Commit 44a7fbdb for xz
commit 44a7fbdbe4b6b75854df2f073cd0815abf6a6beb
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Aug 15 20:31:20 2026 +0300
Add NEWS for 5.8.4
diff --git a/NEWS b/NEWS
index c1870e89..812124e9 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,145 @@
XZ Utils Release Notes
======================
+5.8.4 (2026-09-09)
+
+ IMPORTANT: This includes a fix for a security issue that affects all
+ XZ Utils versions since 5.0.0. This and a few other fixes have also
+ been committed to the old stable branches (v5.2, v5.4, and v5.6) in
+ the xz Git repository. Those fixes are marked below. No new 5.2.x,
+ 5.4.x, or 5.6.x releases will be made.
+
+ * liblzma:
+
+ - lzma_alone_decoder(), lzma_lzip_decoder(),
+ lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
+ invalid memory access after memory allocation has failed and
+ the application reinitializes the existing decoder to decode
+ a different file. This bug could at least result in a crash.
+ This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - lzma_stream_buffer_decode(): Fix wrong error code and,
+ in debug builds, assertion failure. LZMA_BUF_ERROR could
+ be returned with truncated inputs while LZMA_DATA_ERROR
+ is the correct one in this function.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - Fix a performance issue in the typical use case of
+ lzma_index_cat(). Internally liblzma calls it from
+ lzma_file_info_decoder(), so that was affected too. The
+ problem occurred if the input .xz file was created by
+ concatenating a large number of .xz files. A crafted file
+ could make "xz --list" very slow or effectively hang.
+ Normal decompression doesn't use these functions and
+ thus wasn't affected.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - Fix a theoretical integer overflow in lzma_index_cat().
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - Fix bogus memory usage report in lzma_index_decoder() when
+ the .xz Index is obviously invalid. A huge bogus value could
+ cause an integer overflow in lzma_file_info_decoder()'s
+ memory usage reporting due to a missing overflow check,
+ making lzma_memused() report an incorrect tiny value. This
+ bug didn't affect the memory usage limiter in these two
+ decoders; only the reporting via lzma_memused() was affected.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - Fix a too low memory usage report in lzma_index_decoder()
+ if lzma_memused() is called after a part of the Index has
+ already been decoded. The typical use case is to call
+ lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
+ which did work correctly.
+
+ - Fix copying of check type in lzma_index_dup(). Calling
+ lzma_index_checks() on the duplicated lzma_index returned
+ return garbage a result. lzma_index_dup() is rarely used;
+ liblzma doesn't use it internally and xz itself doesn't use
+ it either.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - lzma_file_info_decoder() and lzma_index_decoder(): Reject
+ an obviously-invalid Number of Records field earlier.
+ (Partially also in v5.2, v5.4, and v5.6.)
+
+ - Fix a missing synchronization in the threaded .xz decoder. It
+ could make lzma_get_progress() return incorrect progress info.
+ (Also in v5.4 and v5.6.)
+
+ - Detect certain kinds of corrupt inputs slightly earlier in
+ the LZMA2 decoder.
+
+ - ARM64 and LoongArch: Don't use aligned reads on unaligned
+ buffers. This makes the code work on strict-align processors
+ and fixes a sanitizer error in other cases. (Since 5.7.1alpha)
+
+ * xz:
+
+ - Fix a use-after-free when showing an error message if --files
+ or --files0 was specified in the environment variables XZ_OPT
+ or XZ_DEFAULTS.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - Fix a use-after-free bug when --verbose is used and
+ standard error isn't a terminal. (Since 5.7.1alpha)
+
+ - Make it an error if the totals in "xz --list" exceed the range
+ of 64-bit integers.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ * xz and xzdec on Linux:
+
+ - Add support for Landlock ABI version 9.
+
+ - Use fallback macros for Landlock ABI version 2, 3, and 5
+ (but not 4) if <linux/landlock.h> is older than ABI version 5.
+ This makes the binary slightly more protected if it is run on
+ a kernel that supports newer ABIs than <linux/landlock.h>.
+
+ * Scripts:
+
+ - xzgrep: Fix handling of the ' char at the end of a command
+ line option. For example, the following tricked xzgrep to
+ run "id": xzgrep "-e'" "-e;id;'" somefile
+ (Also in v5.2, v5.4, and v5.6.)
+
+ - xzdiff: Use the C locale (LC_ALL=C) with "sed" and "expr"
+ to ensure safe behavior with invalid multibyte sequences.
+ An equivalent improvement was made in xzgrep in 5.2.6
+ (2022-08-12), but it was forgotten from xzdiff.
+ (Also in v5.2, v5.4, and v5.6.)
+
+ * Tests:
+
+ - Improve a few tests and fuzz targets.
+
+ - Add new test files:
+ * bad-0-index-1.xz (32 bytes)
+ * bad-1-index-huge-uncomp.xz (72 bytes)
+
+ * Man pages:
+
+ - Improve the rendering with OpenBSD's mandoc(1).
+
+ - Reduce indentation of the tables to avoid overlong lines
+ in translated versions of the xz man page.
+
+ * Translations:
+
+ - In translated man pages, workaround an issue with non-ASCII
+ characters in tables.
+
+ - Fix syntax errors in a few man page translations.
+
+ - Update Arabic and German man page translations.
+
+ - Update Brazilian Portuguese, Croatian, Dutch, German, Italian,
+ Korean, Polish, Portuguese, Romanian, and Ukrainian message
+ translations.
+
+
5.8.3 (2026-03-31)
IMPORTANT: This includes a fix for CVE-2026-34743 which affects all