Move to flat package hierarchy

Note to self: never try to move submodules again

To migrate your existing submodules (more or less):

	set -x
	set -e

	mkdir .git/modules/pkg
	for old in */*/src ; do
	        new="pkg/${old#*/}"
	        if ! [ -f "$old/.git" ] || [ "${old%%/*}" = pkg ] ; then
			continue
		fi
		git -C ".git/modules/$old" config core.worktree "../../../../../$new"
		rmdir "$new"
		mv "$old" "$new"
	        sed -e "s,$old,$new," "$new/.git" > "$new/.git.tmp"
	        mv "$new/.git.tmp" "$new/.git"
		mkdir ".git/modules/${new%/src}"
	        mv ".git/modules/$old" ".git/modules/$new"

		rm "${old%/src}"/*.ninja
		mv "${old%/src}"/*.tar.{gz,xz,bz2} "${new%/src}/"
		rmdir "${old%/src}" || true
	done
	sed -e 's,^\[submodule "[^/]*/,[submodule "pkg/,' .git/config > .git/config.tmp
	mv .git/config.tmp .git/config

13 files changed, 875 insertions, 0 deletions

diff --git a/pkg/unzip/patch/0001-Drop-L-suffix-from-man-page-sections.patch b/pkg/unzip/patch/0001-Drop-L-suffix-from-man-page-sections.patch
new file mode 100644
index 00000000..27d1f048
--- /dev/null
+++ b/pkg/unzip/patch/0001-Drop-L-suffix-from-man-page-sections.patch
@@ -0,0 +1,319 @@
+From 099364ef5cdd7801c9744815ef5ec75f5f267222 Mon Sep 17 00:00:00 2001
+From: Santiago Vila <sanvila@debian.org>
+Date: Thu, 16 Jun 2016 22:39:42 -0700
+Subject: [PATCH] Drop L suffix from man page sections
+
+From 01-manpages-in-section-1-not-in-section-1l in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ man/funzip.1   |  8 ++++----
+ man/unzip.1    | 24 ++++++++++++------------
+ man/unzipsfx.1 | 32 ++++++++++++++++----------------
+ man/zipgrep.1  |  8 ++++----
+ man/zipinfo.1  | 10 +++++-----
+ 5 files changed, 41 insertions(+), 41 deletions(-)
+
+diff --git a/man/funzip.1 b/man/funzip.1
+index 30206e4..a9b4195 100644
+--- a/man/funzip.1
++++ b/man/funzip.1
+@@ -20,7 +20,7 @@
+ .in -4n
+ ..
+ .\" =========================================================================
+-.TH FUNZIP 1L "20 April 2009 (v3.95)" "Info-ZIP"
++.TH FUNZIP 1 "20 April 2009 (v3.95)" "Info-ZIP"
+ .SH NAME
+ funzip \- filter for extracting from a ZIP archive in a pipe
+ .PD
+@@ -78,7 +78,7 @@ funzip test.zip > /dev/null
+ .EE
+ .PP
+ To use \fIzip\fP and \fIfunzip\fP in place of \fIcompress\fP(1) and
+-\fIzcat\fP(1) (or \fIgzip\fP(1L) and \fIgzcat\fP(1L)) for tape backups:
++\fIzcat\fP(1) (or \fIgzip\fP(1) and \fIgzcat\fP(1)) for tape backups:
+ .PP
+ .EX
+ tar cf \- . | zip \-7 | dd of=/dev/nrst0 obs=8k
+@@ -108,8 +108,8 @@ itself (future release).
+ .PD
+ .\" =========================================================================
+ .SH "SEE ALSO"
+-\fIgzip\fP(1L), \fIunzip\fP(1L), \fIunzipsfx\fP(1L), \fIzip\fP(1L),
+-\fIzipcloak\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L)
++\fIgzip\fP(1), \fIunzip\fP(1), \fIunzipsfx\fP(1), \fIzip\fP(1),
++\fIzipcloak\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1)
+ .PD
+ .\" =========================================================================
+ .SH URL
+diff --git a/man/unzip.1 b/man/unzip.1
+index 75a7060..eee43a9 100644
+--- a/man/unzip.1
++++ b/man/unzip.1
+@@ -20,7 +20,7 @@
+ .in -4n
+ ..
+ .\" =========================================================================
+-.TH UNZIP 1L "20 April 2009 (v6.0)" "Info-ZIP"
++.TH UNZIP 1 "20 April 2009 (v6.0)" "Info-ZIP"
+ .SH NAME
+ unzip \- list, test and extract compressed files in a ZIP archive
+ .PD
+@@ -34,7 +34,7 @@ unzip \- list, test and extract compressed files in a ZIP archive
+ \fIunzip\fP will list, test, or extract files from a ZIP archive, commonly
+ found on MS-DOS systems.  The default behavior (with no options) is to extract
+ into the current directory (and subdirectories below it) all files from the
+-specified ZIP archive.  A companion program, \fIzip\fP(1L), creates ZIP
++specified ZIP archive.  A companion program, \fIzip\fP(1), creates ZIP
+ archives; both programs are compatible with archives created by PKWARE's
+ \fIPKZIP\fP and \fIPKUNZIP\fP for MS-DOS, but in many cases the program
+ options or default behaviors differ.
+@@ -105,8 +105,8 @@ only a reminder of the basic \fIunzip\fP syntax rather than an exhaustive
+ list of all possible flags.  The exhaustive list follows:
+ .TP
+ .B \-Z
+-\fIzipinfo\fP(1L) mode.  If the first option on the command line is \fB\-Z\fP,
+-the remaining options are taken to be \fIzipinfo\fP(1L) options.  See the
++\fIzipinfo\fP(1) mode.  If the first option on the command line is \fB\-Z\fP,
++the remaining options are taken to be \fIzipinfo\fP(1) options.  See the
+ appropriate manual page for a description of these options.
