Adding upstream version 3.5.1.

Signed-off-by: Daniel Baumann <daniel@debian.org>

testdata/corpus/proverbs/extra/proverb3.txt

@@ -0,0 +1,2 @@
+"interface{} says nothing."
+	- Rob Pike

testdata/corpus/proverbs/proverb1.txt

@@ -0,0 +1,2 @@
+"Channels orchestrate; mutexes serialize."
+	- Rob Pike

testdata/corpus/proverbs/proverb2.txt

@@ -0,0 +1,2 @@
+"A little copying is better than a little dependency."
+	- Rob Pike

testdata/corpus/quote1.txt

@@ -0,0 +1,2 @@
+"Go has generics; they're called interfaces."
+	- Matt Holt

testdata/create-evil-tar.go

@@ -0,0 +1,74 @@
+package main
+
+import (
+	"archive/tar"
+	"fmt"
+	"log"
+	"os"
+	"time"
+)
+
+func main() {
+	// Create a file to write our archive to.
+	tarname := "double-evil.tar"
+	fw, err := os.Create(tarname)
+	if nil != err {
+		log.Fatal(err)
+		return
+	}
+
+	// Create a new tar archive.
+	tw := tar.NewWriter(fw)
+
+	// Write the evil symlink, it points outside of the target directory
+	hdr := &tar.Header{
+		Name:     "bad/file.txt",
+		Mode:     0644,
+		Typeflag: tar.TypeSymlink,
+		Linkname: "../../badfile.txt",
+		ModTime:  time.Now(),
+	}
+	if err := tw.WriteHeader(hdr); err != nil {
+		log.Fatal(err)
+		return
+	}
+
+	// Write safe files to the archive.
+	var files = []struct {
+		Name, Body string
+	}{
+		{"goodfile.txt", "hello world"},
+		{"morefile.txt", "hello world"},
+		{"bad/file.txt", "Mwa-ha-ha"},
+	}
+	for _, file := range files {
+		hdr := &tar.Header{
+			Name:    file.Name,
+			Mode:    0644,
+			Size:    int64(len(file.Body)),
+			ModTime: time.Now(),
+		}
+
+		if err := tw.WriteHeader(hdr); err != nil {
+			log.Fatal(err)
+			return
+		}
+
+		if _, err := tw.Write([]byte(file.Body)); err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	// Close the in-memory archive so that it writes trailing data
+	err = tw.Close()
+	if err != nil {
+		log.Fatal(err)
+	}
+	fmt.Printf("Wrote %s\n", tarname)
+
+	// close the on-disk archive so that it flushes all bytes
+	if err = fw.Close(); err != nil {
+		log.Fatal(err)
+		return
+	}
+}

testdata/create-evil-zip.go

@@ -0,0 +1,75 @@
+package main
+
+import (
+	"log"
+	"os"
+	"time"
+
+	"github.com/klauspost/compress/zip"
+)
+
+func main() {
+	// Create a buffer to write our archive to.
+	fw, err := os.Create("double-evil.zip")
+	if nil != err {
+		log.Fatal(err)
+		return
+	}
+
+	// Create a new zip archive.
+	w := zip.NewWriter(fw)
+
+	// Write the evil symlink
+	h := &zip.FileHeader{
+		Name:     "bad/file.txt",
+		Method:   zip.Deflate,
+		Modified: time.Now(),
+	}
+	h.SetMode(os.ModeSymlink)
+	header, err := w.CreateHeader(h)
+	if err != nil {
+		log.Fatal(err)
+	}
+	// The evil symlink points outside of the target directory
+	_, err = header.Write([]byte("../../badfile.txt"))
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Write safe files to the archive.
+	var files = []struct {
+		Name, Body string
+	}{
+		{"goodfile.txt", "hello world"},
+		{"morefile.txt", "hello world"},
+		{"bad/file.txt", "Mwa-ha-ha"},
+	}
+	for _, file := range files {
+		h := &zip.FileHeader{
+			Name:     file.Name,
+			Method:   zip.Deflate,
+			Modified: time.Now(),
+		}
+
+		header, err := w.CreateHeader(h)
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		_, err = header.Write([]byte(file.Body))
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+
+	// close the in-memory archive so that it writes trailing data
+	if err = w.Close(); err != nil {
+		log.Fatal(err)
+	}
+
+	// close the on-disk archive so that it flushes all bytes
+	if err = fw.Close(); err != nil {
+		log.Fatal(err)
+		return
+	}
+}