UnZip-6.0 6.0-31.2

UnZip - Extracts ZIP archives

Short:        UnZip - Extracts ZIP archives
Author:       Info-ZIP (original), Matthias Muench (Port)
Uploader:     unzip amigaworld de (Matthias Muench)
Type:         util/arc
Version:      6.0-31.2
Architecture: m68k-amigaos
Distribution: Aminet

Info-ZIP's UnZip for AmigaOS, built from the current maintained source: UnZip
6.0 with Debian's 6.0-31 patch set, 34 patches covering every published CVE
fix from CVE-2014-8139 through CVE-2022-0530 plus the three memory errors
found in 2026.  Upstream itself has not moved since 2009, so a stock 6.0 is
missing more than a decade of fixes.

Info-ZIP's Amiga port supported only Aztec C and SAS/C, neither of which is
still available; this release adds a GCC branch to it.  Nothing Amiga-side
was given up: filenotes, AmigaDOS protection bits and datestamps work as they
did in the original port.

History:

6.0-31.2 (26.10.2026)
    Fix for CVE-2021-4217, taken from Ubuntu (Debian has not applied it):
    a NULL pointer read on entries without a name but with a Unicode path
    extra field, and use of uninitialised data when an extra field is cut
    short by the end of the file.  On the Amiga the NULL read does not
    crash, but it could make UnZip extract an entry under a name it should
    have rejected.

6.0-31.1 (25.10.2026)
    UTF-8 names in archives whose (local) extra field is empty, as 7-Zip,
    Java and Go write them, are now converted to the Amiga character set.
    7-Zip archives used to raise "mismatching local filename" and return
    code 1; archives without any extra field came out with raw UTF-8 bytes
    in the names.  The bug is in Info-ZIP's UnZip 6.0 itself.

6.0-31 (05.09.2026)
    First release of this port.

Contents:

  UnZip      the main program, ZipInfo mode built in ("UnZip -Z")
  FUnZip     unpacks a single entry from standard input
  UnZipSFX   stub for self-extracting archives
  MakeSFX    joins UnZipSFX and a .zip into one program

Both a 68000 and a 68020 build are included.  Linked against libnix, so no
ixemul.library and no other libraries are needed -- copy them to C: and they
run.

What it reads:

  - every compression method up to Deflate64
  - bzip2 entries (libbz2 1.0.8 built in)
  - ZIP64 archives.  Current packers write ZIP64 records even into small
    archives, and an UnZip without support for them refuses the whole file
    with "need PK compat. v4.5"
  - ZipCrypto encryption
  - UTF-8 filenames from Windows, macOS and current zip versions, converted
    to the Amiga character set.  AmigaOS uses Latin-1, so European names come
    through unchanged; anything Latin-1 cannot represent is written as
    "#Uxxxx" with its Unicode code point rather than being mangled

Amiga specifics:

  -N  restores archive comments as filenotes
  -D  leaves drawer datestamps alone, -DD all datestamps

Protection bits follow the archive's attributes, and datestamps are restored
on drawers as well as files.

Memory:

UnZip is ~214K and wants roughly 100K of buffers while running, so a
2 MB machine is comfortable.  bzip2 entries are the exception -- the library
needs another ~1.2 MB in one piece, even in the small-memory mode this build
uses.  When it is not there UnZip says so and skips to the next entry instead
of failing.

Self-extracting archives need MakeSFX rather than plain concatenation:
LoadSeg() would trip over trailing bytes, so the archive goes into a
HUNK_DEBUG block.

Tested on AmigaOS 3.1 (Kickstart 40.72) and on AmigaOS 3.2 with a 68080
(Vampire V4 Standalone), both the 68000 and the 68020 build.

UnZip is Info-ZIP's work and stays under the Info-ZIP licence; the bundled
bzip2 is Julian Seward's, under a BSD-style licence.  Both licence texts are
in the archive.  Bug reports about UnZip itself belong at
http://www.info-zip.org/zip-bug.html; anything specific to this port to the
uploader.