buninu-linux 0.17.60 → 0.18.62

package/NOTICE.md

@@ -156,83 +156,83 @@ the built image redistributes them.
 - License: GPL-2.0-only WITH Linux-syscall-note
 - See: `LICENSES/GPL-2.0.txt` and `LICENSES/Linux-syscall-note.txt`
 
-Linux 6.18.60 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
-The default build uses package `linux-virt`, version 6.18.60-r0.
-`--linux-lts` and `--real` use package `linux-lts`, version 6.18.60-r0.
+Linux 6.18.62 as packaged by Alpine Linux 3.24 from the `linux-lts` aport.
+The default build uses package `linux-virt`, version 6.18.62-r0.
+`--linux-lts` and `--real` use package `linux-lts`, version 6.18.62-r0.
 Each comes from the x86_64 or aarch64 repository to match `--arch`. All
 listed modules are the selected package's `.ko.gz` files decompressed without
 modification.
 
-- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.60.tar.xz
+- Upstream source: https://cdn.kernel.org/pub/linux/kernel/v6.x/linux-6.18.62.tar.xz
 - Alpine build recipe, configuration and patches (Corresponding Source),
-  pinned to the commit shipping 6.18.60-r0 (the same for both architectures):
-  https://gitlab.alpinelinux.org/alpine/aports/-/blob/97a4e7b01d88cdec22ef3a5d30247628dc14d8bc/main/linux-lts/APKBUILD
+  pinned to the commit shipping 6.18.62-r0 (the same for both architectures):
+  https://gitlab.alpinelinux.org/alpine/aports/-/blob/4835e466ec80d5c31c181fa130a10dc81af60c1c/main/linux-lts/APKBUILD
 - Packages:
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.60-r0.apk
-  SHA-256 `3ff658cf5aada14687238527f48526cef7a75ac8c673fc597f3a65791c86a25e`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.60-r0.apk
-  SHA-256 `f205a980e1d683414f5557d26366bee1e52cf128613aa74ef371b3f11b019085`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.60-r0.apk
-  SHA-256 `b931f14a93634469cc8930afe5d6837361325456b620b94e970bb981d841c99c`
-  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.60-r0.apk
-  SHA-256 `4d398f1d401597da5e92fa7c3c1af93c4a9988b3747222c0173bfe3ff4cfe4a2`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-virt-6.18.62-r0.apk
+  SHA-256 `e121b547d9b86194a641718b52ae1c3e605085c59f31525b1649a59b3d4db0c7`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/x86_64/linux-lts-6.18.62-r0.apk
+  SHA-256 `2e03d0d13959a369764d8d24d51844634d1fd6973a523f4e49166a300c782a06`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-virt-6.18.62-r0.apk
+  SHA-256 `3a9a0f16adaabee0e4e05e373682249e2a99ab000faebf6aaaf682ae575c661d`
+  https://dl-cdn.alpinelinux.org/alpine/v3.24/main/aarch64/linux-lts-6.18.62-r0.apk
+  SHA-256 `29d6cbf6f432667d5d17080037b3cfd4d28d71c3b0ecb4ad7e53438abf9f24e7`
 
 SHA-256 of files in the default x86_64 `linux-virt` image:
 
 ```text
-kernel/x86_64/vmlinuz-virt   1e8ac7aebfab3f0fcb443eae94ad320efbbda51be91b928c32ca1740b44ebe9d
-failover.ko                  38da7006965e9595c08ebf062bd681bf991d1b1d4356363e9af9b16731781992
-net_failover.ko              a753488889d8b5b0289542ffcf734c7802da2bc6fa7605feab96381d085880e3
-virtio_net.ko                a369f7726343f67f1ec3f12c42024fa873d988ff3922efb0c75eb53d79c5d280
+kernel/x86_64/vmlinuz-virt   fb646e37ddfe23cb9cbe1127eb641895adaaa4e6062d66eee11f9b2240d952c7
+failover.ko                  7417b9cbde8a6b751a9d5d434c3334f80025637fba4b5812fca826426de2f5f4
+net_failover.ko              9948da8f68df63dc07567f2f8f208fb1d3c917f54766d17e8a95533bd9d5224e
+virtio_net.ko                84f6faa9484b46f0903e1de80c68a4327340bb9f736ae465e5fde4b12e902caa
 ```
 
