.h: consolidate the various error macros into one header file
- mksquashfs: fix stack overflow in write_fragment_table()
- mksquashfs: move list allocation from off the stack
- unsquashfs: fix oversight in directory permission setting
- mksquashfs: dynamically allocate recovery_file
- mksquashfs: dynamically allocate buffer in subpathname()
- mksquashfs: dynamically allocate buffer in pathname()
- unsquashfs: fix CVE-2012-4024
- unsquashfs: fix CVE-2012-4025
- mksquashfs: fix potential stack overflow in get_component()
- mksquashfs: add parse_number() helper for numeric command line options
- mksquasfs: check return value of fstat() in reader_read_file()
- mksquashfs: dynamically allocate filename in old_add_exclude()
- unsquashfs: dynamically allocate pathname in dir_scan()
- unsquashfs: dynamically allocate pathname in pre_scan()
- sort: dynamically allocate filename in add_sort_list()
- mksquashfs: fix dir_scan() exit if lstat of source directory fails
- pseudo: fix memory leak in read_pseudo_def() if exec_file() fails (forwarded request 234303 from duwe)
OBS-URL: https://build.opensuse.org/request/show/234304
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/squashfs?expand=0&rev=27
- update to 4.3:
- unsquashfs: add checks for corrupted data in opendir functions
- unsquashfs: completely empty filesystems incorrectly generate an error
- unsquashfs: fix open file limit
- mksquashfs: Use linked list to store directory entries rather
- mksquashfs: Remove qsort and add a bottom up linked list merge sort
- mksquashfs: optimise lookup_inode2() for dirs
- pseudo: fix handling of modify pseudo files
- pseudo: fix handling of directory pseudo files
- xattr: Fix ERROR() so that it is synchronised with the progress bar
- mksquashfs/sort: Fix INFO() so that it is synced with the progress bar
- mksquashfs: Add -progress to force progress bar when using -info
- error.h: consolidate the various error macros into one header file
- mksquashfs: fix stack overflow in write_fragment_table()
- mksquashfs: move list allocation from off the stack
- unsquashfs: fix oversight in directory permission setting
- mksquashfs: dynamically allocate recovery_file
- mksquashfs: dynamically allocate buffer in subpathname()
- mksquashfs: dynamically allocate buffer in pathname()
- unsquashfs: fix CVE-2012-4024
- unsquashfs: fix CVE-2012-4025
- mksquashfs: fix potential stack overflow in get_component()
- mksquashfs: add parse_number() helper for numeric command line options
- mksquasfs: check return value of fstat() in reader_read_file()
- mksquashfs: dynamically allocate filename in old_add_exclude()
- unsquashfs: dynamically allocate pathname in dir_scan()
- unsquashfs: dynamically allocate pathname in pre_scan()
- sort: dynamically allocate filename in add_sort_list()
- mksquashfs: fix dir_scan() exit if lstat of source directory fails
- pseudo: fix memory leak in read_pseudo_def() if exec_file() fails
OBS-URL: https://build.opensuse.org/request/show/234303
OBS-URL: https://build.opensuse.org/package/show/filesystems/squashfs?expand=0&rev=18
- The ppc64 kernel uses a page size of 64kB but mksquashfs only
pads to a 4kB boundary. When we loopback mount a squashfs file
that isn't 64kB aligned and access the last sector of the
associated loopback device we see a stream of errors.
Disk partitioning tools seem to like accessing the last 512
bytes of partitions.
This should fix warnings seen during starting installation on
ppc64 and IA64 (forwarded request 90070 from k0da)
OBS-URL: https://build.opensuse.org/request/show/90088
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/squashfs?expand=0&rev=20
- The ppc64 kernel uses a page size of 64kB but mksquashfs only
pads to a 4kB boundary. When we loopback mount a squashfs file
that isn't 64kB aligned and access the last sector of the
associated loopback device we see a stream of errors.
Disk partitioning tools seem to like accessing the last 512
bytes of partitions.
This should fix warnings seen during starting installation on
ppc64 and IA64
OBS-URL: https://build.opensuse.org/request/show/90070
OBS-URL: https://build.opensuse.org/package/show/filesystems/squashfs?expand=0&rev=11
