Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package evince for openSUSE:Factory checked in at 2026-07-31 15:30:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/evince (Old) and /work/SRC/openSUSE:Factory/.evince.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "evince" Fri Jul 31 15:30:46 2026 rev:189 rq:1368510 version:48.4 Changes: -------- --- /work/SRC/openSUSE:Factory/evince/evince.changes 2026-05-23 23:27:42.861537553 +0200 +++ /work/SRC/openSUSE:Factory/.evince.new.2004/evince.changes 2026-07-31 16:06:54.539597168 +0200 @@ -1,0 +2,6 @@ +Thu Jul 30 02:49:22 UTC 2026 - Alynx Zhou <[email protected]> + +- Add evince-CVE-2026-63729.patch: Fix use-after-free in + synctex_parser.c from TeX Live (bsc#1272433). + +------------------------------------------------------------------- New: ---- evince-CVE-2026-63729.patch ----------(New B)---------- New: - Add evince-CVE-2026-63729.patch: Fix use-after-free in synctex_parser.c from TeX Live (bsc#1272433). ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ evince.spec ++++++ --- /var/tmp/diff_new_pack.Fvn1Vd/_old 2026-07-31 16:06:55.423627927 +0200 +++ /var/tmp/diff_new_pack.Fvn1Vd/_new 2026-07-31 16:06:55.431628205 +0200 @@ -31,6 +31,8 @@ Source0: %{name}-%{version}.tar.xz # PATCH-FIX-UPSTREAM evince-kpathsea.patch -- Fix build with gcc 15 Patch0: evince-kpathsea.patch +# PATCH-FIX-UPSTREAM evince-CVE-2026-63729.patch bsc#1272433 [email protected] -- Fix use-after-free in synctex_parser.c +Patch1: evince-CVE-2026-63729.patch BuildRequires: c_compiler BuildRequires: desktop-file-utils ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.Fvn1Vd/_old 2026-07-31 16:06:55.491630293 +0200 +++ /var/tmp/diff_new_pack.Fvn1Vd/_new 2026-07-31 16:06:55.495630433 +0200 @@ -1,6 +1,6 @@ -mtime: 1779455239 -commit: 1fe723f5123438450adb85884feced3f1c1a1c505afef59b1aa70849256d0631 +mtime: 1785379791 +commit: 06ca61ee88d1805e6c1f40ba50739678b9035967415188b3303b89d65b10ebca url: https://src.opensuse.org/GNOME/evince -revision: 1fe723f5123438450adb85884feced3f1c1a1c505afef59b1aa70849256d0631 +revision: 06ca61ee88d1805e6c1f40ba50739678b9035967415188b3303b89d65b10ebca projectscmsync: https://src.opensuse.org/GNOME/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-30 04:49:51.000000000 +0200 @@ -0,0 +1,5 @@ +*.obscpio +*.osc +_build.* +.pbuild +osc-collab.* ++++++ evince-CVE-2026-63729.patch ++++++ diff --unified --recursive --text --new-file --color evince-45.0/cut-n-paste/synctex/synctex_parser.c evince-45.0.new/cut-n-paste/synctex/synctex_parser.c --- evince-45.0/cut-n-paste/synctex/synctex_parser.c 2023-09-19 04:54:59.000000000 +0800 +++ evince-45.0.new/cut-n-paste/synctex/synctex_parser.c 2026-07-30 10:08:37.165517620 +0800 @@ -882,10 +882,14 @@ */ static void _synctex_free_node(synctex_node_p node) { if (node) { + synctex_node_p sibling; + synctex_node_p child; SYNCTEX_SCANNER_REMOVE_HANDLE_TO(node); SYNCTEX_WILL_FREE(node); - synctex_node_free(__synctex_tree_sibling(node)); - synctex_node_free(_synctex_tree_child(node)); + sibling = __synctex_tree_reset_sibling(node); + child = _synctex_tree_reset_child(node); + synctex_node_free(sibling); + synctex_node_free(child); _synctex_free(node); } return; @@ -915,9 +919,11 @@ */ static void _synctex_free_leaf(synctex_node_p node) { if (node) { + synctex_node_p sibling; SYNCTEX_SCANNER_REMOVE_HANDLE_TO(node); SYNCTEX_WILL_FREE(node); - synctex_node_free(__synctex_tree_sibling(node)); + sibling = __synctex_tree_reset_sibling(node); + synctex_node_free(sibling); _synctex_free(node); } return; @@ -1181,9 +1187,11 @@ static void _synctex_free_input(synctex_node_p node){ if (node) { + synctex_node_p sibling; SYNCTEX_SCANNER_REMOVE_HANDLE_TO(node); SYNCTEX_WILL_FREE(node); - synctex_node_free(__synctex_tree_sibling(node)); + sibling = __synctex_tree_reset_sibling(node); + synctex_node_free(sibling); _synctex_free(_synctex_data_name(node)); _synctex_free(node); } @@ -5749,6 +5757,13 @@ synctex_tree_set_friend(sub_ns.node,ns.node); ns.node = sub_ns.node; } + /* Ensure ref is fully detached before freeing, + * even if __synctex_replace_ref did not detach it + * (e.g. because the ref had no parent). + * Otherwise _synctex_free_leaf would chase the + * stale sibling pointer into the live tree. */ + __synctex_tree_reset_sibling(ref); + __synctex_tree_reset_parent(ref); synctex_node_free(ref); ref = next_ref; }