 SHA-256 of files in an x86_64 `--linux-lts` image:
 
 ```text
-kernel/x86_64/vmlinuz-lts   4b7fd8c62d98e10fec5cad572a2e5e4446ab8c83db06015521824556514581fc
-failover.ko                 8c2dba793b09615556234ea62455173c47c012a08f5f147a24e2138a7123b8e3
-net_failover.ko             595eb1fc7cf568ecb06b1364b075dc4d818fe9582243625d38295699df54f92b
-virtio_net.ko               35836c6a68aa6aaaafbe9c8bdd796c45a3cb8b2cfe943d09a5dbcc62e1039646
-virtio_ring.ko              791e3c91f6abab031e1585a869e054f29e0093b072793f4ef0468ba61c31b82b
-virtio.ko                   11ea2958363dce81c4df8f325bdd8aba417205c2cbc802429b61abbaa34096d2
-virtio_pci_legacy_dev.ko    515994aafbd6a6cb3543daa1fa0791135640212afede68e63f353877182f865c
-virtio_pci_modern_dev.ko    7fda960c51fa394d1e1a7686060a1919985ff173af3b74c50a160d0a0c8160a2
-virtio_pci.ko               1dcb0fad10f95e3fb2b7704efb4ab3090fd0fc43e4961606372fe56b1e0cb016
+kernel/x86_64/vmlinuz-lts   3504e27e6802231fed95f12e46998e73bfe1653a8ca682d448cdc559bbfc6e3e
+failover.ko                 386a443826c168bb796168d3a9916b01980e69f310c4485001168e5cbf9bf245
+net_failover.ko             16d9fff3e30b17d0a8875154dd0ef837f2518390c49cf8683d83613c503d05cf
+virtio_net.ko               1b384bd50f94e451c52b8475f7dd7c5eb5386e79b79217e91c8f4ef04f68a1eb
+virtio_ring.ko              e13bb8a3ca15f8dec60c12481cd258170ea973934a1747c8dcf42a04ba0f5423
+virtio.ko                   403c140a1063a0e4189339582db77315d7896d136c8b677a8cc4947bd6dfa235
+virtio_pci_legacy_dev.ko    a3554a7cacbbe417b3c4f0f3bf6a5ed556776ee30337375bf99623c30e6c9943
+virtio_pci_modern_dev.ko    3314bb829a4404b979dc09f342b133b9af3d4c184e4fc61beaa566b49b0407dd
+virtio_pci.ko               5163698dd42cf2a221f58982b1fbcc58d915ec78e9adfca44f09efd3493e71a1
 ```
 
 `--real` additionally includes the following modules from that same
 x86_64 `linux-lts` package for physical xHCI controllers and USB HID keyboards:
 
 ```text
-usb-common.ko               1ac8dea6b468dd4428329003f5161e2184dbec9d2af671736581b8dccbed2aa9
-usbcore.ko                  1121a6019673800300056a587fbf0d71de252a3c7f1aafe534111bf4e34f3a75
-xhci-hcd.ko                 523a5610eee78a342e07305dbad2b7b0a422eff6f0efe7cc4d10bc03185d678a
-xhci-pci.ko                 6ae655f06532ec56b3f93e1909e10bce0acf7f5166825461152c706817b5b926
-xhci-pci-renesas.ko         59be69cceeb3ab918b4bd070da23bd91d9bf81f9627d0c57abc13fd3e2ebd997
-hid.ko                      e7cf5abe7e29b50ea9fae671b5d0a42d0cf4c7415e30b3e127d77d00ea37cd7d
-hid-generic.ko              c9082124336d616a489784a117670f83075c0e4bdf0253ffd2fbddf093452efc
-usbhid.ko                   a764883e8831a14d500328af3723d4a5dbb20d3ddf92f9ec7d4136392b6dd539
+usb-common.ko               e441b7fa844c3f745e996d270df9c0c193ebffaed86da2af09c2808e5f5c6e51
+usbcore.ko                  242fa924fa31c3f09e5539f7814d71349d8393920957a1646ce693520ea709f0
+xhci-hcd.ko                 10258014a4e2b82d446731a9816caa305cd6ec01568b1ae83692e6ce72ae76eb
+xhci-pci.ko                 b8ecc6e8abdd74609ffd26e04bf9511ad2281118319bbe550ce7a32a2148c735
+xhci-pci-renesas.ko         1e24d082466dfd29dc97eb3ac0a45e78290cb3c708da6d46760f281499f6040d
+hid.ko                      550ffcb449bbc7e586f594b9bf737260c7be962885a310914f272d20ab903d8a
+hid-generic.ko              26b65cd98dbe3df707458bb2e88cc4d7b106676740bc9775fe932dfe66884672
+usbhid.ko                   c71f82a76f7cdf16d04ac01270ab959c7e01db3ef55d7e72a447e2be27820220
 ```
 
