Skip to content

Update bundled compression libraries - #199

Merged
jcoffland merged 4 commits into
CauldronDevelopmentLLC:masterfrom
marcosfrm:comp-libs-up
Jan 2, 2026
Merged

Update bundled compression libraries#199
jcoffland merged 4 commits into
CauldronDevelopmentLLC:masterfrom
marcosfrm:comp-libs-up

Conversation

@marcosfrm

Copy link
Copy Markdown
Contributor

Fixes a few CVEs, including CVE-2019-12900 (bzip2), CVE-2021-3520 (lz4), and CVE-2022-37434 (zlib, though not exploitable here).

The commits were created with:

wget -q 'https://sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz'
for f in src/bzip2/*; do tar -tf bzip2-1.0.8.tar.gz --no-anchored "${f##*/}" &>/dev/null && tar -xOf bzip2-1.0.8.tar.gz --no-anchored "${f##*/}" > "$f"; done

wget -q 'https://github.com/lz4/lz4/releases/download/v1.10.0/lz4-1.10.0.tar.gz'
for f in src/lz4/*; do tar -tf lz4-1.10.0.tar.gz --no-anchored "${f##*/}" &>/dev/null && tar -xOf lz4-1.10.0.tar.gz --no-anchored "${f##*/}" > "$f"; done

wget -q 'https://www.zlib.net/zlib-1.3.1.tar.gz'
for f in src/ZLib/*; do tar -tf zlib-1.3.1.tar.gz --no-anchored "${f##*/}" &>/dev/null && tar -xOf zlib-1.3.1.tar.gz --no-anchored "${f##*/}" > "$f"; done

Note: lz4 1.9.4 introduced an optional API for transparent file compression and decompression (lz4file.c and lz4file.h) -- not used, so left out.

Compile tested on Linux. Leaving as a draft due to lack of testing on macOS and Windows.

@jcoffland
jcoffland marked this pull request as ready for review January 2, 2026 13:27
@jcoffland
jcoffland merged commit 2022404 into CauldronDevelopmentLLC:master Jan 2, 2026
@jcoffland

Copy link
Copy Markdown
Member

This builds fine on macOS and Windows.

@marcosfrm
marcosfrm deleted the comp-libs-up branch January 2, 2026 16:21
jcoffland added a commit that referenced this pull request Jun 15, 2026
Update bundled compression libraries
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants