* Major changes in release 4.3.8

** Bug Fixes

#20157: Avoid segfault in locate when run as root.  This is caused by
a buffer overrun, but at this time no explot mechanism is known.

* Major changes in release 4.3.7

** Functional changes

Locate can now read old-format locate databases generated on machines
with a different byte order.  It does this by guessing the byte order,
so the result is not completely reliable.  If you need to share
databases between machines of different architectures, you should use
the LOCATE02 format (which has other advantages, as explained in the
documentation).

** Security Fixes

#20014: Findutils-4.3.7 includes a patch for a potential security
problem in locate.  When locate read an old-format database, it read
file names into a fixed-length buffer allocated on the heap without
checking for overflow.  Although overflowing a heap buffer is often
somewhat safer than overflowing a buffer on the stack, this bug still
has potential security implications.

This bug also affected the following previous findutils releases:

 - All releases prior to 4.2.31
 - Findutils 4.3.0 to 4.3.6.

This bug has been assigned CVE number CVE-2007-2452.

** Bug Fixes

#20128: Fix compilation error of find/tree.c on AIX with GCC.

#20005: Tests -mtime -n and -mtime +n incorrectly treated like -mtime n.

#19983: include_next causes compilation failure in findutils 4.3.6 on
non-GCC compilers 

#19981: Don't call setgroups if the function isn't available.  This
fixes Savannah bug# 19981.

#19980: Don't use the functions putw() or getw() since these are not
in current POSIX.  Use the gnulib version of wcwidth() where the
system does not provide it.

#19979: Compilation errors on BeOS

#19970: Cannot cast from pointer to bool using gnulib's <stdbool.h> 

#19967: Use of __attribute((__noreturn__)) makes compilation fail with
some non-GCC compilers  

#19966: find should link against -lm for modf() and fabs()

#19965: Compilation failure on OSF/1 4.0; non-declaration of uintmax_t 

#19948: Assertion failure O_NOFOLLOW != 0 on IRIX 6.5

#19871: Typos in find.1 

#19596: Fixed this bug again, this time in the Texinfo manual (the
discussion should compare %b with %s/512, not %s/1024).

#19416: _FORTIFY_SOURCE warn_unused_result warnings

* Major changes in release 4.3.6

** Bug Fixes

#19948: Fixed an assertion failure on IRIX 6.5 (O_NOFOLLOW is defined
to 0 there).

#19923: Fixed an array overrun in groups[] array of 'locate' when run by
or as root.  This bug appears not to be exploitable.  If locate is not
installed setuid, the bug is not exploitable.  For setuid
installations, it is concievable that there could be an information
leak if the user uses the -d option or the -e option, though the
maintainer has been unable to provoke this on an x86 system.

#19871: Spurious .R directives in manpage produced error messages from
GNU troff.  This is now fixed (they are corrected to .B).

#19416: The result of I/O operations in print-related actions is now
checked, and failures are reported.  Any failure will cause find's
exit status to be nonzero.   The predicate itself will continue to
return true.

** Compilation Fixes

A variety of changes were made to allow compilation to succeed on
non-GNU systems.

#19983: Now compiles on DEC C V5.9-005 on Digital UNIX V4.0 (or at
least, should).

#19970: Compile correctly on C89 systems where the "_Bool" type is not
provided, taking into account the limitations of the gnulib
replacement for stdbool.h.

#19967: Build successfully with C compilers that don't support the GCC
 construct __attribute__((__noreturn__)).

#19966: Findutils should now build on systems which have the modf()
and fabs() functions in the maths library, -lm.  This includes some
versions of HP-UX and Solaris.  

#19965: Fixed a compilation failure on OSF/1 4.0 (no definition of the
type uintmax_t).