 SHA-256 of files in the default aarch64 `linux-virt` image:
 
 ```text
-kernel/aarch64/vmlinuz-virt  cd05fed9e617b5df93dc62ece9b78c422fd94e9b432a2f7c092714b139d5eef4
-failover.ko                  3326352b8cbb89fb1b1281588ec03318175ad8151253da97a50b2180e4e24358
-net_failover.ko              7b0b21b6992453ca6b525f816982b7d2b2aec7cdac66ee6a7a57a3506fbef5ce
-virtio_net.ko                5e66ddb9e20b5401808a792e245f9c6165654da7fb6b6274df8b33260500d8d2
+kernel/aarch64/vmlinuz-virt  019381933096984ffe4d559969db30b59e223fcfd3a0f349cc7b2b7fd0b9f2bb
+failover.ko                  6eb84d8bb29606c40f645101929058d8c1a2226b81f86e1d477ce5292677b1f9
+net_failover.ko              3c4800183b9aadb57b4d7406e17a7dc62dc1955f69eedd52194f0d575fd85e43
+virtio_net.ko                2421ef2c32dd39a9d9d17e20849eb235e0e98d0698f9f3b239839c5367cad3b2
 ```
 
 SHA-256 of files in an aarch64 `--linux-lts` image:
 
 ```text
-kernel/aarch64/vmlinuz-lts  5ad2bbfaaaf6323f1ae3eef4ca392047413cb397a0d5421ec0f0f450b0ada35e
-failover.ko                 dcd9538f66ecb0ab2aa7d2da8262ab499197899b858eafe73ea322a4d81d587d
-net_failover.ko             3570053bf89cdf54fd7188af34150ff2019405cc4018f8dcf02a369f8de71ed8
-virtio_net.ko               1254fc3018a319b59cafca3f68632ad739e4e8529b5684062c278a21c85c2784
-virtio_pci_legacy_dev.ko    e57ab0e3f977104fa9127755af28d450dd459689b99a230066e0f9c43710df04
-virtio_pci_modern_dev.ko    1b7b21794f360313a6d7f08d6257892c7932ffcc397eb1dbfb6d128f472d7bef
-virtio_pci.ko               b7529e676e5237a1b25b2675320526084a6f78c512863e6da6f8ad6aa1e927fb
+kernel/aarch64/vmlinuz-lts  a411fa2f9234162c393c63c697b482c2a63702a4d06951c0e85a0ca5ad97cd28
+failover.ko                 9c7a6e582e0e2d2eb911d0181ade7cdc28b9cfbbcb4331e87ce9ce18005e93c5
+net_failover.ko             4cfe47683cdf4ced4400069c52890595c418d81bfa3cc44f6e523278823c5326
+virtio_net.ko               9eda63780001f09d30c917feea11b2d319a5656aaed61bce48b2bdbef5826af2
+virtio_pci_legacy_dev.ko    ae3ee1f0fec521295b3fe078a271864c484a1177a7099e85930dab9d0d0cc9d5
+virtio_pci_modern_dev.ko    f5d23038fd725d9ca5cef5f1d0c982490be9350a203fe8bc0a82c7939630a789
+virtio_pci.ko               e02dc0d67bcfd28030db4f7af6b42cb6ea3118f6527ebeab59f379c4d27ff913
 ```
 
 ### linuxx64.efi.stub and linuxaa64.efi.stub

package/README.md

@@ -1415,7 +1415,7 @@ initramfs/                init.js, commands, userspace: the same for every archi
 native/<arch>/            musl and the GCC runtime (committed); bun and modules (fetched)
 ```
 
-The `--real` inputs are Alpine v3.24 `linux-lts-6.18.60-r0`, musl `1.2.6-r2`,
+The `--real` inputs are Alpine v3.24 `linux-lts-6.18.62-r0`, musl `1.2.6-r2`,
 `systemd-efistub-260.2-r0`, `libstdc++`/`libgcc` `15.2.0-r5`, and Bun 1.4.2
 `linux-x64-musl-baseline`. The aarch64 guest uses the same versions from
 Alpine's aarch64 repository and Bun's `linux-aarch64-musl`. There is no BusyBox
@@ -1577,7 +1577,7 @@ The physical boot chain is firmware → the UKI stub → its embedded
 and, with the currently pinned kernel, embeds this complete command line:
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Serial kernel logging is retained, while the final console makes
@@ -1601,7 +1601,7 @@ the same way). Build without `--real`; this selects Alpine `linux-virt`, omits t
 module set, and puts `ttyS0` last so serial stdio owns `/dev/console`:
 
 ```text
-console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-virt rdinit=/bin/bun -- -e import('/init.js')
+console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-virt rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 Build and boot it with:
@@ -1724,7 +1724,7 @@ The default `--real` image embeds this kernel command line (shown for the
 currently pinned LTS release):
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 The physical display (`tty0`) is the final console and therefore owns PID 1's

package/README.zh.md

@@ -1415,7 +1415,7 @@ initramfs/                init.js, commands, userspace: the same for every archi
 native/<arch>/            musl and the GCC runtime (committed); bun and modules (fetched)
 ```
 
-`--real` 的輸入為 Alpine v3.24 `linux-lts-6.18.60-r0`、musl
+`--real` 的輸入為 Alpine v3.24 `linux-lts-6.18.62-r0`、musl
 `1.2.6-r2`、`systemd-efistub-260.2-r0`、`libstdc++`／`libgcc`
 `15.2.0-r5`，以及 Bun 1.4.2 `linux-x64-musl-baseline`。aarch64
 客體使用 Alpine aarch64 儲存庫的相同版本與 Bun 的 `linux-aarch64-musl`。
@@ -1577,7 +1577,7 @@ MiB 對齊，尾端保留 34 個磁區
 包含 xHCI 與 USB HID 模組鏈，目前鎖定核心使用以下完整命令列：
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 保留序列核心日誌，最後指定的主控台則讓
@@ -1601,7 +1601,7 @@ pkg install qemu-system-x86-64
 機模組集，並將 `ttyS0` 放最後，讓序列標準輸入輸出擁有 `/dev/console`：
 
 ```text
-console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-virt rdinit=/bin/bun -- -e import('/init.js')
+console=tty0 console=ttyS0,115200 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-virt rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 使用以下命令建置並開機：
@@ -1724,7 +1724,7 @@ Bun 腳本。`--help` 使用 `Bun.markdown.ansi`
 鎖定的 LTS 版本）：
 
 ```text
-console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.60-0-lts rdinit=/bin/bun -- -e import('/init.js')
+console=ttyS0,115200 console=tty0 REAL_MACHINE=1 panic=0 PATH=/bin KERNEL_RELEASE=6.18.62-0-lts rdinit=/bin/bun -- -e import('/init.js')
 ```
 
 實體螢幕（`tty0`）是最後指定的主控台，因此擁有 PID 1 的

package/initramfs/bin/tar

@@ -142,7 +142,7 @@ const octal = (block, offset, length) => {
 };
 
 // The header checksum is computed with its own field read as spaces. A
-// mismatch means this is not a tar header, so scanning stops there.
+// mismatch rejects the archive instead of reporting a partial listing.
 const checksumMatches = (block) => {
   let sum = 0;
   for (let index = 0; index < BLOCK; index++) {
@@ -151,16 +151,19 @@ const checksumMatches = (block) => {
   return sum === octal(block, 148, 8);
 };
 