+ .TP
+ .B \-A
+@@ -178,7 +178,7 @@ encrypted entries from the compressed size numbers.  Therefore,
+ compressed size and compression ratio figures are independent of the entry's
+ encryption status and show the correct compression performance.  (The complete
+ size of the encrypted compressed data stream for zipfile entries is reported
+-by the more verbose \fIzipinfo\fP(1L) reports, see the separate manual.)
++by the more verbose \fIzipinfo\fP(1) reports, see the separate manual.)
+ When no zipfile is specified (that is, the complete command is simply
+ ``\fCunzip \-v\fR''), a diagnostic screen is printed.  In addition to
+ the normal header with release date and version, \fIunzip\fP lists the
+@@ -379,8 +379,8 @@ file, skip extraction of all existing files, or rename the current file.
+ .TP
+ .B \-N
+ [Amiga] extract file comments as Amiga filenotes.  File comments are created
+-with the \-c option of \fIzip\fP(1L), or with the \-N option of the Amiga port
+-of \fIzip\fP(1L), which stores filenotes as comments.
++with the \-c option of \fIzip\fP(1), or with the \-N option of the Amiga port
++of \fIzip\fP(1), which stores filenotes as comments.
+ .TP
+ .B \-o
+ overwrite existing files without prompting.  This is a dangerous option, so
+@@ -598,7 +598,7 @@ Unix \fInice\fP(1).
+ As suggested by the examples above, the default variable names are UNZIP_OPTS
+ for VMS (where the symbol used to install \fIunzip\fP as a foreign command
+ would otherwise be confused with the environment variable), and UNZIP
+-for all other operating systems.  For compatibility with \fIzip\fP(1L),
++for all other operating systems.  For compatibility with \fIzip\fP(1),
+ UNZIPOPT is also accepted (don't ask).  If both UNZIP and UNZIPOPT
+ are defined, however, UNZIP takes precedence.  \fIunzip\fP's diagnostic
+ option (\fB\-v\fP with no zipfile name) can be used to check the values
+@@ -648,8 +648,8 @@ prompt for another password, and so on until all files are extracted.  If
+ a password is not known, entering a null password (that is, just a carriage
+ return or ``Enter'') is taken as a signal to skip all further prompting.
+ Only unencrypted files in the archive(s) will thereafter be extracted.  (In
+-fact, that's not quite true; older versions of \fIzip\fP(1L) and
+-\fIzipcloak\fP(1L) allowed null passwords, so \fIunzip\fP checks each encrypted
++fact, that's not quite true; older versions of \fIzip\fP(1) and
++\fIzipcloak\fP(1) allowed null passwords, so \fIunzip\fP checks each encrypted
+ file to see if the null password works.  This may result in ``false positives''
+ and extraction errors, as noted above.)
+ .PP
+@@ -943,8 +943,8 @@ deleted.
+ .PD
+ .\" =========================================================================
+ .SH "SEE ALSO"
+-\fIfunzip\fP(1L), \fIzip\fP(1L), \fIzipcloak\fP(1L), \fIzipgrep\fP(1L),
+-\fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L)
++\fIfunzip\fP(1), \fIzip\fP(1), \fIzipcloak\fP(1), \fIzipgrep\fP(1),
++\fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1)
+ .PD
+ .\" =========================================================================
+ .SH URL
+diff --git a/man/unzipsfx.1 b/man/unzipsfx.1
+index d9a0e59..533711f 100644
+--- a/man/unzipsfx.1
++++ b/man/unzipsfx.1
+@@ -20,7 +20,7 @@
+ .in -4n
+ ..
+ .\" =========================================================================
+-.TH UNZIPSFX 1L "20 April 2009 (v6.0)" "Info-ZIP"
++.TH UNZIPSFX 1 "20 April 2009 (v6.0)" "Info-ZIP"
+ .SH NAME
+ unzipsfx \- self-extracting stub for prepending to ZIP archives
+ .PD
+@@ -30,7 +30,7 @@ unzipsfx \- self-extracting stub for prepending to ZIP archives
+ .PD
+ .\" =========================================================================
+ .SH DESCRIPTION
+-\fIunzipsfx\fP is a modified version of \fIunzip\fP(1L) designed to be
++\fIunzipsfx\fP is a modified version of \fIunzip\fP(1) designed to be
+ prepended to existing ZIP archives in order to form self-extracting archives.
+ Instead of taking its first non-flag argument to be the zipfile(s) to be
+ extracted, \fIunzipsfx\fP seeks itself under the name by which it was invoked
+@@ -109,7 +109,7 @@ literal subdirectory ``\fB~\fP'' of the current directory.
+ .PD
+ .\" =========================================================================
+ .SH OPTIONS
+-\fIunzipsfx\fP supports the following \fIunzip\fP(1L) options:  \fB\-c\fP
++\fIunzipsfx\fP supports the following \fIunzip\fP(1) options:  \fB\-c\fP
+ and \fB\-p\fP (extract to standard output/screen), \fB\-f\fP and \fB\-u\fP
+ (freshen and update existing files upon extraction), \fB\-t\fP (test
+ archive) and \fB\-z\fP (print archive comment).  All normal listing options
+@@ -118,11 +118,11 @@ option (\fB\-t\fP) may be used as a ``poor man's'' listing.  Alternatively,
+ those creating self-extracting archives may wish to include a short listing
+ in the zipfile comment.
+ .PP
+-See \fIunzip\fP(1L) for a more complete description of these options.
++See \fIunzip\fP(1) for a more complete description of these options.
