diff -Nru miller-5.9.0/c/cli/mlrcli.c miller-5.9.1+dfsg/c/cli/mlrcli.c --- miller-5.9.0/c/cli/mlrcli.c 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/cli/mlrcli.c 2020-09-03 01:13:17.000000000 +0000 @@ -111,8 +111,8 @@ static int mapper_lookup_table_length = sizeof(mapper_lookup_table) / sizeof(mapper_lookup_table[0]); // ---------------------------------------------------------------- -static void cli_load_mlrrc_or_die(cli_opts_t* popts); -static int cli_try_load_mlrrc(cli_opts_t* popts, char* path); +static void cli_load_mlrrc(cli_opts_t* popts); +static void cli_try_load_mlrrc(cli_opts_t* popts, char* path); static int handle_mlrrc_line_1(cli_opts_t* popts, char* line); static int handle_mlrrc_line_2(cli_opts_t* popts, char* line); static int handle_mlrrc_line_3(cli_opts_t* popts, char* line); @@ -178,7 +178,7 @@ if (argc >= 2 && streq(argv[1], "--norc")) { argi++; } else { - cli_load_mlrrc_or_die(popts); + cli_load_mlrrc(popts); } for (; argi < argc; /* variable increment: 1 or 2 depending on flag */) { @@ -871,6 +871,7 @@ fprintf(o, " --prepipe {command} This allows Miller to handle compressed inputs. You can do\n"); fprintf(o, " without this for single input files, e.g. \"gunzip < myfile.csv.gz | %s ...\".\n", argv0); + fprintf(o, "\n"); fprintf(o, " However, when multiple input files are present, between-file separations are\n"); fprintf(o, " lost; also, the FILENAME variable doesn't iterate. Using --prepipe you can\n"); fprintf(o, " specify an action to be taken on each input file. This pre-pipe command must\n"); @@ -881,10 +882,17 @@ fprintf(o, " %s --prepipe 'zcat -cf'\n", argv0); fprintf(o, " %s --prepipe 'xz -cd'\n", argv0); fprintf(o, " %s --prepipe cat\n", argv0); + fprintf(o, " %s --prepipe-gunzip\n", argv0); + fprintf(o, " %s --prepipe-zcat\n", argv0); fprintf(o, " Note that this feature is quite general and is not limited to decompression\n"); fprintf(o, " utilities. You can use it to apply per-file filters of your choice.\n"); fprintf(o, " For output compression (or other) utilities, simply pipe the output:\n"); fprintf(o, " %s ... | {your compression command}\n", argv0); + fprintf(o, "\n"); + fprintf(o, " There are shorthands --prepipe-zcat and --prepipe-gunzip which are\n"); + fprintf(o, " valid in .mlrrc files. The --prepipe flag is not valid in .mlrrc\n"); + fprintf(o, " files since that would put execution of the prepipe command under \n"); + fprintf(o, " control of the .mlrrc file.\n"); } static void main_usage_separator_options(FILE* o, char* argv0) { @@ -1110,31 +1118,30 @@ // * Otherwise try first $HOME/.mlrrc and then ./.mlrrc but let them // stack: e.g. $HOME/.mlrrc is lots of settings and maybe in one // subdir you want to override just a setting or two. -static void cli_load_mlrrc_or_die(cli_opts_t* popts) { +static void cli_load_mlrrc(cli_opts_t* popts) { char* env_mlrrc = getenv("MLRRC"); if (env_mlrrc != NULL) { if (streq(env_mlrrc, "__none__")) { return; } - if (cli_try_load_mlrrc(popts, env_mlrrc)) { - return; - } + cli_try_load_mlrrc(popts, env_mlrrc); + return; } char* env_home = getenv("HOME"); if (env_home != NULL) { char* path = mlr_paste_2_strings(env_home, "/.mlrrc"); - (void)cli_try_load_mlrrc(popts, path); + cli_try_load_mlrrc(popts, path); free(path); } - (void)cli_try_load_mlrrc(popts, "./.mlrrc"); + cli_try_load_mlrrc(popts, "./.mlrrc"); } -static int cli_try_load_mlrrc(cli_opts_t* popts, char* path) { +static void cli_try_load_mlrrc(cli_opts_t* popts, char* path) { FILE* fp = fopen(path, "r"); if (fp == NULL) { - return FALSE; + return; } char* line = NULL; @@ -1157,8 +1164,6 @@ if (line != NULL) { free(line); } - - return TRUE; } // Chomps trailing CR, LF, or CR/LF; comment-strips; left-right trims. @@ -1248,6 +1253,10 @@ static int handle_mlrrc_line_4(cli_opts_t* popts, char** argv, int argc) { int argi = 0; + if (streq(argv[0], "--prepipe")) { + // Don't allow code execution via .mlrrc + return FALSE; + } if (cli_handle_reader_options(argv, argc, &argi, &popts->reader_opts)) { // handled } else if (cli_handle_writer_options(argv, argc, &argi, &popts->writer_opts)) { @@ -1783,6 +1792,14 @@ preader_opts->prepipe = argv[argi+1]; argi += 2; + } else if (streq(argv[argi], "--prepipe-gunzip")) { + preader_opts->prepipe = "gunzip"; + argi += 1; + + } else if (streq(argv[argi], "--prepipe-zcat")) { + preader_opts->prepipe = "zcat"; + argi += 1; + } else if (streq(argv[argi], "--skip-comments")) { preader_opts->comment_string = DEFAULT_COMMENT_STRING; preader_opts->comment_handling = SKIP_COMMENTS; diff -Nru miller-5.9.0/c/cli/mlrcli.h miller-5.9.1+dfsg/c/cli/mlrcli.h --- miller-5.9.0/c/cli/mlrcli.h 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/cli/mlrcli.h 2020-09-03 01:13:17.000000000 +0000 @@ -16,7 +16,7 @@ #include // ---------------------------------------------------------------- -typedef struct _genereator_opts_t { +typedef struct _generator_opts_t { char* field_name; // xxx to do: convert to mv_t long long start; diff -Nru miller-5.9.0/c/lib/mvfuncs.c miller-5.9.1+dfsg/c/lib/mvfuncs.c --- miller-5.9.0/c/lib/mvfuncs.c 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/lib/mvfuncs.c 2020-09-03 01:13:17.000000000 +0000 @@ -1091,7 +1091,7 @@ } if (overflowed) { - return mv_from_float((double)a + (double)b); + return mv_from_float((double)a - (double)b); } else { return mv_from_int(c); } @@ -1193,7 +1193,7 @@ double b = pb->u.fltv; return mv_from_float(a / b); } -static mv_t divide_i_ii(mv_t* pa, mv_t* pb) { +static mv_t divide_n_ii(mv_t* pa, mv_t* pb) { long long a = pa->u.intv; long long b = pb->u.intv; if (b == 0LL) { // Compute inf/nan as with floats rather than fatal runtime FPE on integer divide by zero @@ -1214,7 +1214,7 @@ /*ABSENT*/ {_err, _a, _a, _err, _i0, _f0, _err}, /*EMPTY*/ {_err, _a, _emt, _err, _emt, _emt, _err}, /*STRING*/ {_err, _err, _err, _err, _err, _err, _err}, - /*INT*/ {_err, _1, _emt, _err, divide_i_ii, divide_f_if, _err}, + /*INT*/ {_err, _1, _emt, _err, divide_n_ii, divide_f_if, _err}, /*FLOAT*/ {_err, _1, _emt, _err, divide_f_fi, divide_f_ff, _err}, /*BOOL*/ {_err, _err, _err, _err, _err, _err, _err}, }; @@ -1291,7 +1291,7 @@ double b = pb->u.fltv; return mv_from_float(a + b); } -static mv_t oplus_n_ii(mv_t* pa, mv_t* pb) { +static mv_t oplus_i_ii(mv_t* pa, mv_t* pb) { long long a = pa->u.intv; long long b = pb->u.intv; long long c = a + b; @@ -1304,7 +1304,7 @@ /*ABSENT*/ {_err, _a, _a, _err, _2, _2, _err}, /*EMPTY*/ {_err, _a, _emt, _err, _emt, _emt, _err}, /*STRING*/ {_err, _err, _err, _err, _err, _err, _err}, - /*INT*/ {_err, _1, _emt, _err, oplus_n_ii, oplus_f_if, _err}, + /*INT*/ {_err, _1, _emt, _err, oplus_i_ii, oplus_f_if, _err}, /*FLOAT*/ {_err, _1, _emt, _err, oplus_f_fi, oplus_f_ff, _err}, /*BOOL*/ {_err, _err, _err, _err, _err, _err, _err}, }; diff -Nru miller-5.9.0/c/mapping/mapper_nothing.c miller-5.9.1+dfsg/c/mapping/mapper_nothing.c --- miller-5.9.0/c/mapping/mapper_nothing.c 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/mapping/mapper_nothing.c 2020-09-03 01:13:17.000000000 +0000 @@ -32,7 +32,7 @@ } static void mapper_nothing_usage(FILE* o, char* argv0, char* verb) { - fprintf(o, "Usage: %s %s [options]\n", argv0, verb); + fprintf(o, "Usage: %s %s\n", argv0, verb); fprintf(o, "Drops all input records. Useful for testing, or after tee/print/etc. have\n"); fprintf(o, "produced other output.