head	1.3;
access;
symbols
	RELEASE_0_2_0:1.3
	RELEASE_0_0_19pre2:1.3
	RELEASE_0_0_19pre1:1.3
	RELEASE_0_0_18:1.3
	RELEASE_0_0_17:1.1;
locks; strict;
comment	@# @;


1.3
date	2002.04.03.21.05.51;	author curt;	state Exp;
branches;
next	1.2;

1.2
date	2002.03.11.23.03.19;	author curt;	state Exp;
branches;
next	1.1;

1.1
date	2001.12.29.00.38.04;	author curt;	state Exp;
branches;
next	;


desc
@@


1.3
log
@- Added src-libs/boost.tar.gz and README.boost.  This is in anticipation
  of actually using them in the flightgear event manager.
- Now that we have several add on libs we are bundling with simgear (but
  not automatically built as part of the simgear build) I have moved them
  to their own subdirectory (src-libs).
@
text
@For your convenience and allowed by zlib's license terms:
http://www.gzip.org/zlib/zlib_license.html a copy of the zlib source
is bundled with SimGear in $(top_srcdir)/src-libs/.  You must have
zlib installed before you can build SimGear.

- Most linux distributions have a zlib package.  For linux
  developers, we recommend ysou install your distributions package
  rather than building from source.

- Cygwin installs zlib automatically.

- For developers on most other platforms, you will have to build
  zlib from source and install it yourself.  For your convenience a
  tar ball of the zlib source is included with the simgear source
  distribution.  Untar the zlib source, and follow the included
  build and installation instructions.

Once zlib is installed you can return to configuring and building
Simgear.

We now send you to the official zlib README ... 


=============================================================================


zlib 1.1.4 is a general purpose data compression library.  All the code
is thread safe.  The data format used by the zlib library
is described by RFCs (Request for Comments) 1950 to 1952 in the files 
http://www.ietf.org/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate
format) and rfc1952.txt (gzip format). These documents are also available in
other formats from ftp://ftp.uu.net/graphics/png/documents/zlib/zdoc-index.html

All functions of the compression library are documented in the file zlib.h
(volunteer to write man pages welcome, contact jloup@@gzip.org). A usage
example of the library is given in the file example.c which also tests that
the library is working correctly. Another example is given in the file
minigzip.c. The compression library itself is composed of all source files
except example.c and minigzip.c.

To compile all files and run the test program, follow the instructions
given at the top of Makefile. In short "make test; make install"
should work for most machines. For Unix: "./configure; make test; make install"
For MSDOS, use one of the special makefiles such as Makefile.msc.
For VMS, use Make_vms.com or descrip.mms.

Questions about zlib should be sent to <zlib@@gzip.org>, or to
Gilles Vollant <info@@winimage.com> for the Windows DLL version.
The zlib home page is http://www.zlib.org or http://www.gzip.org/zlib/
Before reporting a problem, please check this site to verify that
you have the latest version of zlib; otherwise get the latest version and
check whether the problem still exists or not.

PLEASE read the zlib FAQ http://www.gzip.org/zlib/zlib_faq.html
before asking for help.

Mark Nelson <markn@@ieee.org> wrote an article about zlib for the Jan. 1997
issue of  Dr. Dobb's Journal; a copy of the article is available in
http://dogma.net/markn/articles/zlibtool/zlibtool.htm

The changes made in version 1.1.4 are documented in the file ChangeLog.
The only changes made since 1.1.3 are bug corrections:

- ZFREE was repeated on same allocation on some error conditions.
  This creates a security problem described in
  http://www.zlib.org/advisory-2002-03-11.txt
- Returned incorrect error (Z_MEM_ERROR) on some invalid data
- Avoid accesses before window for invalid distances with inflate window
  less than 32K.
- force windowBits > 8 to avoid a bug in the encoder for a window size
  of 256 bytes. (A complete fix will be available in 1.1.5).

The beta version 1.1.5beta includes many more changes. A new official
version 1.1.5 will be released as soon as extensive testing has been
completed on it.


Unsupported third party contributions are provided in directory "contrib".

A Java implementation of zlib is available in the Java Development Kit
http://www.javasoft.com/products/JDK/1.1/docs/api/Package-java.util.zip.html
See the zlib home page http://www.zlib.org for details.

A Perl interface to zlib written by Paul Marquess <pmarquess@@bfsec.bt.co.uk>
is in the CPAN (Comprehensive Perl Archive Network) sites
http://www.cpan.org/modules/by-module/Compress/

A Python interface to zlib written by A.M. Kuchling <amk@@magnet.com>
is available in Python 1.5 and later versions, see
http://www.python.org/doc/lib/module-zlib.html

A zlib binding for TCL written by Andreas Kupries <a.kupries@@westend.com>
is availlable at http://www.westend.com/~kupries/doc/trf/man/man.html

An experimental package to read and write files in .zip format,
written on top of zlib by Gilles Vollant <info@@winimage.com>, is
available at http://www.winimage.com/zLibDll/unzip.html
and also in the contrib/minizip directory of zlib.