+ .PD
+ .\" =========================================================================
+ .SH MODIFIERS
+-\fIunzipsfx\fP currently supports all \fIunzip\fP(1L) modifiers:  \fB\-a\fP
++\fIunzipsfx\fP currently supports all \fIunzip\fP(1) modifiers:  \fB\-a\fP
+ (convert text files), \fB\-n\fP (never overwrite), \fB\-o\fP (overwrite
+ without prompting), \fB\-q\fP (operate quietly), \fB\-C\fP (match names
+ case-insensitively), \fB\-L\fP (convert uppercase-OS names to lowercase),
+@@ -137,18 +137,18 @@ files have the appropriate format for the local OS.  EBCDIC conversion will
+ of course continue to be supported since the zipfile format implies ASCII
+ storage of text files.)
+ .PP
+-See \fIunzip\fP(1L) for a more complete description of these modifiers.
++See \fIunzip\fP(1) for a more complete description of these modifiers.
+ .PD
+ .\" =========================================================================
+ .SH "ENVIRONMENT OPTIONS"
+-\fIunzipsfx\fP uses the same environment variables as \fIunzip\fP(1L) does,
++\fIunzipsfx\fP uses the same environment variables as \fIunzip\fP(1) does,
+ although this is likely to be an issue only for the person creating and
+-testing the self-extracting archive.  See \fIunzip\fP(1L) for details.
++testing the self-extracting archive.  See \fIunzip\fP(1) for details.
+ .PD
+ .\" =========================================================================
+ .SH DECRYPTION
+-Decryption is supported exactly as in \fIunzip\fP(1L); that is, interactively
+-with a non-echoing prompt for the password(s).  See \fIunzip\fP(1L) for
++Decryption is supported exactly as in \fIunzip\fP(1); that is, interactively
++with a non-echoing prompt for the password(s).  See \fIunzip\fP(1) for
+ details.  Once again, note that if the archive has no encrypted files there
+ is no reason to use a version of \fIunzipsfx\fP with decryption support;
+ that only adds to the size of the archive.
+@@ -286,7 +286,7 @@ available that provide the full path name, so the archive may be invoked
+ from anywhere in the user's path.  The situation is not known for AmigaDOS,
+ Atari TOS, MacOS, etc.
+ .PP
+-As noted above, a number of the normal \fIunzip\fP(1L) functions have
++As noted above, a number of the normal \fIunzip\fP(1) functions have
+ been removed in order to make \fIunzipsfx\fP smaller:  usage and diagnostic
+ info, listing functions and extraction to other directories.  Also, only
+ stored and deflated files are supported.  The latter limitation is mainly
+@@ -303,17 +303,17 @@ does not work.  (For technically oriented users, the attached archive is
+ defined as a ``debug hunk.'')  There may be compatibility problems between
+ the ROM levels of older Amigas and newer ones.
+ .PP
+-All current bugs in \fIunzip\fP(1L) exist in \fIunzipsfx\fP as well.
++All current bugs in \fIunzip\fP(1) exist in \fIunzipsfx\fP as well.
+ .PD
+ .\" =========================================================================
+ .SH DIAGNOSTICS
+ \fIunzipsfx\fP's exit status (error level) is identical to that of
+-\fIunzip\fP(1L); see the corresponding man page.
++\fIunzip\fP(1); see the corresponding man page.
+ .PD
+ .\" =========================================================================
+ .SH "SEE ALSO"
+-\fIfunzip\fP(1L), \fIunzip\fP(1L), \fIzip\fP(1L), \fIzipcloak\fP(1L),
+-\fIzipgrep\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L)
++\fIfunzip\fP(1), \fIunzip\fP(1), \fIzip\fP(1), \fIzipcloak\fP(1),
++\fIzipgrep\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1)
+ .PD
+ .PD
+ .\" =========================================================================
+@@ -330,7 +330,7 @@ or
+ .\" =========================================================================
+ .SH AUTHORS
+ Greg Roelofs was responsible for the basic modifications to UnZip necessary
+-to create UnZipSFX.  See \fIunzip\fP(1L) for the current list of Zip-Bugs
++to create UnZipSFX.  See \fIunzip\fP(1) for the current list of Zip-Bugs
+ authors, or the file CONTRIBS in the UnZip source distribution for the
+ full list of Info-ZIP contributors.
+ .PD
+diff --git a/man/zipgrep.1 b/man/zipgrep.1
+index dad83f8..252fcae 100644
+--- a/man/zipgrep.1
++++ b/man/zipgrep.1
+@@ -8,7 +8,7 @@
+ .\" zipgrep.1 by Greg Roelofs.
+ .\"
+ .\" =========================================================================
+-.TH ZIPGREP 1L "20 April 2009" "Info-ZIP"
++.TH ZIPGREP 1 "20 April 2009" "Info-ZIP"
+ .SH NAME
+ zipgrep \- search files in a ZIP archive for lines matching a pattern
+ .PD
+@@ -21,7 +21,7 @@ zipgrep \- search files in a ZIP archive for lines matching a pattern
+ .SH DESCRIPTION
+ \fIzipgrep\fP will search files within a ZIP archive for lines matching
+ the given string or pattern.  \fIzipgrep\fP is a shell script and requires
+-\fIegrep\fP(1) and \fIunzip\fP(1L) to function.  Its output is identical to
++\fIegrep\fP(1) and \fIunzip\fP(1) to function.  Its output is identical to
+ that of \fIegrep\fP(1).
+ .PD
+ .\" =========================================================================
+@@ -69,8 +69,8 @@ All options prior to the ZIP archive filename are passed to \fIegrep\fP(1).
+ .PD
+ .\" =========================================================================
+ .SH "SEE ALSO"
+-\fIegrep\fP(1), \fIunzip\fP(1L), \fIzip\fP(1L), \fIfunzip\fP(1L),
+-\fIzipcloak\fP(1L), \fIzipinfo\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L)
++\fIegrep\fP(1), \fIunzip\fP(1), \fIzip\fP(1), \fIfunzip\fP(1),
++\fIzipcloak\fP(1), \fIzipinfo\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1)
+ .PD
+ .\" =========================================================================
+ .SH URL
+diff --git a/man/zipinfo.1 b/man/zipinfo.1
+index 428e4b9..22d1fa2 100644
+--- a/man/zipinfo.1
++++ b/man/zipinfo.1
+@@ -34,7 +34,7 @@
+ .in -4n
+ ..
