UnZip Changes and New Features Before Version 6.00
--------------------------------------------------
The 5.52 maintenance release fixes a few minor problems found in the 5.51
release, closes some more security holes, adds a new AtheOS port, and
contains a Win32 extra-field code cleanup that was not finished earlier.
The most important changes are:
- (re)enabled unshrinking support by default, the LZW patents have expired
- fixed an extraction size bug for encrypted stored entries (12 excess bytes
were written with 5.51)
- fixed false "uncompressed size mismatch" messages when extracting
encrypted archive entries
- do not restore SUID/SGID/Tacky attribute bits on Unix (BeOS, AtheOS)
unless explicitly requested by new "-K" command line qualifier
- optional support for "-W" qualifier to modify the pattern matching syntax
(with -W: "*" stops at directory delimiter, "**" matches unlimited)
- prevent buffer overflow caused by bogus extra-long Zipfile specification
- performance enhancements for VMS port
- fixed windll interface handling of its extraction mode qualifiers
nfflag, ExtractOnlyNewer, noflag, PromptToOverwrite; added detailed
explanation of their meanings and interactions to the windll documentation
The 5.51 maintenance release adds a command-line CE port, intended for
batch processing. With the integration of this port, the pUnZip port
has been revised and "revitalized".
The most important changes for the general public are a number of
bug fixes, mostly related to security issues:
- repair a serious bug in the textmode output conversion code for the 16-bit
ports (16-bit MSDOS, OS/2 1.x, some variants of AMIGA, possibly others)
which was introduced by the Deflate64 support of release 5.5
- fix a long standing bug in the the inflate decompression method that
prevented correct extraction in some rare cases
- fixed holes in parent dir traversal security code (e.g.: ".^C." slipped
through the previous version of the check code)
- fixed security hole: check naming consistency in local and central header
- fixed security hole: prevent extracted symlinks from redirecting file
extraction paths
The main addition in the 5.5 release is support for PKWARE's new Deflate64(tm)
algorithm, which appeared first in PKZIP 4.0 (published November 2000).
As usual, some other bugfixes and clean-ups have been integrated:
- support for Deflate64 (Zip compression method #9)
- support for extracting VMS variable length record text files on
any system
- optional "cheap autorun" feature for the SFX stub
- security fixes:
* strip leading slash from stored pathspecs,
* remove "../" parent dir path components from extracted file names
- new option "-:" to allow verbatim extraction of file names containing
"../" parent dir path specs
- fixed file handle leak for the DLL code
- repaired OS2 & WinNT ACL extraction which was broken in 5.42
The 5.42 maintenance release fixes more bugs and cleans up the redistribution
conditions:
- removal of unreduce.c and amiga/timelib.c code to get rid of the last
distribution restrictions beyond the BSD-like Info-ZIP LICENSE
- new generic timelib replacement (currently used by AMIGA port)
- more reasonable mapping rules of UNIX "leading-dot" filenames to the
DOS 8.3 name convention
- repaired screensize detection in MORE paging code
(was broken for DOS/OS2/WIN32 in 5.41)
The 5.41 maintenance release adds another new port and fixes some bugs.
- new BSD-like LICENSE
- new Novell Netware NLM port
- supports extraction of archives with more than 64k entries
- attribute handling of VMS port was broken in UnZip 5.4
- decryption support integrated in the main source distribution
The 5.4 release adds new ports, again. Other important items are changes
to the listing format, new supplemental features and several bug fixes
(especially concerning time-stamp handling...):
- new IBM OS/390 port, a UNIX derivative (POSIX with EBCDIC charset)
- complete revision of the MacOS port
- changed listing formats to enlarge the file size fields for more digits
- added capability to restore directory attributes on MSDOS, OS/2, WIN32
- enabled support of symbolic links on BeOS
- Unix: optional Acorn filetype support, useful for volumes exported via NFS
- several changes/additions to the DLL API
- GUI SFX stub for Win16 (Windows 3.1) and Win32 (Windows 9x, Windows NT)
- new free GCC compiler environments supported on WIN32
- many time-zone handling bug fixes for WIN32, AMIGA, ...
The 5.32 release adds two new ports and a fix for at least one relatively
serious bug:
- new FlexOS port
- new Tandem NSK port
- new Visual BASIC support (compatibility with the Windows DLLs)
- new -T option (set zipfile timestamp) for virtually all ports
- fix for timestamps beyond 2038 (e.g., 2097; crashed under DOS/Win95/NT)
- fix for undetected "dangling" symbolic links (i.e., no pointee)
- fix for VMS indexed-file extraction problem (stored with Zip 2.0 or 2.1)
- further performance optimizations
The 5.31 release included nothing but small bug-fixes and typo corrections,
with the exception of some minor performance tweaks.
The 5.3 release added still more ports and more cross-platform portability
features:
- new BeOS port
- new SMS/QDOS port
- new Windows CE graphical port
- VM/CMS port fully updated and tested
- MVS port fully updated and tested
- updated Windows DLL port, with WiZ GUI spun off to a separate package
- full Universal Time (UTC or GMT) support for trans-timezone consistency
- cross-platform support for 8-bit characters (ISO Latin-1, OEM code pages)
- support for NT security descriptors (ACLs)
- support for overwriting OS/2 directory EAs if -o option given
- updated Solaris/SVR4 package facility