Notes for some targets:

- To build a Windows DLL version, include in a DLL project zlib.def, zlib.rc
  and all .c files except example.c and minigzip.c; compile with -DZLIB_DLL
  The zlib DLL support was initially done by Alessandro Iacopetti and is
  now maintained by Gilles Vollant <info@@winimage.com>. Check the zlib DLL
  home page at http://www.winimage.com/zLibDll

  From Visual Basic, you can call the DLL functions which do not take
  a structure as argument: compress, uncompress and all gz* functions.
  See contrib/visual-basic.txt for more information, or get
  http://www.tcfb.com/dowseware/cmp-z-it.zip

- For 64-bit Irix, deflate.c must be compiled without any optimization.
  With -O, one libpng test fails. The test works in 32 bit mode (with
  the -n32 compiler flag). The compiler bug has been reported to SGI.

- zlib doesn't work with gcc 2.6.3 on a DEC 3000/300LX under OSF/1 2.1   
  it works when compiled with cc.

- on Digital Unix 4.0D (formely OSF/1) on AlphaServer, the cc option -std1
  is necessary to get gzprintf working correctly. This is done by configure.

- zlib doesn't work on HP-UX 9.05 with some versions of /bin/cc. It works
  with other compilers. Use "make test" to check your compiler.

- gzdopen is not supported on RISCOS, BEOS and by some Mac compilers.

- For Turbo C the small model is supported only with reduced performance to
  avoid any far allocation; it was tested with -DMAX_WBITS=11 -DMAX_MEM_LEVEL=3

- For PalmOs, see http://www.cs.uit.no/~perm/PASTA/pilot/software.html
  Per Harald Myrvang <perm@@stud.cs.uit.no>


Acknowledgments:

  The deflate format used by zlib was defined by Phil Katz. The deflate
  and zlib specifications were written by L. Peter Deutsch. Thanks to all the
  people who reported problems and suggested various improvements in zlib;
  they are too numerous to cite here.

Copyright notice:

 (C) 1995-2002 Jean-loup Gailly and Mark Adler

  This software is provided 'as-is', without any express or implied
  warranty.  In no event will the authors be held liable for any damages
  arising from the use of this software.

  Permission is granted to anyone to use this software for any purpose,
  including commercial applications, and to alter it and redistribute it
  freely, subject to the following restrictions:

  1. The origin of this software must not be misrepresented; you must not
     claim that you wrote the original software. If you use this software
     in a product, an acknowledgment in the product documentation would be
     appreciated but is not required.
  2. Altered source versions must be plainly marked as such, and must not be
     misrepresented as being the original software.
  3. This notice may not be removed or altered from any source distribution.

  Jean-loup Gailly        Mark Adler
  jloup@@gzip.org          madler@@alumni.caltech.edu

If you use the zlib library in a product, we would appreciate *not*
receiving lengthy legal documents to sign. The sources are provided
for free but without warranty of any kind.  The library has been
entirely written by Jean-loup Gailly and Mark Adler; it does not
include third-party code.

If you redistribute modified sources, we would appreciate that you include
in the file ChangeLog history information documenting your changes.
@


1.2
log
@zlib-1.1.3 had a potential security flaw which is fixed by zlib-1.1.4:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Zlib Advisory 2002-03-11
zlib Compression Library Corrupts malloc Data Structures via Double Free

   Original release date: March 11, 2002
   Last revised: March 11, 2002
   Source: This advisory is based on a CERT advisory written
           by Jeffrey P. Lanza  http://www.kb.cert.org/vuls/id/368819

Systems Affected

     * Any software that is linked against zlib 1.1.3 or earlier
     * Any data compression library derived from zlib 1.1.3 or earlier

Overview

   There is a vulnerability in the zlib shared library that may introduce
   vulnerabilities   into   any   program   that   includes   zlib.  This
   vulnerability has been assigned a CVE name of CAN-2002-0059
   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0059

I. Description

   There  is  a  vulnerability in the decompression algorithm used by the
   popular  zlib  compression  library.  If an attacker is able to pass a
   specially-crafted  block of invalid compressed data to a program  that
   includes zlib,  the program's  attempt to decompress  the crafted data
   can cause the  zlib  routines to corrupt the internal data  structures
   maintained by malloc.

   The  vulnerability  results  from  a  programming  error  that  causes
   segments of dynamically allocated memory to be released more than once
   (aka.   "double-freed").  Specifically,  when  inftrees.c:huft_build()
   encounters  the  crafted data, it returns an unexpected Z_MEM_ERROR to
   inftrees.c:inflate_trees_dynamic().  When a subsequent call is made to
   infblock.c:inflate_blocks(), the inflate_blocks function tries to free
   an internal data structure a second time.

