CI: Add DragonflyBSD

Use --disable-nls --enable-external-sha256 because those are used
in the xz Makefile in the OpenBSD ports tree.

.github/workflows/ci.yml

@@ -18,6 +18,8 @@ on:
   # Allows running workflow manually
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   POSIX:
     strategy:
@@ -26,7 +28,7 @@ jobs:
         build_system: [autotools, cmake]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4.1.6
+      - uses: actions/checkout@v4
 
       ########################
       # Install Dependencies #
@@ -156,7 +158,7 @@ jobs:
         run: ./build-aux/ci_build.bash -b ${{ matrix.build_system }} -d small -p test -n small
 
       # Attempt to upload the test logs as artifacts if any step has failed
-      - uses: actions/upload-artifact@v4.3.3
+      - uses: actions/upload-artifact@v4
         if: ${{ failure() }}
         with:
           name: ${{ matrix.os }} ${{ matrix.build_system }} Test Logs

.github/workflows/cifuzz.yml

@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: 0BSD
+
+# Authors: Sam James
+#          Lasse Collin
+#
+# This was written based on the OSS-Fuzz docs:
+# https://google.github.io/oss-fuzz/getting-started/continuous-integration/
+
+name: CIFuzz
+
+on:
+  push:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  CIFuzz:
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        sanitizer: [ address, undefined, memory ]
+
+    steps:
+    - name: Build Fuzzers (${{ matrix.sanitizer }})
+      id: build
+      uses: google/oss-fuzz/infra/cifuzz/actions/build_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'xz'
+        # The language must match the one in project.yaml in OSS-Fuzz:
+        # https://github.com/google/oss-fuzz/blob/master/projects/xz/project.yaml
+        # Thus, use C++ even though there are no C++ files in XZ Utils.
+        language: c++
+        sanitizer: ${{ matrix.sanitizer }}
+
+    - name: Run Fuzzers (${{ matrix.sanitizer }})
+      uses: google/oss-fuzz/infra/cifuzz/actions/run_fuzzers@master
+      with:
+        oss-fuzz-project-name: 'xz'
+        language: c++
+        sanitizer: ${{ matrix.sanitizer }}
+        fuzz-seconds: 600
+        report-timeouts: true
+        report-ooms: true
+
+    - name: Upload Crash
+      uses: actions/upload-artifact@v4
+      if: failure() && steps.build.outcome == 'success'
+      with:
+        name: ${{ matrix.sanitizer }}-artifacts
+        path: ./out/artifacts

.github/workflows/dragonflybsd.yml

@@ -0,0 +1,39 @@
+# SPDX-License-Identifier: 0BSD
+
+name: DragonflyBSD
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  DragonflyBSD:
+    runs-on: ubuntu-latest
+    name: DragonflyBSD
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test in DragonflyBSD
+        id: test
+        uses: vmactions/dragonflybsd-vm@e3c420e8a2362c2496fca6e76a291abd46f5d8e7 #v1.1.0
+        with:
+          usesh: true
+          prepare: >
+            pkg install -y
+            autoconf
+            automake
+            gettext-tools
+            libtool
+            m4
+          run: |
+            set -e
+            uname -a
+            ./autogen.sh --no-po4a
+            # Innocent putc() triggers strict-overflow warnings.
+            ./configure --disable-static --enable-debug --enable-werror CFLAGS='-g -O2 -pipe -Wno-error=strict-overflow'
+            make -j4 check