+ .\" =========================================================================
+-.TH ZIPINFO 1L "20 April 2009 (v3.0)" "Info-ZIP"
++.TH ZIPINFO 1 "20 April 2009 (v3.0)" "Info-ZIP"
+ .SH NAME
+ zipinfo \- list detailed information about a ZIP archive
+ .PD
+@@ -272,7 +272,7 @@ format:
+ Note that because of limitations in the MS-DOS format used to store file
+ times, the seconds field is always rounded to the nearest even second.
+ For Unix files this is expected to change in the next major releases of
+-\fIzip\fP(1L) and \fIunzip\fP.
++\fIzip\fP(1) and \fIunzip\fP.
+ .PP
+ In addition to individual file information, a default zipfile listing
+ also includes header and trailer lines:
+@@ -361,7 +361,7 @@ of the Unix command \fInice\fP(1).
+ As suggested above, the default variable names are ZIPINFO_OPTS for VMS
+ (where the symbol used to install \fIzipinfo\fP as a foreign command
+ would otherwise be confused with the environment variable), and ZIPINFO
+-for all other operating systems.  For compatibility with \fIzip\fP(1L),
++for all other operating systems.  For compatibility with \fIzip\fP(1),
+ ZIPINFOOPT is also accepted (don't ask).  If both ZIPINFO and ZIPINFOOPT
+ are defined, however, ZIPINFO takes precedence.  \fIunzip\fP's diagnostic
+ option (\fB\-v\fP with no zipfile name) can be used to check the values
+@@ -496,8 +496,8 @@ be simplified.  (This is not to say that it will be.)
+ .PP
+ .\" =========================================================================
+ .SH "SEE ALSO"
+-\fIls\fP(1), \fIfunzip\fP(1L), \fIunzip\fP(1L), \fIunzipsfx\fP(1L),
+-\fIzip\fP(1L), \fIzipcloak\fP(1L), \fIzipnote\fP(1L), \fIzipsplit\fP(1L)
++\fIls\fP(1), \fIfunzip\fP(1), \fIunzip\fP(1), \fIunzipsfx\fP(1),
++\fIzip\fP(1), \fIzipcloak\fP(1), \fIzipnote\fP(1), \fIzipsplit\fP(1)
+ .PD
+ .\" =========================================================================
+ .SH URL
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0002-Handle-the-PKWare-verification-bit-of-internal-attri.patch b/pkg/unzip/patch/0002-Handle-the-PKWare-verification-bit-of-internal-attri.patch
new file mode 100644
index 00000000..f7d9caab
--- /dev/null
+++ b/pkg/unzip/patch/0002-Handle-the-PKWare-verification-bit-of-internal-attri.patch
@@ -0,0 +1,32 @@
+From 4a125f29b8d313456ad91ab6694d84db7d1685da Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:41:39 -0700
+Subject: [PATCH] Handle the PKWare verification bit of internal attributes
+
+From 04-handle-pkware-verification-bit in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ process.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/process.c b/process.c
+index 1e9a1e1..ed314e1 100644
+--- a/process.c
++++ b/process.c
+@@ -1729,6 +1729,13 @@ int process_cdir_file_hdr(__G)    /* return PK-type error code */
+     else if (uO.L_flag > 1)   /* let -LL force lower case for all names */
+         G.pInfo->lcflag = 1;
+ 
++    /* Handle the PKWare verification bit, bit 2 (0x0004) of internal
++       attributes.  If this is set, then a verification checksum is in the
++       first 3 bytes of the external attributes.  In this case all we can use
++       for setting file attributes is the last external attributes byte. */
++    if (G.crec.internal_file_attributes & 0x0004)
++      G.crec.external_file_attributes &= (ulg)0xff;
++
+     /* do Amigas (AMIGA_) also have volume labels? */
+     if (IS_VOLID(G.crec.external_file_attributes) &&
+         (G.pInfo->hostnum == FS_FAT_ || G.pInfo->hostnum == FS_HPFS_ ||
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0003-Restore-uid-and-gid-information-when-requested.patch b/pkg/unzip/patch/0003-Restore-uid-and-gid-information-when-requested.patch
new file mode 100644
index 00000000..ce3b3f0b
--- /dev/null
+++ b/pkg/unzip/patch/0003-Restore-uid-and-gid-information-when-requested.patch
@@ -0,0 +1,39 @@
+From a32a7b300ba2a8df9468a2c029c3a8d20971e823 Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:41:43 -0700
+Subject: [PATCH] Restore uid and gid information when requested
+
+From 05-fix-uid-gid-handling in unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ process.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/process.c b/process.c
+index ed314e1..df58d28 100644
+--- a/process.c
++++ b/process.c
+@@ -2904,7 +2904,7 @@ unsigned ef_scan_for_izux(ef_buf, ef_len, ef_is_c, dos_mdatetime,
+ #ifdef IZ_HAVE_UXUIDGID
+             if (eb_len >= EB_UX3_MINLEN
+                 && z_uidgid != NULL
+-                && (*((EB_HEADSIZE + 0) + ef_buf) == 1)
++                && (*((EB_HEADSIZE + 0) + ef_buf) == 1))
+                     /* only know about version 1 */
+             {
+                 uch uid_size;
+@@ -2916,10 +2916,10 @@ unsigned ef_scan_for_izux(ef_buf, ef_len, ef_is_c, dos_mdatetime,
+                 flags &= ~0x0ff;      /* ignore any previous UNIX field */
+ 
+                 if ( read_ux3_value((EB_HEADSIZE + 2) + ef_buf,
+-                                    uid_size, z_uidgid[0])