+// Each record's length counts bytes, so the records are cut from the bytes and decoded one by one;
+// cutting a decoded string by that length breaks on any multi-byte name.
 const paxRecords = (data) => {
-  const records = {};
+  const records = Object.create(null);
   let offset = 0;
-  const content = decoder.decode(data);
-  while (offset < content.length) {
-    const space = content.indexOf(" ", offset);
-    if (space === -1) break;
-    const length = Number.parseInt(content.slice(offset, space), 10);
-    if (!Number.isFinite(length) || length <= 0) break;
-    const record = content.slice(space + 1, offset + length).replace(/\n$/, "");
+  while (offset < data.length) {
+    const space = data.indexOf(0x20, offset);
+    if (space === -1) throw new Error("invalid pax record length");
+    const digits = decoder.decode(data.subarray(offset, space));
+    const length = /^[0-9]+$/.test(digits) ? Number(digits) : NaN;
+    if (!Number.isSafeInteger(length) || length <= space - offset + 1 || length > data.length - offset
+        || data[offset + length - 1] !== 10) throw new Error("invalid pax record length");
+    const record = decoder.decode(data.subarray(space + 1, offset + length)).replace(/\n$/, "");
     const equals = record.indexOf("=");
     if (equals > 0) records[record.slice(0, equals)] = record.slice(equals + 1);
     offset += length;
@@ -174,13 +177,14 @@ const entryKinds = {
 };
 
 // Every member of the archive, in order, as { name, kind, target, size, mode,
-// mtime }. Returns null when the bytes do not parse as tar.
+// mtime }. Reject malformed input before listing or extracting any members.
 const scanEntries = (bytes) => {
   const entries = [];
   let offset = 0;
   let longName = null;
   let longTarget = null;
   let extended = {};
+  let global = {};
   let ended = false;
   entries.concatenated = false;
   while (offset + BLOCK <= bytes.length) {
@@ -191,13 +195,24 @@ const scanEntries = (bytes) => {
       ended = true;
       longName = longTarget = null;
       extended = {};
+      global = {};
       continue;
     }
-    if (!checksumMatches(block)) return entries.length ? entries : null;
+    if (!checksumMatches(block)) throw new Error("invalid tar header checksum");
     if (ended) { entries.concatenated = true; ended = false; }
     const flag = String.fromCharCode(block[156] || 0x30);
-    const size = extended.size !== undefined ? Number(extended.size) : octal(block, 124, 12);
+    // Extension records use their own header size, never the preceding pax size.
+    const metadata = ["L", "K", "x", "X", "g"].includes(flag);
+    const attrs = { ...global, ...extended };
+    const digits = text(block, 124, 12).trim();
+    if (!(block[124] & 0x80) && digits && !/^[0-7]+$/.test(digits))
+      throw new Error("invalid tar member size");
+    if (!metadata && attrs.size !== undefined && !/^[0-9]+$/.test(attrs.size))
+      throw new Error("invalid pax member size");
+    const size = !metadata && attrs.size !== undefined ? Number(attrs.size) : octal(block, 124, 12);
     const dataBlocks = Math.ceil(size / BLOCK) * BLOCK;
+    if (!Number.isSafeInteger(size) || size < 0 || !Number.isSafeInteger(dataBlocks)
+        || dataBlocks > bytes.length - offset) throw new Error("invalid or truncated tar member size");
     const data = bytes.subarray(offset, offset + size);
     if (flag === "L" || flag === "K") {
       const value = decoder.decode(data).replace(/\0+$/, "");
@@ -211,13 +226,14 @@ const scanEntries = (bytes) => {
       continue;
     }
     if (flag === "g") {
+      global = { ...global, ...paxRecords(data) };
       offset += dataBlocks;
       continue;
     }
-    const prefix = text(block, 345, 155);
+    const prefix = text(block, 257, 5) === "ustar" ? text(block, 345, 155) : "";
     const stored = text(block, 0, 100);
-    const name = extended.path ?? longName ?? (prefix ? `${prefix}/${stored}` : stored);
-    const target = extended.linkpath ?? longTarget ?? text(block, 157, 100);
+    const name = attrs.path ?? longName ?? (prefix ? `${prefix}/${stored}` : stored);
+    const target = attrs.linkpath ?? longTarget ?? text(block, 157, 100);
     entries.push({
       name: name.replace(/^\.\//, ""),
       archiveName: name,
@@ -233,6 +249,7 @@ const scanEntries = (bytes) => {
     extended = {};
     offset += dataBlocks;
   }
+  if (offset !== bytes.length) throw new Error("truncated tar header");
   return entries;
 };
 

package/initramfs/bin/unzip

@@ -7,7 +7,7 @@
 // MEMBER operands may be wildcards. Unix modes and symlinks are restored.
 // Runs under node as well as bun.
 