.github/workflows/freebsd.yml

@@ -9,24 +9,47 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  FreeBSD-test:
-    runs-on: ubuntu-latest
-    name: Test xz on FreeBSD
+  FreeBSD:
+    strategy:
+      matrix:
+        include:
+          - host: ubuntu-latest
+            version: 12.4
+            arch: x86_64
+          - host: ubuntu-latest
+            version: 15.0
+            arch: x86_64
+          # - host: ubuntu-24.04-arm
+          #   version: 15.0
+          #   arch: aarch64
+
+    runs-on: ${{ matrix.host }}
+
+    name: FreeBSD
+
     steps:
-    - uses: actions/checkout@v4.1.6
-    - name: Test in FreeBSD
-      id: test
-      uses: vmactions/FreeBSD-vm@d7b8fcc7711aa41ad45e8d9b737cf90f035a7e3d #v1.1.3
-      with:
-        usesh: true
-        prepare: |
-         pkg install -y autoconf automake gmake gettext-tools gtar libtool m4 po4a
-        run: |
-          set -e
-          export LC_ALL=C LANG=C
-          uname -a
-          ./autogen.sh
-          ./configure --enable-werror
-          make
-          make check VERBOSE=1
+      - uses: actions/checkout@v4
+
+      - name: Test in FreeBSD
+        uses: vmactions/freebsd-vm@c3ae29a132c8ef1924775414107a97cac042aad5 #v1.2.0
+        with:
+          release: ${{ matrix.release }}
+          arch: ${{ matrix.arch }}
+          usesh: true
+          prepare: >
+            pkg install -y
+            autoconf
+            automake
+            gettext-tools
+            libtool
+            m4
+            po4a
+          run: |
+            set -e
+            uname -a
+            ./autogen.sh
+            ./configure --disable-static --enable-debug --enable-werror
+            make -j4 check

.github/workflows/msvc.yml

@@ -0,0 +1,91 @@
+# SPDX-License-Identifier: 0BSD
+
+# Author: Lasse Collin
+
+name: Windows-MSVC
+
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  MSVC:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ windows-2019, windows-latest ]
+
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Configure Win32
+        run: >
+          cmake
+          -A Win32
+          -B build-msvc-win32
+
+      - name: Build Win32 Debug
+        run: >
+          cmake
+          --build build-msvc-win32
+          --config Debug
+
+      - name: Test Win32 Debug
+        run: >
+          ctest
+          --test-dir build-msvc-win32
+          --build-config Debug
+          --output-on-failure
+
+      - name: Build Win32 Release
+        run: >
+          cmake
+          --build build-msvc-win32
+          --config Release
+
+      # This fails with VS 2019 without b5a5d9e3f702.
+      - name: Test Win32 Release
+        run: >
+          ctest
+          --test-dir build-msvc-win32
+          --build-config Release
+          --output-on-failure
+
+      - name: Configure x64
+        run: >
+          cmake
+          -A x64
+          -B build-msvc-x64
+
+      - name: Build x64 Debug
+        run: >
+          cmake
+          --build build-msvc-x64
+          --config Debug
+
+      - name: Test x64 Debug
+        run: >
+          ctest
+          --test-dir build-msvc-x64
+          --build-config Debug
+          --output-on-failure
+
+      - name: Build x64 Release
+        run: >
+          cmake
+          --build build-msvc-x64
+          --config Release
+
+      - name: Test x64 Release
+        run: >
+          ctest
+          --test-dir build-msvc-x64
+          --build-config Release
+          --output-on-failure

.github/workflows/netbsd.yml

@@ -9,24 +9,31 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  NetBSD-test:
+  NetBSD:
     runs-on: ubuntu-latest
-    name: Test xz on NetBSD
+    name: NetBSD
     steps:
-    - uses: actions/checkout@v4.1.6
-    - name: Test in NetBSD
-      id: test
-      uses: vmactions/NetBSD-vm@dd0161ecbb6386e562fd098acf367633501487a4 #v1.1.3
-      with:
-        usesh: true
-        prepare: |
-          /usr/sbin/pkg_add -v autoconf automake gmake gettext-tools gtar-base libtool-base m4 po4a
-        run: |
-          set -e
-          export LC_ALL=C LANG=C
-          uname -a
-          ./autogen.sh
-          ./configure --enable-werror
-          make
-          make check VERBOSE=1
+      - uses: actions/checkout@v4
+
+      - name: Test in NetBSD
+        id: test
+        uses: vmactions/netbsd-vm@46a58bbf03682b4cb24142b97fa315ae52bed573 #v1.1.8
+        with:
+          usesh: true
+          prepare: >
+            /usr/sbin/pkg_add -v
+            cmake
+            gettext-tools
+            ninja-build
+            po4a
+          run: |
+            set -e
+            uname -a
+            ./po4a/update-po
+            # Innocent putc() triggers strict-overflow warnings.
+            cmake -G Ninja -B build -DBUILD_SHARED_LIBS=ON -DCMAKE_C_FLAGS='-g -O2 -pipe -Wno-error=strict-overflow' -DCMAKE_COMPILE_WARNING_AS_ERROR=ON
+            ninja -C build
+            ctest --test-dir build --output-on-failure