++                                    uid_size, &z_uidgid[0])
+                     &&
+                      read_ux3_value((EB_HEADSIZE + uid_size + 3) + ef_buf,
+-                                    gid_size, z_uidgid[1]) )
++                                    gid_size, &z_uidgid[1]) )
+                 {
+                     flags |= EB_UX2_VALID;   /* signal success */
+                 }
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0004-Initialize-the-symlink-flag.patch b/pkg/unzip/patch/0004-Initialize-the-symlink-flag.patch
new file mode 100644
index 00000000..d8f4d38d
--- /dev/null
+++ b/pkg/unzip/patch/0004-Initialize-the-symlink-flag.patch
@@ -0,0 +1,31 @@
+From 6e7edd8d5093795a96a80e36b7c019de3f637cc8 Mon Sep 17 00:00:00 2001
+From: Andreas Schwab <schwab@linux-m68k.org>
+Date: Thu, 16 Jun 2016 22:41:53 -0700
+Subject: [PATCH] Initialize the symlink flag
+
+From 06-initialize-the-symlink-flag in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ process.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/process.c b/process.c
+index df58d28..3228bde 100644
+--- a/process.c
++++ b/process.c
+@@ -1758,6 +1758,12 @@ int process_cdir_file_hdr(__G)    /* return PK-type error code */
+         = (G.crec.general_purpose_bit_flag & (1 << 11)) == (1 << 11);
+ #endif
+ 
++#ifdef SYMLINKS
++    /* Initialize the symlink flag, may be set by the platform-specific
++       mapattr function.  */
++    G.pInfo->symlink = 0;
++#endif
++
+     return PK_COOL;
+ 
+ } /* end function process_cdir_file_hdr() */
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0005-Increase-size-of-cfactorstr-array-to-avoid-buffer-ov.patch b/pkg/unzip/patch/0005-Increase-size-of-cfactorstr-array-to-avoid-buffer-ov.patch
new file mode 100644
index 00000000..e58bbdd5
--- /dev/null
+++ b/pkg/unzip/patch/0005-Increase-size-of-cfactorstr-array-to-avoid-buffer-ov.patch
@@ -0,0 +1,27 @@
+From 638801fa4a9ffb16839d6dd42e70afc3e989e510 Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:41:56 -0700
+Subject: [PATCH] Increase size of cfactorstr array to avoid buffer overflow
+
+From 07-increase-size-of-cfactorstr in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ list.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/list.c b/list.c
+index 15e0011..5de41e5 100644
+--- a/list.c
++++ b/list.c
+@@ -97,7 +97,7 @@ int list_files(__G)    /* return PK-type error code */
+ {
+     int do_this_file=FALSE, cfactor, error, error_in_archive=PK_COOL;
+ #ifndef WINDLL
+-    char sgn, cfactorstr[10];
++    char sgn, cfactorstr[12];
+     int longhdr=(uO.vflag>1);
+ #endif
+     int date_format;
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0006-zipinfo.c-Do-not-crash-when-hostver-byte-is-100.patch b/pkg/unzip/patch/0006-zipinfo.c-Do-not-crash-when-hostver-byte-is-100.patch
new file mode 100644
index 00000000..f7ea35fa
--- /dev/null
+++ b/pkg/unzip/patch/0006-zipinfo.c-Do-not-crash-when-hostver-byte-is-100.patch
@@ -0,0 +1,27 @@
+From 0a3f8770bbe8fbd71a62a806a3fe9681a9e14c9e Mon Sep 17 00:00:00 2001
+From: Santiago Vila <sanvila@debian.org>
+Date: Thu, 16 Jun 2016 22:42:02 -0700
+Subject: [PATCH] zipinfo.c: Do not crash when hostver byte is >= 100
+
+From 08-allow-greater-hostver-values in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ zipinfo.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zipinfo.c b/zipinfo.c
+index a92bca9..5e77018 100644
+--- a/zipinfo.c
++++ b/zipinfo.c
+@@ -2114,7 +2114,7 @@ static int zi_short(__G)   /* return PK-type error code */
+             else
+                 attribs[9] = (xattr & UNX_ISVTX)? 'T' : '-';  /* T==undefined */
+ 
+-            sprintf(&attribs[12], "%u.%u", hostver/10, hostver%10);
++            sprintf(&attribs[11], "%2u.%u", hostver/10, hostver%10);
+             break;
+ 
+     } /* end switch (hostnum: external attributes format) */
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0007-Fix-CVE-2014-8139-CRC32-verification-heap-based-over.patch b/pkg/unzip/patch/0007-Fix-CVE-2014-8139-CRC32-verification-heap-based-over.patch
new file mode 100644
index 00000000..cbf42c2e
--- /dev/null
+++ b/pkg/unzip/patch/0007-Fix-CVE-2014-8139-CRC32-verification-heap-based-over.patch
@@ -0,0 +1,64 @@
+From 52cb9b4a9bfc63f0fce3ffe41cf7a61cb3bb625a Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:42:06 -0700
+Subject: [PATCH] Fix CVE-2014-8139: CRC32 verification heap-based overflow
+
+From 09-cve-2014-8139-crc-overflow in unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ extract.c | 17 ++++++++++++++---
+ 1 file changed, 14 insertions(+), 3 deletions(-)
+
+diff --git a/extract.c b/extract.c
+index 1acd769..df0fa1c 100644
+--- a/extract.c
++++ b/extract.c
+@@ -1,5 +1,5 @@
+ /*
+-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
++  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
+ 
+   See the accompanying file LICENSE, version 2009-Jan-02 or later
+   (the contents of which are also included in unzip.h) for terms of use.