-import { chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
+import { constants, chmodSync, closeSync, fstatSync, lstatSync, mkdirSync, openSync, readSync, rmSync, symlinkSync, writeFileSync, writeSync } from "node:fs";
 import { basename, dirname, join, normalize, resolve } from "node:path";
 import { inflateRawSync } from "node:zlib";
 import { crc32 } from "../lib/crc32.js";
@@ -61,11 +61,23 @@ if (operands.length === 0) usage();
 const [archive, ...patterns] = operands;
 
 const fd = (() => {
-  try { return openSync(archive, "r"); } catch (error) { return fail(`cannot open ${archive}: ${error.message}`, 9); }
+  try { return openSync(archive, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0)); } catch (error) { return fail(`cannot open ${archive}: ${error.message}`, 9); }
 })();
-const size = fstatSync(fd).size;
+const info = fstatSync(fd);
+if (!info.isFile()) fail(`${archive}: not a regular file`, 3);
+const size = info.size;
+const validSize = (value) => Number.isSafeInteger(value) && value >= 0;
+const uint64 = (buffer, offset) => {
+  const value = buffer.readBigUInt64LE(offset);
+  if (value > BigInt(Number.MAX_SAFE_INTEGER)) fail(`${archive}: ZIP64 value exceeds safe integer range`, 3);
+  return Number(value);
+};
 const read = (position, length) => {
-  const buffer = Buffer.alloc(length);
+  if (!validSize(position) || !validSize(length) || position > size || length > size - position)
+    fail(`${archive}: invalid or truncated archive range`, 3);
+  let buffer;
+  try { buffer = Buffer.alloc(length); }
+  catch { fail(`${archive}: cannot allocate member buffer`, 3); }
   let done = 0;
   while (done < length) {
     const count = readSync(fd, buffer, done, length - done, position + done);
@@ -80,28 +92,59 @@ const tailLength = Math.min(size, 65557);
 const tail = read(size - tailLength, tailLength);
 let eocd = -1;
 for (let offset = tailLength - 22; offset >= 0; offset--) {
-  if (tail.readUInt32LE(offset) === 0x06054b50) { eocd = offset; break; }
+  if (tail.readUInt32LE(offset) === 0x06054b50 && offset + 22 + tail.readUInt16LE(offset + 20) === tail.length) { eocd = offset; break; }
 }
 if (eocd < 0) fail(`${archive}: not a zip archive (no end of central directory)`, 9);
+if (tail.readUInt16LE(eocd + 4) !== 0 || tail.readUInt16LE(eocd + 6) !== 0
+    || tail.readUInt16LE(eocd + 8) !== tail.readUInt16LE(eocd + 10))
+  fail(`${archive}: split archives are not supported`, 3);
 let entryCount = tail.readUInt16LE(eocd + 10);
 let directorySize = tail.readUInt32LE(eocd + 12);
 let directoryOffset = tail.readUInt32LE(eocd + 16);
+let directoryLimit = size - tailLength + eocd;
 // zip64: the locator sits just before the end of central directory record.
 if (eocd >= 20 && tail.readUInt32LE(eocd - 20) === 0x07064b50) {
-  const record = read(Number(tail.readBigUInt64LE(eocd - 20 + 8)), 56);
+  if (tail.readUInt32LE(eocd - 16) !== 0 || tail.readUInt32LE(eocd - 4) !== 1)
+    fail(`${archive}: split ZIP64 archives are not supported`, 3);
+  const recordOffset = uint64(tail, eocd - 20 + 8);
+  if (recordOffset > directoryLimit - 20 - 56) fail(`${archive}: invalid ZIP64 record range`, 3);
+  const record = read(recordOffset, 56);
   if (record.readUInt32LE(0) !== 0x06064b50) fail(`${archive}: bad zip64 end of central directory`, 3);
-  entryCount = Number(record.readBigUInt64LE(32));
-  directorySize = Number(record.readBigUInt64LE(40));
-  directoryOffset = Number(record.readBigUInt64LE(48));
+  if (record.readUInt32LE(16) !== 0 || record.readUInt32LE(20) !== 0
+      || uint64(record, 24) !== uint64(record, 32) || uint64(record, 4) < 44)
+    fail(`${archive}: invalid or split ZIP64 directory`, 3);
+  if (uint64(record, 4) > directoryLimit - 20 - recordOffset - 12)
+    fail(`${archive}: truncated ZIP64 record`, 3);
+  directoryLimit = recordOffset;
+  entryCount = uint64(record, 32);
+  directorySize = uint64(record, 40);
+  directoryOffset = uint64(record, 48);
 }
 