.github/workflows/openbsd.yml

@@ -9,27 +9,31 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  OpenBSD-test:
+  OpenBSD:
     runs-on: ubuntu-latest
-    name: Test xz on OpenBSD
+    name: OpenBSD
     steps:
-    - uses: actions/checkout@v4.1.6
-    - name: Test in OpenBSD
-      id: test
-      uses: vmactions/OpenBSD-vm@ebafa4eac4adf5e7d04e5bbb4aa764b75dd160df #v1.1.2
-      with:
-        usesh: true
-        prepare: |
-          /usr/sbin/pkg_add -I -v autoconf-2.71 automake-1.16.5 gmake gettext-tools gtar libtool m4
-        run: |
-          set -e
-          export LC_ALL=C LANG=C
-          export AUTOCONF_VERSION=2.71
-          export AUTOMAKE_VERSION=1.16
-          uname -a
-          # OpenBSD ports lack po4a
-          ./autogen.sh --no-po4a
-          ./configure --enable-werror
-          make
-          make check VERBOSE=1
+      - uses: actions/checkout@v4
+
+      - name: Test in OpenBSD
+        uses: vmactions/openbsd-vm@284abc8fb4cd88f69946a0d4c27c4eecd82fdde9 #v1.1.7
+        with:
+          usesh: true
+          prepare: >
+            /usr/sbin/pkg_add -I -v
+            autoconf-2.72p0
+            automake-1.16.5
+            gettext-tools
+            libtool
+            m4
+          run: |
+            set -e
+            export AUTOCONF_VERSION=2.72
+            export AUTOMAKE_VERSION=1.16
+            uname -a
+            ./autogen.sh --no-po4a
+            ./configure --disable-static --enable-debug --enable-werror --disable-nls --enable-external-sha256
+            make -j4 check

.github/workflows/solaris.yml

@@ -9,24 +9,25 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
-  solaris-test:
+  Solaris:
     runs-on: ubuntu-latest
-    name: Test xz on Solaris
+    name: Solaris
     steps:
-    - uses: actions/checkout@v4.1.6
-    - name: Test in Solaris
-      id: test
-      uses: vmactions/solaris-vm@960d7483ffd6ac03397964cf6423a2f41332c9c8 #v1.0.9
-      with:
-        usesh: true
-        prepare: |
-          pkg install bash libtool automake gnu-m4 tree wget gcc autoconf //solaris/text/gawk pkg://solaris/text/gnu-diffutils pkg://solaris/text/gnu-grep pkg://solaris/text/gnu-sed
-        run: |
-          set -e
-          export LC_ALL=C LANG=C
-          uname -a
-          ./autogen.sh --no-po4a
-          ./configure --enable-werror
-          make
-          make check VERBOSE=1
+      - uses: actions/checkout@v4
+
+      - name: Test in Solaris
+        uses: vmactions/solaris-vm@cc8f82fa1a7cc746153ec3f71bf11f311f16e225 #v1.1.1
+        with:
+          release: 11.4-gcc
+          usesh: true
+          run: |
+            set -e
+            uname -a
+            # /usr/xpg4/bin isn't in PATH by default.
+            echo "Environment variable PATH: $PATH"
+            ./autogen.sh --no-po4a
+            ./configure --disable-static --enable-debug --enable-werror
+            make check

CMakeLists.txt

@@ -2171,8 +2171,10 @@ this many MiB of RAM if xz cannot determine the amount at runtime")
     tuklib_progname(xz)
     tuklib_mbstr(xz)
 