+@@ -298,6 +298,8 @@ char ZCONST Far TruncNTSD[] =
+ #ifndef SFX
+    static ZCONST char Far InconsistEFlength[] = "bad extra-field entry:\n \
+      EF block length (%u bytes) exceeds remaining EF data (%u bytes)\n";
++   static ZCONST char Far TooSmallEBlength[] = "bad extra-field entry:\n \
++     EF block length (%u bytes) invalid (< %d)\n";
+    static ZCONST char Far InvalidComprDataEAs[] =
+      " invalid compressed data for EAs\n";
+ #  if (defined(WIN32) && defined(NTSD_EAS))
+@@ -2023,7 +2025,8 @@ static int TestExtraField(__G__ ef, ef_len)
+         ebID = makeword(ef);
+         ebLen = (unsigned)makeword(ef+EB_LEN);
+ 
+-        if (ebLen > (ef_len - EB_HEADSIZE)) {
++        if (ebLen > (ef_len - EB_HEADSIZE))
++        {
+            /* Discovered some extra field inconsistency! */
+             if (uO.qflag)
+                 Info(slide, 1, ((char *)slide, "%-22s ",
+@@ -2158,11 +2161,19 @@ static int TestExtraField(__G__ ef, ef_len)
+                 }
+                 break;
+             case EF_PKVMS:
+-                if (makelong(ef+EB_HEADSIZE) !=
++                if (ebLen < 4)
++                {
++                    Info(slide, 1,
++                     ((char *)slide, LoadFarString(TooSmallEBlength),
++                     ebLen, 4));
++                }
++                else if (makelong(ef+EB_HEADSIZE) !=
+                     crc32(CRCVAL_INITIAL, ef+(EB_HEADSIZE+4),
+                           (extent)(ebLen-4)))
++                {
+                     Info(slide, 1, ((char *)slide,
+                       LoadFarString(BadCRC_EAs)));
++                }
+                 break;
+             case EF_PKW32:
+             case EF_PKUNIX:
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0008-Fix-CVE-2014-8140-out-of-bounds-write-issue-in-test_.patch b/pkg/unzip/patch/0008-Fix-CVE-2014-8140-out-of-bounds-write-issue-in-test_.patch
new file mode 100644
index 00000000..b60fc149
--- /dev/null
+++ b/pkg/unzip/patch/0008-Fix-CVE-2014-8140-out-of-bounds-write-issue-in-test_.patch
@@ -0,0 +1,40 @@
+From 74f5aaa429f14d8888504127921e9da6554425af Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:42:11 -0700
+Subject: [PATCH] Fix CVE-2014-8140: out-of-bounds write issue in
+ test_compr_eb()
+
+From 10-cve-2014-8140-test-compr-eb in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ extract.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/extract.c b/extract.c
+index df0fa1c..ec31e60 100644
+--- a/extract.c
++++ b/extract.c
+@@ -2232,10 +2232,17 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
+     if (compr_offset < 4)                /* field is not compressed: */
+         return PK_OK;                    /* do nothing and signal OK */
+ 
++    /* Return no/bad-data error status if any problem is found:
++     *    1. eb_size is too small to hold the uncompressed size
++     *       (eb_ucsize).  (Else extract eb_ucsize.)
++     *    2. eb_ucsize is zero (invalid).  2014-12-04 SMS.
++     *    3. eb_ucsize is positive, but eb_size is too small to hold
++     *       the compressed data header.
++     */
+     if ((eb_size < (EB_UCSIZE_P + 4)) ||
+-        ((eb_ucsize = makelong(eb+(EB_HEADSIZE+EB_UCSIZE_P))) > 0L &&
+-         eb_size <= (compr_offset + EB_CMPRHEADLEN)))
+-        return IZ_EF_TRUNC;               /* no compressed data! */
++     ((eb_ucsize = makelong( eb+ (EB_HEADSIZE+ EB_UCSIZE_P))) == 0L) ||
++     ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
++        return IZ_EF_TRUNC;             /* no/bad compressed data! */
+ 
+     if (
+ #ifdef INT_16BIT
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0009-Fix-CVE-2014-8141-out-of-bounds-read-issues-in-getZi.patch b/pkg/unzip/patch/0009-Fix-CVE-2014-8141-out-of-bounds-read-issues-in-getZi.patch
new file mode 100644
index 00000000..b34ae1a8
--- /dev/null
+++ b/pkg/unzip/patch/0009-Fix-CVE-2014-8141-out-of-bounds-read-issues-in-getZi.patch
@@ -0,0 +1,152 @@
+From 2fbede051e0344ac5fcc6e6bcb865d4cb8a45f21 Mon Sep 17 00:00:00 2001
+From: Steven Schweda <sms@antinode.info>
+Date: Thu, 16 Jun 2016 22:42:14 -0700
+Subject: [PATCH] Fix CVE-2014-8141: out-of-bounds read issues in
+ getZip64Data()
+
+From 11-cve-2014-8141-getzip64data in unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ fileio.c  |  9 ++++++++-
+ process.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++----------------
+ 2 files changed, 59 insertions(+), 18 deletions(-)
+
+diff --git a/fileio.c b/fileio.c
+index ba0a1d0..36bfea3 100644
+--- a/fileio.c
++++ b/fileio.c
+@@ -176,6 +176,8 @@ static ZCONST char Far FilenameTooLongTrunc[] =
+ #endif
+ static ZCONST char Far ExtraFieldTooLong[] =
+   "warning:  extra field too long (%d).  Ignoring...\n";
++static ZCONST char Far ExtraFieldCorrupt[] =
++  "warning:  extra field (type: 0x%04x) corrupt.  Continuing...\n";
+ 
+ #ifdef WINDLL
+    static ZCONST char Far DiskFullQuery[] =
+@@ -2295,7 +2297,12 @@ int do_string(__G__ length, option)   /* return PK-type error code */
+             if (readbuf(__G__ (char *)G.extra_field, length) == 0)
+                 return PK_EOF;
+             /* Looks like here is where extra fields are read */
+-            getZip64Data(__G__ G.extra_field, length);
++            if (getZip64Data(__G__ G.extra_field, length) != PK_COOL)
++            {
++                Info(slide, 0x401, ((char *)slide,
++                 LoadFarString( ExtraFieldCorrupt), EF_PKSZ64));
++                error = PK_WARN;
++            }
+ #ifdef UNICODE_SUPPORT
+             G.unipath_filename = NULL;
+             if (G.UzO.U_flag < 2) {
+diff --git a/process.c b/process.c
+index 3228bde..df683ea 100644
+--- a/process.c
++++ b/process.c
+@@ -1,5 +1,5 @@
+ /*
+-  Copyright (c) 1990-2009 Info-ZIP.  All rights reserved.