+// Info-ZIP writes UTF-8 names without the 0x800 flag, so a name that decodes as UTF-8 is read as
+// UTF-8 and only the rest as the old code page's stand-in, latin1.
+const strictUtf8 = new TextDecoder("utf-8", { fatal: true });
+const memberName = (raw, flags) => {
+  if (flags & 0x800) return raw.toString("utf8");
+  try { return strictUtf8.decode(raw); } catch { return raw.toString("latin1"); }
+};
+
 const entries = [];
-const central = read(directoryOffset, directorySize);
-for (let offset = 0, index = 0; index < entryCount; index++) {
+if (!validSize(entryCount) || !validSize(directorySize) || !validSize(directoryOffset)
+    || directoryOffset > directoryLimit || directorySize > directoryLimit - directoryOffset
+    || entryCount > Math.floor(directorySize / 46)) fail(`${archive}: invalid central directory bounds`, 3);
+let directoryPosition = 0;
+for (let index = 0; index < entryCount; index++) {
+  if (directorySize - directoryPosition < 46) fail(`${archive}: truncated central directory`, 3);
+  const header = read(directoryOffset + directoryPosition, 46);
+  const entryLength = 46 + header.readUInt16LE(28) + header.readUInt16LE(30) + header.readUInt16LE(32);
+  if (entryLength > directorySize - directoryPosition) fail(`${archive}: truncated central entry`, 3);
+  // Read one bounded entry instead of allocating the untrusted whole-directory size.
+  const central = read(directoryOffset + directoryPosition, entryLength), offset = 0;
+  if (central.readUInt16LE(34) !== 0) fail(`${archive}: split members are not supported`, 3);
   if (central.readUInt32LE(offset) !== 0x02014b50) fail(`${archive}: bad central directory entry ${index}`, 3);
   const nameLength = central.readUInt16LE(offset + 28);
   const extraLength = central.readUInt16LE(offset + 30);
-  const commentLength = central.readUInt16LE(offset + 32);
   const flags = central.readUInt16LE(offset + 8);
   const entry = {
     madeBy: central.readUInt16LE(offset + 4) >> 8,
@@ -114,23 +157,33 @@ for (let offset = 0, index = 0; index < entryCount; index++) {
     size: central.readUInt32LE(offset + 24),
     external: central.readUInt32LE(offset + 38),
     localOffset: central.readUInt32LE(offset + 42),
-    name: central.toString(flags & 0x800 ? "utf8" : "latin1", offset + 46, offset + 46 + nameLength),
+    name: memberName(central.subarray(offset + 46, offset + 46 + nameLength), flags),
   };
   // zip64 extra field: the 0xFFFFFFFF fields follow, in this order.
   const extra = central.subarray(offset + 46 + nameLength, offset + 46 + nameLength + extraLength);
-  for (let position = 0; position + 4 <= extra.length;) {
+  const required64 = ["size", "compressedSize", "localOffset"].filter(key => entry[key] === 0xffffffff);
+  let found64 = false;
+  for (let position = 0; position < extra.length;) {
+    if (extra.length - position < 4) fail(`${archive}: truncated extra field`, 3);
     const id = extra.readUInt16LE(position);
     const length = extra.readUInt16LE(position + 2);
-    if (id === 0x0001) {
+    if (length > extra.length - position - 4) fail(`${archive}: truncated extra field`, 3);
+    if (id === 0x0001 && !found64) {
+      found64 = true;
       let field = position + 4;
-      for (const key of ["size", "compressedSize", "localOffset"]) {
-        if (entry[key] === 0xffffffff) { entry[key] = Number(extra.readBigUInt64LE(field)); field += 8; }
+      for (const key of required64) {
+        if (field + 8 > position + 4 + length) fail(`${archive}: truncated ZIP64 extra field`, 3);
+        entry[key] = uint64(extra, field); field += 8;
       }
     }
     position += 4 + length;
   }
+  if (required64.length && !found64) fail(`${archive}: missing ZIP64 extra field`, 3);
+  if (entry.localOffset > directoryOffset || directoryOffset - entry.localOffset < 30
+      || entry.compressedSize > directoryOffset - entry.localOffset - 30)
+    fail(`${archive}: invalid member range`, 3);
   entries.push(entry);
-  offset += 46 + nameLength + extraLength + commentLength;
+  directoryPosition += entryLength;
 }
 