-    check_symbol_exists(optreset getopt.h HAVE_OPTRESET)
-    tuklib_add_definition_if(xz HAVE_OPTRESET)
+    if(HAVE_GETOPT_LONG)
+        check_symbol_exists(optreset getopt.h HAVE_OPTRESET)
+        tuklib_add_definition_if(xz HAVE_OPTRESET)
+    endif()
 
     check_symbol_exists(posix_fadvise fcntl.h HAVE_POSIX_FADVISE)
     tuklib_add_definition_if(xz HAVE_POSIX_FADVISE)

THANKS

@@ -33,6 +33,7 @@ has been important. :-) In alphabetical order:
   - Cristiano Ceglia
   - Marek Černocký
   - Tomer Chachamu
+  - Aziz Chaudhry
   - Vitaly Chikunov
   - Antoine Cœur
   - Elijah Almeida Coimbra
@@ -42,6 +43,7 @@ has been important. :-) In alphabetical order:
   - Vincent Cruz
   - Gabi Davar
   - Ron Desmond
+  - Antonio Diaz Diaz
   - İhsan Doğan
   - Chris Donawa
   - Andrew Dudman
@@ -106,6 +108,7 @@ has been important. :-) In alphabetical order:
   - James M Leddy
   - Kelvin Lee
   - Vincent Lefevre
+  - Daniel Leonard
   - Hin-Tak Leung
   - Andraž 'ruskie' Levstik
   - Cary Lewis

doc/SHA256SUMS

@@ -234,3 +234,10 @@ b523c5e47d1490338c5121bdf2a6ecca2bcf0dce05a83ad40a830029cbe6679b  xz-5.8.0.tar.g
 05ecad9e71919f4fca9f19fbbc979ea28e230188ed123dc6f06b98031ea14542  xz-5.8.0.tar.xz
 397165cedccb8e16700b8fdd026c3fd7ff2d18923e28cfbf7d0c5f89cd6a50af  xz-5.8.0-windows.zip
 078caa9d406018d4d43df343455f57811e9ba69c1340670a85a0ae6341d42ba3  xz-5.8.0-windows.7z
+ee188eabc3220684422f62df7a385541a86d2a5c385407f9d8fd94d49b251c4e  xz-cve-2025-31115.patch
+c9789682496d124fd214e665f6aa2f6d3d9e8527a7f0e120f9180c531d322bd6  xz-5.8.1.tar
+5965c692c4c8800cd4b33ce6d0f6ac9ac9d6ab227b17c512b6561bce4f08d47e  xz-5.8.1.tar.bz2
+507825b599356c10dca1cd720c9d0d0c9d5400b9de300af00e4d1ea150795543  xz-5.8.1.tar.gz
+0b54f79df85912504de0b14aec7971e3f964491af1812d83447005807513cd9e  xz-5.8.1.tar.xz
+62fdfde73d5c5d293bbb4a96211b29d09adbd56bc6736976e4c9fc9942ae3c67  xz-5.8.1-windows.zip
+8ed1403fe6c971a2a6ac85fb7b27c8438b83175bc6f3bc49fec06540c904c84d  xz-5.8.1-windows.7z

src/liblzma/api/lzma/container.h

@@ -843,8 +843,7 @@ extern LZMA_API(lzma_ret) lzma_alone_decoder(
 /**
  * \brief       Initialize .lz (lzip) decoder (a foreign file format)
  *
- * This decoder supports the .lz format version 0 and the unextended .lz
- * format version 1:
+ * This decoder supports the .lz format versions 0 and 1:
  *
  *   - Files in the format version 0 were produced by lzip 1.3 and older.
  *     Such files aren't common but may be found from file archives
@@ -853,12 +852,12 @@ extern LZMA_API(lzma_ret) lzma_alone_decoder(
  *     support for the format version 0 was removed in lzip 1.18.
  *
  *   - lzip 1.3 added decompression support for .lz format version 1 files.
- *     Compression support was added in lzip 1.4. In lzip 1.6 the .lz format
- *     version 1 was extended to support the Sync Flush marker. This extension
- *     is not supported by liblzma. lzma_code() will return LZMA_DATA_ERROR
- *     at the location of the Sync Flush marker. In practice files with
- *     the Sync Flush marker are very rare and thus liblzma can decompress
- *     almost all .lz files.
+ *     Compression support was added in lzip 1.4.
+ *
+ *   - lzlib extends version 1 format with the Sync Flush marker. This
+ *     extension is only meant for lzlib use; it's not valid in normal .lz
+ *     files. This extension is not supported by liblzma. lzma_code() will
+ *     return LZMA_DATA_ERROR at the location of the Sync Flush marker.
  *
  * Just like with lzma_stream_decoder() for .xz files, LZMA_CONCATENATED
  * should be used when decompressing normal standalone .lz files.