\n"); } diff -Nru miller-5.9.0/c/mlrvers.h miller-5.9.1+dfsg/c/mlrvers.h --- miller-5.9.0/c/mlrvers.h 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/mlrvers.h 2020-09-03 01:13:17.000000000 +0000 @@ -1,5 +1,5 @@ #ifndef MLRVERS_H #define MLRVERS_H // Manually increment on updates to https://github.com/johnkerl/miller/releases -#define MLR_VERSION "v5.9.0" +#define MLR_VERSION "v5.9.1" #endif // MLRVERS_H diff -Nru miller-5.9.0/c/reg_test/expected/out miller-5.9.1+dfsg/c/reg_test/expected/out --- miller-5.9.0/c/reg_test/expected/out 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/reg_test/expected/out 2020-09-03 01:13:17.000000000 +0000 @@ -18661,16 +18661,6 @@ [ZYX]=[CBA1] a is zee [ZYX]=[CBA1] a is hat [ZYX]=[CBA1] a is pan -a=pan,b=pan,i=1,x=0.3467901443380824,y=0.7268028627434533 -a=eks,b=pan,i=2,x=0.7586799647899636,y=0.5221511083334797 -a=wye,b=wye,i=3,x=0.20460330576630303,y=0.33831852551664776 -a=eks,b=wye,i=4,x=0.38139939387114097,y=0.13418874328430463 -a=wye,b=pan,i=5,x=0.5732889198020006,y=0.8636244699032729 -a=zee,b=pan,i=6,x=0.5271261600918548,y=0.49322128674835697 -a=eks,b=zee,i=7,x=0.6117840605678454,y=0.1878849191181694 -a=zee,b=wye,i=8,x=0.5985540091064224,y=0.976181385699006 -a=hat,b=wye,i=9,x=0.03144187646093577,y=0.7495507603507059 -a=pan,b=wye,i=10,x=0.5026260055412137,y=0.9526183602969864 ================================================================ diff -Nru miller-5.9.0/c/reg_test/run miller-5.9.1+dfsg/c/reg_test/run --- miller-5.9.0/c/reg_test/run 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/c/reg_test/run 2020-09-03 01:13:17.000000000 +0000 @@ -1308,7 +1308,7 @@ echo 'x=hello' | run_mlr put '$y = capitalize($z)' mention LHS value on first record should result in ZYX for process creation -export indir; run_mlr --from $indir/abixy put 'ENV["ZYX"]="CBA".NR; print | ENV["indir"]."/env-assign.sh" , "a is " . $a' +export indir; run_mlr --from $indir/abixy put -q 'ENV["ZYX"]="CBA".NR; print | ENV["indir"]."/env-assign.sh" , "a is " . $a' # ---------------------------------------------------------------- announce POSITIONAL INDEXING diff -Nru miller-5.9.0/configure miller-5.9.1+dfsg/configure --- miller-5.9.0/configure 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/configure 2020-09-03 01:13:17.000000000 +0000 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for mlr 5.9.0. +# Generated by GNU Autoconf 2.69 for mlr 5.9.1. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. @@ -587,8 +587,8 @@ # Identity of this package. PACKAGE_NAME='mlr' PACKAGE_TARNAME='mlr' -PACKAGE_VERSION='5.9.0' -PACKAGE_STRING='mlr 5.9.0' +PACKAGE_VERSION='5.9.1' +PACKAGE_STRING='mlr 5.9.1' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1324,7 +1324,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures mlr 5.9.0 to adapt to many kinds of systems. +\`configure' configures mlr 5.9.1 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1395,7 +1395,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of mlr 5.9.0:";; + short | recursive ) echo "Configuration of mlr 5.9.1:";; esac cat <<\_ACEOF @@ -1505,7 +1505,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -mlr configure 5.9.0 +mlr configure 5.9.1 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -1783,7 +1783,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by mlr $as_me 5.9.0, which