Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gcc13 for openSUSE:Factory checked in at 2026-10-02 23:01:20 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gcc13 (Old) and /work/SRC/openSUSE:Factory/.gcc13.new.1631729 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gcc13" Fri Oct 2 23:01:20 2026 rev:43 rq:1381853 version:13.5.0+git10516 Changes: -------- --- /work/SRC/openSUSE:Factory/gcc13/gcc13.changes 2026-09-12 21:15:51.653748877 +0200 +++ /work/SRC/openSUSE:Factory/.gcc13.new.1631729/gcc13.changes 2026-10-02 23:01:35.096877254 +0200 @@ -1,0 +2,6 @@ +Tue Sep 29 13:59:16 UTC 2026 - Richard Biener <[email protected]> + +- Add gcc13-pr127656.patch to fix use-after-free in + __gnu_pbds::priority_queue. [bsc#1283123] (CVE-2026-102010) + +------------------------------------------------------------------- New: ---- gcc13-pr127656.patch ----------(New B)---------- New: - Add gcc13-pr127656.patch to fix use-after-free in __gnu_pbds::priority_queue. [bsc#1283123] (CVE-2026-102010) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cross-aarch64-gcc13-bootstrap.spec ++++++ --- /var/tmp/diff_new_pack.P6e8Xb/_old 2026-10-02 23:01:37.014957445 +0200 +++ /var/tmp/diff_new_pack.P6e8Xb/_new 2026-10-02 23:01:37.021957738 +0200 @@ -140,6 +140,7 @@ Patch27: gcc13-amdgcn-remove-fiji.patch Patch28: gcc13-bsc1239566.patch Patch29: gcc13-pr124811.patch +Patch30: gcc13-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -374,6 +375,7 @@ %patch -P 27 -p1 %patch -P 28 -p1 %patch -P 29 -p1 +%patch -P 30 -p1 %patch -P 51 %patch -P 60 -p1 %patch -P 61 -p1 cross-aarch64-gcc13.spec: same change cross-amdgcn-gcc13.spec: same change cross-arm-gcc13.spec: same change cross-arm-none-gcc13-bootstrap.spec: same change cross-arm-none-gcc13.spec: same change cross-avr-gcc13-bootstrap.spec: same change cross-avr-gcc13.spec: same change cross-bpf-gcc13.spec: same change cross-hppa-gcc13-bootstrap.spec: same change cross-nvptx-gcc13.spec: same change cross-ppc64-gcc13.spec: same change cross-ppc64le-gcc13-bootstrap.spec: same change cross-ppc64le-gcc13.spec: same change cross-pru-gcc13-bootstrap.spec: same change cross-pru-gcc13.spec: same change cross-riscv64-elf-gcc13-bootstrap.spec: same change cross-riscv64-elf-gcc13.spec: same change cross-riscv64-gcc13-bootstrap.spec: same change cross-riscv64-gcc13.spec: same change cross-rx-gcc13-bootstrap.spec: same change cross-rx-gcc13.spec: same change cross-s390x-gcc13-bootstrap.spec: same change cross-s390x-gcc13.spec: same change cross-x86_64-gcc13.spec: same change gcc13-testresults.spec: same change ++++++ gcc13.spec ++++++ --- /var/tmp/diff_new_pack.P6e8Xb/_old 2026-10-02 23:01:38.143004607 +0200 +++ /var/tmp/diff_new_pack.P6e8Xb/_new 2026-10-02 23:01:38.146004733 +0200 @@ -391,6 +391,7 @@ Patch27: gcc13-amdgcn-remove-fiji.patch Patch28: gcc13-bsc1239566.patch Patch29: gcc13-pr124811.patch +Patch30: gcc13-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -2383,6 +2384,7 @@ %patch -P 27 -p1 %patch -P 28 -p1 %patch -P 29 -p1 +%patch -P 30 -p1 %patch -P 51 %patch -P 60 -p1 %patch -P 61 -p1 ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.P6e8Xb/_old 2026-10-02 23:01:38.297011046 +0200 +++ /var/tmp/diff_new_pack.P6e8Xb/_new 2026-10-02 23:01:38.301011213 +0200 @@ -1,5 +1,5 @@ -mtime: 1789111069 -commit: 906e74d3145658a4dc0c2369436792f2ff634d02c7476f43865bca225a6aea57 +mtime: 1790690459 +commit: 3c76bc73d3bd04fad4992d776ecfe12f498c9a58d67c07ca2d946f9e4eb77272 url: https://src.opensuse.org/gcc/gcc13.git revision: main ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-29 16:00:59.000000000 +0200 @@ -0,0 +1 @@ +.osc diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pre_checkin.sh new/pre_checkin.sh --- old/pre_checkin.