src/liblzma/check/crc64_fast.c

@@ -146,14 +146,6 @@ crc64_dispatch(const uint8_t *buf, size_t size, uint64_t crc)
 extern LZMA_API(uint64_t)
 lzma_crc64(const uint8_t *buf, size_t size, uint64_t crc)
 {
-#if defined(_MSC_VER) && !defined(__INTEL_COMPILER) && !defined(__clang__) \
-		&& defined(_M_IX86) && defined(CRC64_ARCH_OPTIMIZED)
-	// VS2015-2022 might corrupt the ebx register on 32-bit x86 when
-	// the CLMUL code is enabled. This hack forces MSVC to store and
-	// restore ebx. This is only needed here, not in lzma_crc32().
-	__asm  mov ebx, ebx
-#endif
-
 #if defined(CRC64_GENERIC) && defined(CRC64_ARCH_OPTIMIZED)
 	return crc64_func(buf, size, crc);
 

src/liblzma/check/crc_common.h

@@ -134,10 +134,20 @@ extern const uint64_t lzma_crc64_table[4][256];
 	//     built and runtime detection is used even if compiler flags
 	//     were set to allow CLMUL unconditionally.
 	//
-	//   - This doesn't work with MSVC as I don't know how to detect
-	//     the features here.
+	//   - The unconditional use doesn't work with MSVC as I don't know
+	//     how to detect the features here.
 	//
-#	if (defined(__SSSE3__) && defined(__SSE4_1__) && defined(__PCLMUL__) \
+	// Don't enable CLMUL at all on old MSVC that targets 32-bit x86.
+	// There seems to be a compiler bug that produces broken code
+	// in optimized (Release) builds. It results in crashing tests.
+	// It is known that VS 2019 16.11 (MSVC 19.29.30158) is broken
+	// and that VS 2022 17.13 (MSVC 19.43.34808) works.
+#	if defined(_MSC_FULL_VER) && _MSC_FULL_VER < 194334808 \
+			&& !defined(__INTEL_COMPILER) && !defined(__clang__) \
+			&& defined(_M_IX86)
+		// Old MSVC targeting 32-bit x86: Don't enable CLMUL at all.
+#	elif (defined(__SSSE3__) && defined(__SSE4_1__) \
+			&& defined(__PCLMUL__) \
 			&& !defined(HAVE_CRC_X86_ASM)) \
 		|| (defined(__e2k__) && __iset__ >= 6)
 #		define CRC32_ARCH_OPTIMIZED 1

src/xz/xz.1

@@ -615,7 +615,7 @@ Compression is not supported.
 .IP ""
 The
 .B .lz
-format version 0 and the unextended version 1 are supported.
+format versions 0 and 1 are supported.
 Version 0 files were produced by
 .B lzip
 1.3 and older.
@@ -625,15 +625,8 @@ People might have old personal files in this format too.
 Decompression support for the format version 0 was removed in
 .B lzip
 1.18.
-.IP ""
 .B lzip
 1.4 and later create files in the format version 1.
-The sync flush marker extension to the format version 1 was added in
-.B lzip
-1.6.
-This extension is rarely used and isn't supported by
-.B xz
-(diagnosed as corrupt input).
 .TP
 .B raw
 Compress or uncompress a raw stream (no headers).

tests/ossfuzz/config/fuzz_decode_stream_mt.options

@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: 0BSD
+
+[libfuzzer]
+dict = fuzz_xz.dict