Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package faad2 for openSUSE:Factory checked in at 2026-08-21 16:49:47 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/faad2 (Old) and /work/SRC/openSUSE:Factory/.faad2.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "faad2" Fri Aug 21 16:49:47 2026 rev:7 rq:1372025 version:2.11.3 Changes: -------- --- /work/SRC/openSUSE:Factory/faad2/faad2.changes 2026-07-28 17:49:58.227815965 +0200 +++ /work/SRC/openSUSE:Factory/.faad2.new.1258/faad2.changes 2026-08-21 16:50:09.276195584 +0200 @@ -1,0 +2,30 @@ +Wed Aug 19 15:26:22 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 2.11.3: + * Fix ISO C warning in libfaad/fixed.h + * Check for mp4config.frame.nsclices == 0 in frontend/mp4read.c + to fix Heap Buffer Overflow + * SBR: prevent heap overflow in channel-pair reconstruction + * Fix off-by-one frame index check in mp4read_seek + * Fix integer overflow in stszin/stscin allocation size checks + * Bound sscanf field width in option parsing + * Fix out-of-bounds iq_table read in iquant for -32768 + * Prevent length_of_rvlc_sf underflow in rvlc_scale_factor_data + * Fix out-of-bounds Xsbr write in hf_assembly sinusoid addition + * Fix out-of-bounds X underflow in SBR low-power QMF assembly + * Fix ssr_gc_function signature mismatch in ssr_gain_control + * Fix signed overflow in estimate_current_envelope energy sum + * Cap escape length in huffman_spectral_data_2 + * Prevent num_bits_left underflow in ps_data extension parsing + * Fix signed overflow in fixed-point sample rounding before + saturation + * Add sanity checks on the width in libfaad/specrec.c + * Check the last swb_offset value is valid in libfaad/specrec.c + * Return early from NeAACDecInit when the object type can't be + supported + * Fix null pointer dereferences in intra channel and long term + prediction + * Increase the ASC buffer from 10 to 64 bytes in + frontend/mp4read.h + +------------------------------------------------------------------- Old: ---- faad2-2.11.2.git18.obscpio New: ---- faad2-2.11.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ faad2.spec ++++++ --- /var/tmp/diff_new_pack.1Nr8pD/_old 2026-08-21 16:50:10.140226585 +0200 +++ /var/tmp/diff_new_pack.1Nr8pD/_new 2026-08-21 16:50:10.143226692 +0200 @@ -24,7 +24,7 @@ %define so_name libfaad%so_version %define so_name_drm libfaad_drm%so_version Name: faad2 -Version: 2.11.2.git18 +Version: 2.11.3 Release: 0 Summary: Freeware Advanced Audio (AAC) Decoder including SBR decoding License: GPL-2.0-or-later ++++++ _service ++++++ --- /var/tmp/diff_new_pack.1Nr8pD/_old 2026-08-21 16:50:10.209229060 +0200 +++ /var/tmp/diff_new_pack.1Nr8pD/_new 2026-08-21 16:50:10.215229276 +0200 @@ -1,7 +1,7 @@ <services> <service name="obs_scm" mode="manual"> <param name="filename">faad2</param> - <param name="revision">b743105de73f31f214f824e72d2001a3736da768</param> + <param name="revision">2.11.3</param> <param name="scm">git</param> <param name="submodules">disable</param> <param name="url">https://github.com/knik0/faad2.git</param> ++++++ faad2-2.11.2.git18.obscpio -> faad2-2.11.3.