xz corruption bug in 4.999.8beta

Ron Parker · 09-29-2009, 12:23 PM

According to http://tukaani.org/xz/ there is a data corruption bug in XZ Utils versions prior to 4.999.9beta. I know I can update it locally but I didn't know what Slackware's position was on updating bugs like this in a stable release, especially since 13.0 uses xz for distributing packages.

BTW, it is soooo nice to finally have a stable 64-bit version for use at work. Thank you, thank you, thank you. Now, I just chuckle watching the other dev's constantly downloading huge updates.

rworkman · 09-29-2009, 01:36 PM

I won't speak for Pat, but I personally haven't seen it, nor have I seen any reports of corruption.

Updating to the new 4.999.9beta isn't an option, as it now requires libtool-2.x:

Quote:

commit 696d7ee3953beaf4f0ed18e78917ccf300431966
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Aug 27 15:43:54 2009 +0300

Require GNU libtool 2.2.

However, if you prefer, you could apply this patch from git and rebuild xz
(I'm also attaching the patch):

Code:

diff --git a/src/liblzma/lz/lz_encoder.h b/src/liblzma/lz/lz_encoder.h
index 4904c22..35e9ebb 100644
--- a/src/liblzma/lz/lz_encoder.h
+++ b/src/liblzma/lz/lz_encoder.h
@@ -234,7 +234,7 @@ mf_avail(const lzma_mf *mf)
 static inline uint32_t
 mf_unencoded(const lzma_mf *mf)
 {
-	return mf->write_pos - mf->read_pos - mf->read_ahead;
+	return mf->write_pos - mf->read_pos + mf->read_ahead;
 }

I'll point Pat to this thread, but to be honest, I doubt there will be an update since nobody has reported any problems with the version we have.

sahko · 09-29-2009, 06:21 PM

Quote:

Originally Posted by rworkman

I won't speak for Pat, but I personally haven't seen it, nor have I seen any reports of corruption.

Haven't seen it either and i use xz exclusively.

Quote:

Originally Posted by rworkman

Updating to the new 4.999.9beta isn't an option, as it now requires libtool-2.x:

Sorry for asking, as well as my ignorance, but what is wrong with libtool-2.x.y?
And does this mean that xz on Slackware will always be beta?

rworkman · 09-29-2009, 08:45 PM

Quote:

Originally Posted by sahko

Sorry for asking, as well as my ignorance, but what is wrong with libtool-2.x.y?
And does this mean that xz on Slackware will always be beta?

Not too terribly long ago, lots of other upstream stuff didn't like it too well, and other distros that had moved to libtool2 were having some issues; at least one of them shipped both libtool1 and libtool2, and quite frankly, that's not something that I had ANY desire to work out all the details involved.

Lately though, it seems to be fine in my testing here; there are a few things that have to be rebuilt, and so far, everything I've tried to build has compiled just fine. Long story short, I don't know the answer to your second question, but also don't expect libtool to be a holdup. Of course, that's not my decision though :-)

gnashley · 09-30-2009, 01:42 PM

Uh, I checked this out today, and xz-4.999.9beta builds just fine with older versions of libtool. I'm still using libtool-1.5.22.
As far as libtool-2.x, it supposedly fixes at least one long-standing, subtle-but-serious bug.

The new version of xz has a significant number of fixes -some of which may improve the memory footprint. Probably worth having a longer look at it.

rworkman · 10-01-2009, 11:40 PM

Quote:

Originally Posted by gnashley

Uh, I checked this out today, and xz-4.999.9beta builds just fine with older versions of libtool. I'm still using libtool-1.5.22.

Interesting. I haven't actually tried building it - I was just basing my conclusion on the git log.

Quote:

As far as libtool-2.x, it supposedly fixes at least one long-standing, subtle-but-serious bug.

Is that the one where unnecessary "deps" are included to the libtool archive (.la) file? If so, that's good - several of the xorg-related updates wouldn't have been necessary but for that bug.

Quote:

The new version of xz has a significant number of fixes -some of which may improve the memory footprint. Probably worth having a longer look at it.

Well, I'll definitely check it out for -current, but I still wouldn't get hopes up for 13.0 /patches :-)