   Because  this  vulnerability interferes with the proper allocation and
   de-allocation of dynamic memory, it may be possible for an attacker to
   influence  the  operation  of  programs  that  include  zlib.  In most
   circumstances,  this influence will be limited to denial of service or
   information  leakage, but it is theoretically possible for an attacker
   to  insert  arbitrary  code into a running program. This code would be
   executed with the permissions of the vulnerable program.

II. Impact

   This vulnerability may introduce vulnerabilities into any program that
   includes  the  affected library. Depending upon how and where the zlib
   routines   are   called   from   the   given  program,  the  resulting
   vulnerability may have one or more of the following impacts: denial of
   service, information leakage, or execution of arbitrary code.

III. Solution

Upgrade your version of zlib

   The  maintainers  of  zlib have released version 1.1.4 to address this
   vulnerability.  Any software that is linked against or derived from an
   earlier  version  of  zlib  should be upgraded immediately. The latest
   version of zlib is available at http://www.zlib.org

   The md5 sums of the source archives are:
       abc405d0bdd3ee22782d7aa20e440f08  zlib-1.1.4.tar.gz
       ea16358be41384870acbdc372f9db152  zlib-1.1.4.tar.bz2

IV. Acknowledgments

Thanks to Owen Taylor and Mark Cox of Redhat, Inc. for the
reporting and research of this vulnerability.


This document is available from
http://www.gzip.org/zlib/advisory-2002-03-11.txt

The public PGP key of zlib author Jean-loup Gailly is available from
http://www.gzip.org/zlib/jloup.asc

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8jSR02aJ9JQGWcacRAuDEAKCWdrRkWeJV9lYU5z8NN56s3m8eKACglR4m
42KDUGHuftBkwACTMCnZLEo=
=3yLS
-----END PGP SIGNATURE-----
@
text
@d3 2
a4 2
is bundled with SimGear.  You must have zlib installed before you can
build SimGear.
@


1.1
log
@Removed metakit and zlib from the configure/build process.  The
developer will need to build and install these separately if they
don't have packages already installed by their system.  See
README.metakit and README.zlib for more details.

As a convenience, pristine tarballs of the metakit and zlib source
code trees are included with the simgear distribution (and cvs.)
@
text
@d26 2
a27 1
zlib 1.1.3 is a general purpose data compression library.  All the code
d30 1
a30 1
ftp://ds.internic.net/rfc/rfc1950.txt (zlib format), rfc1951.txt (deflate
d43 1
a43 1
should work for most machines. For Unix: "configure; make test; make install"
d47 1
a47 1
Questions about zlib should be sent to <zlib@@quest.jpl.nasa.gov>, or to
d49 2
a50 3
The zlib home page is http://www.cdrom.com/pub/infozip/zlib/
The official zlib ftp site is ftp://ftp.cdrom.com/pub/infozip/zlib/
Before reporting a problem, please check those sites to verify that
d54 4
a57 1
Mark Nelson <markn@@tiny.com> wrote an article about zlib for the Jan. 1997
d59 1
a59 1
http://web2.airmail.net/markn/articles/zlibtool/zlibtool.htm
d61 2
a62 2
The changes made in version 1.1.3 are documented in the file ChangeLog.
The main changes since 1.1.2 are:
d64 12
a75 14
- fix "an inflate input buffer bug that shows up on rare but persistent
  occasions" (Mark)
- fix gzread and gztell for concatenated .gz files (Didier Le Botlan)
- fix gzseek(..., SEEK_SET) in write mode
- fix crc check after a gzeek (Frank Faubert)
- fix miniunzip when the last entry in a zip file is itself a zip file
  (J Lillge)
- add contrib/asm586 and contrib/asm686 (Brian Raiter)
  See http://www.muppetlabs.com/~breadbox/software/assembly.html
- add support for Delphi 3 in contrib/delphi (Bob Dellaca)
- add support for C++Builder 3 and Delphi 3 in contrib/delphi2 (Davide Moretti)
- do not exit prematurely in untgz if 0 at start of block (Magnus Holmgren)
- use macro EXTERN instead of extern to support DLL for BeOS (Sander Stoks)
- added a FAQ file
a76 1
plus many changes for portability.
d80 1
a80 1
A Java implementation of zlib is available in the Java Development Kit 1.1
d82 1
a82 1
See the zlib home page http://www.cdrom.com/pub/infozip/zlib/ for details.
d85 2
a86 2
is in the CPAN (Comprehensive Perl Archive Network) sites, such as:
ftp://ftp.cis.ufl.edu/pub/perl/CPAN/modules/by-module/Compress/Compress-Zlib*
d145 1
a145 1
 (C) 1995-1998 Jean-loup Gailly and Mark Adler
@