was +It was created by mlr $as_me 5.9.1, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2650,7 +2650,7 @@ # Define the identity of the package. PACKAGE='mlr' - VERSION='5.9.0' + VERSION='5.9.1' cat >>confdefs.h <<_ACEOF @@ -12742,7 +12742,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by mlr $as_me 5.9.0, which was +This file was extended by mlr $as_me 5.9.1, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -12812,7 +12812,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -mlr config.status 5.9.0 +mlr config.status 5.9.1 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -Nru miller-5.9.0/configure.ac miller-5.9.1+dfsg/configure.ac --- miller-5.9.0/configure.ac 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/configure.ac 2020-09-03 01:13:17.000000000 +0000 @@ -1,6 +1,6 @@ AC_PREREQ([2.60]) # Manually increment on updates to https://github.com/johnkerl/miller/releases -AC_INIT([mlr],[5.9.0]) +AC_INIT([mlr],[5.9.1]) AC_CONFIG_SRCDIR([c/mlrmain.c]) AC_CONFIG_HEADERS([config.h]) AC_CONFIG_AUX_DIR([autotools]) diff -Nru miller-5.9.0/debian/changelog miller-5.9.1+dfsg/debian/changelog --- miller-5.9.0/debian/changelog 2020-08-27 06:39:22.000000000 +0000 +++ miller-5.9.1+dfsg/debian/changelog 2020-09-03 18:49:39.000000000 +0000 @@ -1,3 +1,11 @@ +miller (5.9.1+dfsg-1) unstable; urgency=medium + + * New upstream release, fixing CVE-2020-15167. Closes: #969467. + * Adjust debian/copyright and debian/watch to exclude unlicensed Go + code. + + -- Stephen Kitt Thu, 03 Sep 2020 20:49:39 +0200 + miller (5.9.0-1) unstable; urgency=medium * New upstream release. diff -Nru miller-5.9.0/debian/copyright miller-5.9.1+dfsg/debian/copyright --- miller-5.9.0/debian/copyright 2020-03-17 11:34:55.000000000 +0000 +++ miller-5.9.1+dfsg/debian/copyright 2020-09-03 18:46:32.000000000 +0000 @@ -1,6 +1,7 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: miller Source: https://github.com/johnkerl/miller +Files-Excluded: go/src/localdeps/ordered Files: * Copyright: 2015 John Kerl @@ -64,10 +65,31 @@ Copyright: 2012, 2013, 2014 James McLaughlin et al. License: BSD-2-Clause +Files: go/src/github.com/goccmack/gocc/* +Copyright: 2012 Vastech SA (PTY) LTD +License: Apache-2.0 + Files: debian/* Copyright: 2015-2020 Stephen Kitt License: BSD-2-Clause + +License: Apache-2.0 + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + . + http://www.apache.org/licenses/LICENSE-2.0 + . + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + . + On Debian systems, the full text of the Apache License, Version 2.0 + can be found in /usr/share/common-licenses/Apache-2.0. + License: BSD-2-Clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions diff -Nru miller-5.9.0/debian/watch miller-5.9.1+dfsg/debian/watch --- miller-5.9.0/debian/watch 2019-09-13 11:02:28.000000000 +0000 +++ miller-5.9.1+dfsg/debian/watch 2020-09-03 18:43:00.000000000 +0000 @@ -1,4 +1,4 @@ version=4 -opts="filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%miller-$1.tar.gz%" \ +opts="repacksuffix=+dfsg,dversionmangle=s/(\da?)[\+\.\-~](?:dfsg|debian|ds|repack)\.?\d*$/$1/,filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%miller-$1.tar.gz%" \ https://github.com/johnkerl/miller/tags \ (?:.*?/)?v?(\d[\d.]*)\.tar\.gz debian uupdate diff -Nru miller-5.9.0/doc/content-for-release-docs.html miller-5.9.1+dfsg/doc/content-for-release-docs.html --- miller-5.9.0/doc/content-for-release-docs.html 2020-08-19 18:35:36.000000000 +0000 +++ miller-5.9.1+dfsg/doc/content-for-release-docs.html 2020-09-03 01:13:17.000000000 +0000 @@ -25,6 +25,7 @@