Some security fixes and some touch ups. tar and unzip are both prone to

undesirable directory traversal (nothing like leaving .. unlinked *shudder*) I
package.masked unzip-5.42 since thier server is busted and I can't test it yet.
http://www.security.nnov.ru/advisories <-- is the advisories. rar is also
suceptible. Remeber you should run archivers under a privleged UID.

2 files changed, 71 insertions, 0 deletions

diff --git a/app-arch/unzip/files/unzip-5.42.patch b/app-arch/unzip/files/unzip-5.42.patch
new file mode 100644
index 000000000000..a39d3c7d137e
--- /dev/null
+++ b/app-arch/unzip/files/unzip-5.42.patch
@@ -0,0 +1,31 @@
+*** extract.orig	Sun Jan 14 00:40:20 2001
+--- extract.c	Mon Jul  9 14:45:42 2001
+***************
+*** 154,159 ****
+--- 154,161 ----
+  #ifndef WINDLL
+     static ZCONST char Far ReplaceQuery[] =
+       "replace %s? [y]es, [n]o, [A]ll, [N]one, [r]ename: ";
++    static ZCONST char Far TraversalWarning[] = 
++      "%s skipped because of directory traversal\n";
+     static ZCONST char Far AssumeNone[] = " NULL\n(assuming [N]one)\n";
+     static ZCONST char Far NewNameQuery[] = "new name: ";
+     static ZCONST char Far InvalidResponse[] = "error:  invalid response [%c]\n";
+***************
+*** 877,882 ****
+--- 879,893 ----
+                      } /* end switch (*answerbuf) */
+  #endif /* ?WINDLL */
+                  } /* end if (query) */
++ 		if(*__G__ G.filename=='/' || !strncmp(__G__ G.filename, "../", 3)
++ 		    || strstr(__G__ G.filename,"/../")){
++                         skip_entry = SKIP_Y_EXISTING;
++ #ifndef WINDLL
++                     Info(slide, 0x81, ((char *)slide,
++                       LoadFarString(TraversalWarning),
++                       FnFilter1(G.filename)));
++ #endif
++ 		}
+                  if (skip_entry != SKIP_NO) {
+  #ifdef WINDLL
+                      if (skip_entry == SKIP_Y_EXISTING) {
diff --git a/app-arch/unzip/unzip-5.42.ebuild b/app-arch/unzip/unzip-5.42.ebuild
new file mode 100644
index 000000000000..eddd5e509403
--- /dev/null
+++ b/app-arch/unzip/unzip-5.42.ebuild
@@ -0,0 +1,40 @@
+# Copyright 1999-2000 Gentoo Technologies, Inc.
+# Distributed under the terms of the GNU General Public License, v2 or later
+# Author Achim Gottinger <achim@gentoo.org>
+# $Header: /var/cvsroot/gentoo-x86/app-arch/unzip/unzip-5.42.ebuild,v 1.1 2001/07/12 19:43:49 lamer Exp $
+
+A=unzip542.tar.gz
+S=${WORKDIR}/${P}
+DESCRIPTION="Unzipper for pkzip-compressed files"
+SRC_URI="ftp://ftp.freesoftware.com/pub/infozip/src/${A}"
+HOMEPAGE="ftp://ftp.info-zip.org/pub/infozip/UnZip.html"
+
+DEPEND="virtual/glibc"
+
+src_unpack() {
+	unpack ${A}
+	cd ${S}
+	patch -p0 < ${FILEDIR}/unzip-5.42.patch
+}
+
+
+src_compile() {
+
+  cp unix/Makefile unix/Makefile.orig
+  sed -e "s:-O3:${CFLAGS}:" unix/Makefile.orig > unix/Makefile
+
+  try make -f unix/Makefile linux
+
+}
+
+src_install() {
+
+  dobin unzip funzip unzipsfx unix/zipgrep
+  doman man/*.1
+  dodoc BUGS COPYING History* LICENSE README ToDo WHERE
+
+
+}
+
+
+