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/ChangeLog new/faad2-2.11.3/ChangeLog --- old/faad2-2.11.2.git18/ChangeLog 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/ChangeLog 2026-08-19 07:45:36.000000000 +0200 @@ -1,3 +1,39 @@ +2.11.3 (2026-08-19): + [ Dario Binacchi ] + * Fix ISO C warning in `libfaad/fixed.h` + + [ Fabian Greffrath ] + * Check for `mp4config.frame.nsclices == 0` in `frontend/mp4read.c` to fix + Heap Buffer Overflow + + [ Kevin Valerio ] + * SBR: prevent heap overflow in channel-pair reconstruction + + [ netliomax25-code ] + * Fix off-by-one frame index check in `mp4read_seek` + * Fix integer overflow in `stszin`/`stscin` allocation size checks + * Bound `sscanf` field width in option parsing + * Fix out-of-bounds `iq_table` read in `iquant` for -32768 + * Prevent `length_of_rvlc_sf` underflow in `rvlc_scale_factor_data` + * Fix out-of-bounds `Xsbr` write in `hf_assembly` sinusoid addition + * Fix out-of-bounds `X` underflow in SBR low-power QMF assembly + * Fix `ssr_gc_function` signature mismatch in `ssr_gain_control` + * Fix signed overflow in `estimate_current_envelope` energy sum + * Cap escape length in `huffman_spectral_data_2` + * Prevent `num_bits_left` underflow in `ps_data` extension parsing + * Fix signed overflow in fixed-point sample rounding before saturation + + [ Steve Lhomme ] + * Add sanity checks on the width in `libfaad/specrec.c` + * Check the last `swb_offset` value is valid in `libfaad/specrec.c` + * Return early from `NeAACDecInit` when the object type can't be supported + + [ Thomas Lange ] + * Fix null pointer dereferences in intra channel and long term prediction + + [ hexapod0815 ] + * Increase the ASC buffer from 10 to 64 bytes in `frontend/mp4read.h` + 2.11.2 (2025-03-04): [ Armin Novak ] * Add option BUILD_FAAD_CLI diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/frontend/mp4read.h new/faad2-2.11.3/frontend/mp4read.h --- old/faad2-2.11.2.git18/frontend/mp4read.h 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/frontend/mp4read.h 2026-08-19 07:45:36.000000000 +0200 @@ -57,7 +57,11 @@ // AudioSpecificConfig data: struct { - uint8_t buf[10]; + // Some muxers (e.g. FFmpeg/libavformat) zero-pad the DecSpecificInfo + // descriptor, so the declared ASC length can exceed the ~2 bytes of + // meaningful data. A 10-byte buffer rejected such files in esdsin() + // with "parse:-1"; 64 bytes safely holds any real AudioSpecificConfig. + uint8_t buf[64]; uint32_t size; } asc; struct { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/libfaad/decoder.c new/faad2-2.11.3/libfaad/decoder.c --- old/faad2-2.11.2.git18/libfaad/decoder.c 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/libfaad/decoder.c 2026-08-19 07:45:36.000000000 +0200 @@ -372,6 +372,9 @@ } #endif + if (can_decode_ot(hDecoder->object_type) < 0) + return -1; + /* must be done before frameLength is divided by 2 for LD */ #ifdef SSR_DEC if (hDecoder->object_type == SSR) @@ -385,9 +388,6 @@ hDecoder->frameLength >>= 1; #endif - if (can_decode_ot(hDecoder->object_type) < 0) - return -1; - return bits; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/libfaad/error.c new/faad2-2.11.3/libfaad/error.c --- old/faad2-2.11.2.git18/libfaad/error.c 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/libfaad/error.c 2026-08-19 07:45:36.000000000 +0200 @@ -65,6 +65,6 @@ "No standard extension payload allowed in DRM", "PCE shall be the first element in a frame", "Bitstream value not allowed by specification", - "MAIN prediction not initialised" + "MAIN