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/pre_checkin.sh 2026-09-29 16:00:59.000000000 +0200 @@ -0,0 +1,31 @@ +#!/bin/bash +# This script is called automatically during autobuild checkin. + +case $0 in + \./*) + here=$PWD + ;; + */*) + here=${0%/*} + ;; + *) + here=$PWD + ;; +esac +case ${here##*/} in + gcc*.*) + # Handle maintainance projects with .$REPO suffix + suffix=${here##*/} + suffix=${suffix%%\.*} + set ${suffix#gcc} + ;; + gcc-*) + suffix=${here##*/} + set ${suffix#*-}- + ;; + gcc[0-9]*) + suffix=${here##*/} + set ${suffix#gcc} + ;; +esac +. ${here}/change_spec ++++++ gcc.spec.in ++++++ --- /var/tmp/diff_new_pack.P6e8Xb/_old 2026-10-02 23:01:38.655026014 +0200 +++ /var/tmp/diff_new_pack.P6e8Xb/_new 2026-10-02 23:01:38.667026516 +0200 @@ -396,6 +396,7 @@ Patch27: gcc13-amdgcn-remove-fiji.patch Patch28: gcc13-bsc1239566.patch Patch29: gcc13-pr124811.patch +Patch30: gcc13-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -1373,6 +1374,7 @@ %patch -P 27 -p1 %patch -P 28 -p1 %patch -P 29 -p1 +%patch -P 30 -p1 %patch -P 51 %patch -P 60 -p1 %patch -P 61 -p1 ++++++ gcc13-pr127656.patch ++++++ >From 1d1b3c2f214345a98570ed6b095b8df305db2363 Mon Sep 17 00:00:00 2001 From: Richard Biener <[email protected]> Date: Fri, 25 Sep 2026 18:14:34 +0100 Subject: [PATCH] libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010) [PR127656] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To: [email protected] From: Jonathan Wakely <[email protected]> After reallocating the storage the m_a_entries pointer is left dangling and the new storage is leaked. libstdc++-v3/ChangeLog: PR libstdc++/127656 * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp (erase_if): Update m_a_entries after reallocation. * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc: New test. Reviewed-by: Tomasz Kamiński <[email protected]> (cherry picked from commit aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6) --- .../detail/binary_heap_/erase_fn_imps.hpp | 1 + .../regression/priority_queues_erase_if.cc | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc diff --git a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp index 8710b40ea01..fc20db4d67c 100644 --- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp +++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp @@ -121,6 +121,7 @@ erase_if(Pred pred) entry_pointer new_entries = s_entry_allocator.allocate(new_size); std::copy(m_a_entries, m_a_entries + left, new_entries); s_entry_allocator.deallocate(m_a_entries, m_actual_size); + m_a_entries = new_entries; m_actual_size = new_size; resize_policy::notify_arbitrary(m_actual_size); } diff --git a/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc new file mode 100644 index 00000000000..30b8452eff9 --- /dev/null +++ b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc @@ -0,0 +1,19 @@ +// { dg-do run } + +// CVE-2026-201020 use-after-free in binary heap erase_if + +#include <ext/pb_ds/priority_queue.hpp> + +bool is_odd(int v) { return v & 1; } + +int main() +{ + using __gnu_pbds::priority_queue; + using __gnu_pbds::binary_heap_tag; + priority_queue<int, std::less<int>, binary_heap_tag> q; + q.push(1); + q.push(2); + q.push(3); + q.erase_if(&is_odd); + q.clear(); +} -- 2.51.0
