Note zlib 1.2.3 is just out -- the zlib compression/decompression http://www.zlib.net/ From the page: Version 1.2.3 eliminates potential security vulnerabilities in zlib 1.2.1 and 1.2.2, so all users of those versions should upgrade immediately. The following important fixes are provided in zlib 1.2.3 over 1.2.1 and 1.2.2: * Eliminate a potential security vulnerability when decoding invalid compressed data * Eliminate a potential security vulnerability when decoding specially crafted compressed data * Fix a bug when decompressing dynamic blocks with no distance codes * Fix crc check bug in gzread() after gzungetc() * Do not return an error when using gzread() on an empty file I'd guess this belongs in 2.5, with a possible retrofit for 2.4. --Scott David Daniels Scott.Daniels@Acm.Org
Raymond Hettinger wrote:
I'd guess this belongs in 2.5, with a possible retrofit for 2.4.
+1 on backporting, but that is up to Anthony.
Correct me if I'm wrong - but there isn't much "porting" to this. AFAICT, this is only relevant for the Windows build (i.e. which version is used in the binaries). For the source distribution, there should be no change (except for PCbuild/readme.txt, which should reflect the version that is used in the Windows build). FWIW, this currently talks about 1.2.1. Regards, Martin
[Martin v. L?wis wrote]
Raymond Hettinger wrote:
I'd guess this belongs in 2.5, with a possible retrofit for 2.4.
+1 on backporting, but that is up to Anthony.
Correct me if I'm wrong - but there isn't much "porting" to this. AFAICT, this is only relevant for the Windows build (i.e. which version is used in the binaries). For the source distribution, there should be no change (except for PCbuild/readme.txt, which should reflect the version that is used in the Windows build). FWIW, this currently talks about 1.2.1.
Here is a patch to do this (attached) that works on the trunk and against the Python-2.4.1.tgz source tarball. Shall I check this into the HEAD and release24-maint? Trent -- Trent Mick TrentM@ActiveState.com
[Scott David Daniels]
I'd guess this belongs in 2.5, with a possible retrofit for 2.4.
[Raymond Hettinger]
+1 on backporting, but that is up to Anthony.
[Martin v. L?wis wrote]
Correct me if I'm wrong - but there isn't much "porting" to this. AFAICT, this is only relevant for the Windows build (i.e. which version is used in the binaries). For the source distribution, there should be no change (except for PCbuild/readme.txt, which should reflect the version that is used in the Windows build). FWIW, this currently talks about 1.2.1.
[Trent Mick]
Here is a patch to do this (attached) that works on the trunk and against the Python-2.4.1.tgz source tarball. Shall I check this into the HEAD and release24-maint?
Definitely on HEAD, almost certainly on 24 maint. The slight uncertainty wrt the latter is due to the slim possibility that they also made this version of zlib incompatible in some way. I doubt that, but I haven't tried it. BTW, the NEWS files should add a blurb saying Python moved to a new zlib, under a "Windows" section.
[Trent Mick]
Here is a patch to do this (attached) that works on the trunk and against the Python-2.4.1.tgz source tarball. Shall I check this into the HEAD and release24-maint?
[Tim Peters wrote]
Definitely on HEAD, almost certainly on 24 maint. The slight uncertainty wrt the latter is due to the slim possibility that they also made this version of zlib incompatible in some way. I doubt that, but I haven't tried it.
Dunno. All tests in test_zlib pass.
BTW, the NEWS files should add a blurb saying Python moved to a new zlib, under a "Windows" section.
Okay. Trent -- Trent Mick TrentM@ActiveState.com
On Tuesday 26 July 2005 11:39, Trent Mick wrote:
Here is a patch to do this (attached) that works on the trunk and against the Python-2.4.1.tgz source tarball. Shall I check this into the HEAD and release24-maint?
Yes. -- Anthony Baxter <anthony@interlink.com.au> It's never too late to have a happy childhood.
[Anthony Baxter wrote]
On Tuesday 26 July 2005 11:39, Trent Mick wrote:
Here is a patch to do this (attached) that works on the trunk and against the Python-2.4.1.tgz source tarball. Shall I check this into the HEAD and release24-maint?
Yes.
Okay, done. Can I say that I've had the pleasure for a long while now at only being afflicted with Subversion and Perforce. We can't move Python CVS to subversion soon enough. Then again with a checkin rate hovering belong one per year... :) HEAD: Checking in dist/src/Misc/NEWS; /cvsroot/python/python/dist/src/Misc/NEWS,v <-- NEWS new revision: 1.1323; previous revision: 1.1322 done Checking in dist/src/PCbuild/readme.txt; /cvsroot/python/python/dist/src/PCbuild/readme.txt,v <-- readme.txt new revision: 1.60; previous revision: 1.59 done Checking in dist/src/PCbuild/zlib.vcproj; /cvsroot/python/python/dist/src/PCbuild/zlib.vcproj,v <-- zlib.vcproj new revision: 1.7; previous revision: 1.6 done release24-maint: Checking in dist/src/Misc/NEWS; /cvsroot/python/python/dist/src/Misc/NEWS,v <-- NEWS new revision: 1.1193.2.66; previous revision: 1.1193.2.65 done Checking in dist/src/PCbuild/readme.txt; /cvsroot/python/python/dist/src/PCbuild/readme.txt,v <-- readme.txt new revision: 1.58.2.1; previous revision: 1.58 done Checking in dist/src/PCbuild/zlib.vcproj; /cvsroot/python/python/dist/src/PCbuild/zlib.vcproj,v <-- zlib.vcproj new revision: 1.6.4.1; previous revision: 1.6 done Trent -- Trent Mick TrentM@ActiveState.com
participants (6)
-
"Martin v. Löwis" -
Anthony Baxter -
Raymond Hettinger -
Scott David Daniels -
Tim Peters -
Trent Mick