Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package srt for openSUSE:Factory checked in at 2026-08-28 19:46:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/srt (Old) and /work/SRC/openSUSE:Factory/.srt.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "srt" Fri Aug 28 19:46:52 2026 rev:21 rq:1374081 version:1.5.7 Changes: -------- --- /work/SRC/openSUSE:Factory/srt/srt.changes 2026-07-23 23:09:09.945807784 +0200 +++ /work/SRC/openSUSE:Factory/.srt.new.1265/srt.changes 2026-08-28 19:47:14.877694639 +0200 @@ -1,0 +2,91 @@ +Thu Aug 27 05:26:33 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 1.5.7: + + Security Notice: + - This release includes important security hardening and + multiple vulnerability fixes identified during extensive + security audits of the SRT codebase. Several issues could + allow memory corruption, protocol state manipulation, + resource exhaustion, or misuse of auxiliary tools and CI + infrastructure. + - Users are strongly encouraged to upgrade to this version to + benefit from these security improvements and protocol + hardening measures. + + Security Improvements: + - Handshake and Encryption Security: + . Fully remediated the KMREQ processing vulnerability by + validating all incoming KM message lengths before they + reach internal conversion and copy routines, protecting + both HSv4 and HSv5 negotiation paths. + . Completed the remediation of the encryption downgrade + vulnerability by preventing post-establishment KMRSP + messages from modifying the security state of already + secured sessions. Additional protections were added for + both HSv4 and HSv5 negotiation paths. + . Added minimum MSS enforcement during connection negotiation + to prevent undersized payload buffers that could otherwise + lead to heap corruption and information disclosure during + handshake generation. + . Hardened handshake state processing to correctly derive + connection state from the live connection status and + prevent unintended state rollback caused by late or + malformed handshake exchanges. + - Data Plane Protection: + . Fixed validation of ACK control messages to prevent + send-buffer corruption caused by forged or malformed + acknowledgements. Additional bounds checking now ensures + that sequence number ranges remain valid before buffer + state updates occur. + . Added protection against invalid DROPREQ ranges. Reversed + ranges and invalid sequence number distances are now + rejected before modifying receiver buffer state. + . Corrected receive-path connection status handling to + prevent non-addressed packets from affecting unrelated + connection attempts. + - FEC Robustness: + . Added payload-size validation in FEC clipping operations to + prevent out-of-bounds writes when processing oversized + payloads. + . Introduced minimum-size validation for FEC control packets, + eliminating integer-underflow conditions that could occur + when processing malformed packets. + . Added upper bounds for peer-supplied FEC configuration + values and improved error handling to prevent excessive + memory allocation during connection establishment. + - Bonding Reliability: + . Fixed a use-after-free condition in the bonding BACKUP send + path. Internal member context tracking now safely handles + members removed while locks are temporarily released, + preventing dangling references during failover processing. + - Application Hardening: + . Added validation of remotely supplied filenames in the + srt-file-transmit utility. Path separators, parent + directory references, and platform-specific path + manipulation patterns are now rejected before files are + created. + + Build and CI Security Enhancements: + - Replaced the dynamic Codecov script download mechanism with a + pinned and integrity-verified version. + - Pinned ABI compatibility checker dependencies to specific + versions and removed reliance on mutable default branches. + - Improved GitHub workflow supply-chain protection by pinning + third-party actions, container images, and external + dependencies to known revisions. + + Stability Improvements: + - Fixed local connection teardown handling following rejected + late handshakes, ensuring the local endpoint correctly + terminates invalid connection states. + - Improved error handling for FEC initialization failures and + memory allocation exceptions, providing graceful connection + rejection instead of abrupt failures. + + Test Coverage: + - Additional negative and security-focused test coverage has + been added for: + . Malformed KMRSP messages. + . Encryption downgrade scenarios. + . ACK validation. + . DROPREQ malformed and reversed ranges. + . FEC oversized payloads and invalid configurations. + . Connection cleanup and shutdown paths. + +------------------------------------------------------------------- Old: ---- srt-1.5.6.tar.gz New: ---- srt-1.5.7.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ srt.spec ++++++ --- /var/tmp/diff_new_pack.kgfday/_old 2026-08-28 19:47:16.535752595 +0200 +++ /var/tmp/diff_new_pack.kgfday/_new 2026-08-28 19:47:16.536752630 +0200 @@ -19,7 +19,7 @@ %define sover 1_5 Name: srt -Version: 1.5.6 +Version: 1.5.7 Release: 0 Summary: Secure Reliable Transport (SRT) License: MPL-2.0 ++++++ srt-1.5.6.tar.gz -> srt-1.5.7.tar.gz ++++++ ++++ 4216 lines of diff (skipped)