 // Bun.Glob when running under Bun; elsewhere the wildcards become a RegExp:
@@ -165,10 +218,12 @@ const data = (entry) => {
   const local = read(entry.localOffset, 30);
   if (local.readUInt32LE(0) !== 0x04034b50) throw new Error("bad local header");
   const start = entry.localOffset + 30 + local.readUInt16LE(26) + local.readUInt16LE(28);
+  if (!validSize(start) || start > directoryOffset || entry.compressedSize > directoryOffset - start)
+    throw new Error("invalid member data range");
   const raw = read(start, entry.compressedSize);
   let bytes;
   if (entry.method === 0) bytes = raw;
-  else if (entry.method === 8) bytes = inflateRawSync(raw);
+  else if (entry.method === 8) bytes = inflateRawSync(raw, { maxOutputLength: Math.max(1, entry.size) });
   else throw new Error(`compression method ${entry.method} is not supported`);
   if (bytes.length !== entry.size) throw new Error(`size mismatch (${bytes.length} != ${entry.size})`);
   if (crc32(bytes) !== entry.crc) throw new Error("CRC error");

package/initramfs/buninu/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.7.1 - 2026-11-08
+
+- Sync jsgotty to 1.4.2-rc0:
+  * Add browser Kitty-frame flow control: limit unacknowledged replaceable
+    image placements to two, coalesce pending updates for the same placement,
+    and pause delivery while the page is hidden. Ordinary terminal output and
+    CLI clients keep their existing ordered path.
+  * Negotiate the capability per WebSocket and acknowledge image placement
+    after decoding, preventing a suspended browser from accumulating stale
+    frames that replay when it returns to the foreground.
+  * Add automated server/browser flow tests and manual FPS diagnostic helpers.
+- Sync bunmsh to 0.4.2:
+  * Extend `find` with grouped expressions, negation, AND/OR precedence,
+    short-circuit actions, `-prune` and `-exec` with bounded `+` batches.
+  * Stream uncaptured results during traversal while preserving command
+    substitution, pipeline capture and redirection behavior.
+  * Retain submitted interactive lines received while waiting for terminal
+    cursor-position replies, and allow slow terminals up to 400 ms to reply.
+
 ## 0.7.0 - 2026-10-26
 
 - Sync jsgotty to 1.4.0:

package/initramfs/buninu/apps/bunmsh/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable user-visible changes to bunmsh are documented here.
 
+## [0.4.2] - 2026-11-08
+
+### Added and fixed
+
+- Extend builtin `find` with grouped expressions, negation, AND/OR precedence,
+  short-circuit actions and `-prune`. Support `-exec` with `;` and bounded `+`
+  batches, and report invalid expressions as command errors.
+- Stream uncaptured `find` results during traversal while preserving command
+  substitutions, pipeline captures and stdout/stderr redirection order.
+- Increase the interactive cursor-position query timeout from 60 ms to 400 ms
+  for slow terminals when checking output without a trailing newline.
+- Preserve commands submitted while waiting for cursor-position replies instead
+  of losing buffered input lines.
+
+### Tests
+
+- Isolate builtin assertions from host utilities and descriptor-redirection
+  assertions from inherited console-color settings.
+- Expand coverage for `find` expressions, execution, streaming and capture
+  isolation, plus immediate, delayed and missing terminal cursor replies.
+
 ## [0.4.1] - 2026-10-13
 
 - Fixed awk bypassing linker protection

package/initramfs/buninu/apps/bunmsh/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunmsh",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Cross-platform command shell for Bun JavaScript",
   "license": "MIT",
   "type": "module",