prediction not initialised", + "Long term prediction not initialised" }; - diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/libfaad/error.h new/faad2-2.11.3/libfaad/error.h --- old/faad2-2.11.2.git18/libfaad/error.h 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/libfaad/error.h 2026-08-19 07:45:36.000000000 +0200 @@ -35,7 +35,7 @@ extern "C" { #endif -#define NUM_ERROR_MESSAGES 34 +#define NUM_ERROR_MESSAGES 35 extern char *err_msg[]; #ifdef __cplusplus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/libfaad/specrec.c new/faad2-2.11.3/libfaad/specrec.c --- old/faad2-2.11.2.git18/libfaad/specrec.c 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/libfaad/specrec.c 2026-08-19 07:45:36.000000000 +0200 @@ -372,6 +372,9 @@ #ifdef LD_DEC } #endif + if (ics->num_swb > 0 && ics->swb_offset[ics->num_swb] < ics->swb_offset[ics->num_swb-1]) { + return 32; + } return 0; case EIGHT_SHORT_SEQUENCE: ics->num_windows = 8; @@ -594,6 +597,13 @@ int16_t scale_factor = ics->scale_factors[g][sfb]; width = ics->swb_offset[sfb+1] - ics->swb_offset[sfb]; + if (width + 3 >= 1024) + { + // quant_data contains 1024 uint16_t, the k iterator + 3 + // should never reach more 1024 + error = 17; + continue; + } #ifdef FIXED_POINT scale_factor -= 100; @@ -996,8 +1006,8 @@ /* MAIN object type prediction */ if (hDecoder->object_type == MAIN) { - if (!hDecoder->pred_stat[sce->channel]) - return 33; + if (!hDecoder->pred_stat[sce->channel]) + return 33; /* intra channel prediction */ ic_prediction(ics, spec_coef, hDecoder->pred_stat[sce->channel], hDecoder->frameLength, @@ -1026,6 +1036,9 @@ } #endif + if (!hDecoder->lt_pred_stat[sce->channel]) + return 34; + /* long term prediction */ lt_prediction(ics, &(ics->ltp), spec_coef, hDecoder->lt_pred_stat[sce->channel], hDecoder->fb, ics->window_shape, hDecoder->window_shape_prev[sce->channel], @@ -1230,6 +1243,9 @@ /* MAIN object type prediction */ if (hDecoder->object_type == MAIN) { + if (!hDecoder->pred_stat[cpe->channel] || !hDecoder->pred_stat[cpe->paired_channel]) + return 33; + /* intra channel prediction */ ic_prediction(ics1, spec_coef1, hDecoder->pred_stat[cpe->channel], hDecoder->frameLength, hDecoder->sf_index); @@ -1268,6 +1284,9 @@ } #endif + if (!hDecoder->lt_pred_stat[cpe->channel] || !hDecoder->lt_pred_stat[cpe->paired_channel]) + return 34; + /* long term prediction */ lt_prediction(ics1, ltp1, spec_coef1, hDecoder->lt_pred_stat[cpe->channel], hDecoder->fb, ics1->window_shape, hDecoder->window_shape_prev[cpe->channel], diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/faad2-2.11.2.git18/properties.json new/faad2-2.11.3/properties.json --- old/faad2-2.11.2.git18/properties.json 2026-07-18 09:38:09.000000000 +0200 +++ new/faad2-2.11.3/properties.json 2026-08-19 07:45:36.000000000 +0200 @@ -1,4 +1,4 @@ { "//": "This file contains properties used in build / release process", - "PACKAGE_VERSION": "2.11.2" + "PACKAGE_VERSION": "2.11.3" } ++++++ faad2.obsinfo ++++++ --- /var/tmp/diff_new_pack.1Nr8pD/_old 2026-08-21 16:50:10.622243879 +0200 +++ /var/tmp/diff_new_pack.1Nr8pD/_new 2026-08-21 16:50:10.627244058 +0200 @@ -1,5 +1,5 @@ name: faad2 -version: 2.11.2.git18 -mtime: 1784360289 -commit: b743105de73f31f214f824e72d2001a3736da768 +version: 2.11.3 +mtime: 1787118336 +commit: 6918ebb51b8f7e86278da15884bd7114e4b9661e