++  Copyright (c) 1990-2014 Info-ZIP.  All rights reserved.
+ 
+   See the accompanying file LICENSE, version 2009-Jan-02 or later
+   (the contents of which are also included in unzip.h) for terms of use.
+@@ -1901,48 +1901,82 @@ int getZip64Data(__G__ ef_buf, ef_len)
+     and a 4-byte version of disk start number.
+     Sets both local header and central header fields.  Not terribly clever,
+     but it means that this procedure is only called in one place.
++
++    2014-12-05 SMS.
++    Added checks to ensure that enough data are available before calling
++    makeint64() or makelong().  Replaced various sizeof() values with
++    simple ("4" or "8") constants.  (The Zip64 structures do not depend
++    on our variable sizes.)  Error handling is crude, but we should now
++    stay within the buffer.
+   ---------------------------------------------------------------------------*/
+ 
++#define Z64FLGS 0xffff
++#define Z64FLGL 0xffffffff
++
+     if (ef_len == 0 || ef_buf == NULL)
+         return PK_COOL;
+ 
+     Trace((stderr,"\ngetZip64Data: scanning extra field of length %u\n",
+       ef_len));
+ 
+-    while (ef_len >= EB_HEADSIZE) {
++    while (ef_len >= EB_HEADSIZE)
++    {
+         eb_id = makeword(EB_ID + ef_buf);
+         eb_len = makeword(EB_LEN + ef_buf);
+ 
+-        if (eb_len > (ef_len - EB_HEADSIZE)) {
+-            /* discovered some extra field inconsistency! */
++        if (eb_len > (ef_len - EB_HEADSIZE))
++        {
++            /* Extra block length exceeds remaining extra field length. */
+             Trace((stderr,
+               "getZip64Data: block length %u > rest ef_size %u\n", eb_len,
+               ef_len - EB_HEADSIZE));
+             break;
+         }
+-        if (eb_id == EF_PKSZ64) {
+-
++        if (eb_id == EF_PKSZ64)
++        {
+           int offset = EB_HEADSIZE;
+ 
+-          if (G.crec.ucsize == 0xffffffff || G.lrec.ucsize == 0xffffffff){
+-            G.lrec.ucsize = G.crec.ucsize = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.ucsize);
++          if ((G.crec.ucsize == Z64FLGL) || (G.lrec.ucsize == Z64FLGL))
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
++            G.crec.ucsize = G.lrec.ucsize = makeint64(offset + ef_buf);
++            offset += 8;
+           }
+-          if (G.crec.csize == 0xffffffff || G.lrec.csize == 0xffffffff){
+-            G.csize = G.lrec.csize = G.crec.csize = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.csize);
++
++          if ((G.crec.csize == Z64FLGL) || (G.lrec.csize == Z64FLGL))
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
++            G.csize = G.crec.csize = G.lrec.csize = makeint64(offset + ef_buf);
++            offset += 8;
+           }
+-          if (G.crec.relative_offset_local_header == 0xffffffff){
++
++          if (G.crec.relative_offset_local_header == Z64FLGL)
++          {
++            if (offset+ 8 > ef_len)
++              return PK_ERR;
++
+             G.crec.relative_offset_local_header = makeint64(offset + ef_buf);
+-            offset += sizeof(G.crec.relative_offset_local_header);
++            offset += 8;
+           }
+-          if (G.crec.disk_number_start == 0xffff){
++
++          if (G.crec.disk_number_start == Z64FLGS)
++          {
++            if (offset+ 4 > ef_len)
++              return PK_ERR;
++
+             G.crec.disk_number_start = (zuvl_t)makelong(offset + ef_buf);
+-            offset += sizeof(G.crec.disk_number_start);
++            offset += 4;
+           }
++#if 0
++          break;                /* Expect only one EF_PKSZ64 block. */
++#endif /* 0 */
+         }
+ 
+-        /* Skip this extra field block */
++        /* Skip this extra field block. */
+         ef_buf += (eb_len + EB_HEADSIZE);
+         ef_len -= (eb_len + EB_HEADSIZE);
+     }
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0010-Info-ZIP-UnZip-buffer-overflow.patch b/pkg/unzip/patch/0010-Info-ZIP-UnZip-buffer-overflow.patch
new file mode 100644
index 00000000..edd9706f
--- /dev/null
+++ b/pkg/unzip/patch/0010-Info-ZIP-UnZip-buffer-overflow.patch
@@ -0,0 +1,41 @@
+From fb09687478043d64dc433bd034d063f33f718084 Mon Sep 17 00:00:00 2001
+From: mancha <mancha1@zoho.com>
+Date: Thu, 16 Jun 2016 22:42:17 -0700
+Subject: [PATCH] Info-ZIP UnZip buffer overflow
+
+From 12-cve-2014-9636-test-compr-eb in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ extract.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/extract.c b/extract.c
+index ec31e60..d816603 100644
+--- a/extract.c
++++ b/extract.c
+@@ -2228,6 +2228,7 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
+     ulg eb_ucsize;
+     uch *eb_ucptr;
+     int r;
++    ush eb_compr_method;
+ 
+     if (compr_offset < 4)                /* field is not compressed: */
+         return PK_OK;                    /* do nothing and signal OK */
+@@ -2244,6 +2245,14 @@ static int test_compr_eb(__G__ eb, eb_size, compr_offset, test_uc_ebdata)
+      ((eb_ucsize > 0L) && (eb_size <= (compr_offset + EB_CMPRHEADLEN))))
+         return IZ_EF_TRUNC;             /* no/bad compressed data! */
+ 
++    /* 2014-11-03 Michal Zalewski, SMS.
