GNU findutils 4.3.6 is now available on alpha.gnu.org

[James Youngman]

I announce the release of version 4.3.6 of GNU findutils.

GNU findutils is a set of software tools for finding files that match
certain criteria and for performing various operations on them.
Findutils includes the programs "find", "xargs" and "locate".  More
information about findutils is available at
http://www.gnu.org/software/findutils/.

This is a "development" release of findutils.  It can be downloaded
from  ftp://alpha.gnu.org/gnu/findutils.  The 4.3.x release series is
intended to allow people to try out, comment on or contribute to new
features of findutils.  During the 4.3.x release series some features
may be introduced and then changed or removed as a result of feedback
or experience.  In short, please don't rely on backward compatibility
later in the release series.

While this is a development release, it is tested before being
released, principally with the regression test suite (run "make check"
to use it).  The Savannah website
(http://savannah.gnu.org/bugs/?group=findutils) contains a current
list of known bugs in findutils (for both the stable and development
branches).

This release includes a range of changes, including bugfixes,
documentation improvements and small functional changes.  All the
changes since the previous release are summarised below.

Bugs in GNU findutils should be reported to the findutils bug tracker
at http://savannah.gnu.org/bugs/?group=findutils.  Reporting bugs via
the web interface will ensure that you are automatically informed when
the bug has been fixed.  General discussion of findutils takes place
on the bug-findutils mailing list.  To join the 'bug-findutils'
mailing list, send email to <address@hidden>.

To verify the GPG signature of the release, you will need the public
key of the findutils maintainer, James Youngman.  You can download
this from http://savannah.gnu.org/users/jay.  Alternatively, you
could query a PGP keyserver, but you will need to use one that can
cope with subkeys containing photos.  Many older key servers cannot do
this.  I use subkeys.pgp.net.  I think that one works.  See also the
"Downloading" section of http://www.gnu.org/software/findutils/.

I would like to thank Nix <address@hidden> and the members of the
bug-findutils mailing list for their help in preparing this release.

* Major changes in release 4.3.6

** Bug Fixes

#19923: Fixed an array overrun in groups[] array of 'locate' when run by
or as root.  This bug appears not to be exploitable.  If locate is not
installed setuid, the bug is not exploitable.  For setuid
installations, it is concievable that there could be an information
leak if the user uses the -d option or the -e option, though the
maintainer has been unable to provoke this on an x86 system.

#19871: Spurious .R directives in manpage produced error messages from
GNU troff.  This is now fixed (they are corrected to .B).

#19416: The result of I/O operations in print-related actions is now
checked, and failures are reported.  Any failure will cause find's
exit status to be nonzero.   The predicate itself will continue to
return true.


--
James Youngman <address@hidden>
GNU findutils maintainer