++     * For STORE method, compressed and uncompressed sizes must agree.
++     * http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450
++     */
++    eb_compr_method = makeword( eb + (EB_HEADSIZE + compr_offset));
++    if ((eb_compr_method == STORED) && (eb_size - compr_offset != eb_ucsize))
++        return PK_ERR;
++
+     if (
+ #ifdef INT_16BIT
+         (((ulg)(extent)eb_ucsize) != eb_ucsize) ||
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0011-Upstream-fix-for-heap-overflow.patch b/pkg/unzip/patch/0011-Upstream-fix-for-heap-overflow.patch
new file mode 100644
index 00000000..52681e0b
--- /dev/null
+++ b/pkg/unzip/patch/0011-Upstream-fix-for-heap-overflow.patch
@@ -0,0 +1,36 @@
+From 0fbf62b364615cd0566c0803fff8b0dae4118402 Mon Sep 17 00:00:00 2001
+From: Petr Stodulka <pstodulk@redhat.com>
+Date: Thu, 16 Jun 2016 22:42:25 -0700
+Subject: [PATCH] Upstream fix for heap overflow
+
+From 14-cve-2015-7696 in unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ crypt.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+diff --git a/crypt.c b/crypt.c
+index 784e411..a8975f2 100644
+--- a/crypt.c
++++ b/crypt.c
+@@ -465,7 +465,17 @@ int decrypt(__G__ passwrd)
+     GLOBAL(pInfo->encrypted) = FALSE;
+     defer_leftover_input(__G);
+     for (n = 0; n < RAND_HEAD_LEN; n++) {
+-        b = NEXTBYTE;
++        /* 2012-11-23 SMS.  (OUSPG report.)
++         * Quit early if compressed size < HEAD_LEN.  The resulting
++         * error message ("unable to get password") could be improved,
++         * but it's better than trying to read nonexistent data, and
++         * then continuing with a negative G.csize.  (See
++         * fileio.c:readbyte()).
++         */
++        if ((b = NEXTBYTE) == (ush)EOF)
++        {
++            return PK_ERR;
++        }
+         h[n] = (uch)b;
+         Trace((stdout, " (%02x)", h[n]));
+     }
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0012-fix-infinite-loop-when-extracting-empty-bzip2-data.patch b/pkg/unzip/patch/0012-fix-infinite-loop-when-extracting-empty-bzip2-data.patch
new file mode 100644
index 00000000..7e15d681
--- /dev/null
+++ b/pkg/unzip/patch/0012-fix-infinite-loop-when-extracting-empty-bzip2-data.patch
@@ -0,0 +1,30 @@
+From b2833dbb4beddd027f46d1bea62cdac40ec3b343 Mon Sep 17 00:00:00 2001
+From: Kamil Dudka <kdudka@redhat.com>
+Date: Thu, 16 Jun 2016 22:42:29 -0700
+Subject: [PATCH] fix infinite loop when extracting empty bzip2 data
+
+From 15-cve-2015-7697 in unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ extract.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/extract.c b/extract.c
+index d816603..ad8b3f7 100644
+--- a/extract.c
++++ b/extract.c
+@@ -2728,6 +2728,12 @@ __GDEF
+     int repeated_buf_err;
+     bz_stream bstrm;
+ 
++    if (G.incnt <= 0 && G.csize <= 0L) {
++        /* avoid an infinite loop */
++        Trace((stderr, "UZbunzip2() got empty input\n"));
++        return 2;
++    }
++
+ #if (defined(DLL) && !defined(NO_SLIDE_REDIR))
+     if (G.redirect_slide)
+         wsize = G.redirect_size, redirSlide = G.redirect_buffer;
+-- 
+2.8.1
+
diff --git a/pkg/unzip/patch/0013-extract-prevent-unsigned-overflow-on-invalid-input.patch b/pkg/unzip/patch/0013-extract-prevent-unsigned-overflow-on-invalid-input.patch
new file mode 100644
index 00000000..9f816a7a
--- /dev/null
+++ b/pkg/unzip/patch/0013-extract-prevent-unsigned-overflow-on-invalid-input.patch
@@ -0,0 +1,37 @@
+From 91f3ce1672778ebb41317c2cad4b0a75cf3d002f Mon Sep 17 00:00:00 2001
+From: Kamil Dudka <kdudka@redhat.com>
+Date: Thu, 16 Jun 2016 22:42:33 -0700
+Subject: [PATCH] extract: prevent unsigned overflow on invalid input
+
+From 16-fix-integer-underflow-csiz-decrypted in
+unzip_6.0-16+deb8u2.debian.tar.xz.
+---
+ extract.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/extract.c b/extract.c
+index ad8b3f7..3ec8813 100644
+--- a/extract.c
++++ b/extract.c
+@@ -1257,8 +1257,17 @@ static int extract_or_test_entrylist(__G__ numchunk,
+         if (G.lrec.compression_method == STORED) {
+             zusz_t csiz_decrypted = G.lrec.csize;
+ 
+-            if (G.pInfo->encrypted)
++            if (G.pInfo->encrypted) {
++                if (csiz_decrypted < 12) {
++                    /* handle the error now to prevent unsigned overflow */
++                    Info(slide, 0x401, ((char *)slide,
++                      LoadFarStringSmall(ErrUnzipNoFile),
++                      LoadFarString(InvalidComprData),
++                      LoadFarStringSmall2(Inflate)));
++                    return PK_ERR;
++                }
+                 csiz_decrypted -= 12;
++            }
+             if (G.lrec.ucsize != csiz_decrypted) {
+                 Info(slide, 0x401, ((char *)slide,
+                   LoadFarStringSmall2(WrnStorUCSizCSizDiff),
+-- 
+2.8.1
+