Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsndfile for openSUSE:Factory checked in at 2026-10-15 18:20:26 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsndfile (Old) and /work/SRC/openSUSE:Factory/.libsndfile.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsndfile" Thu Oct 15 18:20:26 2026 rev:70 rq:1384832 version:1.2.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libsndfile/libsndfile-progs.changes 2026-05-08 16:43:04.083431325 +0200 +++ /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes 2026-10-15 18:20:37.649654048 +0200 @@ -0,0 +1,9 @@ +------------------------------------------------------------------- +Wed Oct 14 16:21:27 UTC 2026 - Takashi Iwai <[email protected]> + +- Add another fix for CVE-2022-33065: + libsndfile-CVE-2022-33065-2.patch +- Fix misaligned memory access issue in psf_binheader_readf() + (bsc#1282670, CVE-2026-88386) + libsndfile-CVE-2026-88386.patch + --- /work/SRC/openSUSE:Factory/libsndfile/libsndfile.changes 2026-05-08 16:43:04.103432154 +0200 +++ /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes 2026-10-15 18:20:37.667654802 +0200 @@ -1,0 +2,9 @@ +Wed Oct 14 16:21:27 UTC 2026 - Takashi Iwai <[email protected]> + +- Add another fix for CVE-2022-33065: + libsndfile-CVE-2022-33065-2.patch +- Fix misaligned memory access issue in psf_binheader_readf() + (bsc#1282670, CVE-2026-88386) + libsndfile-CVE-2026-88386.patch + +------------------------------------------------------------------- New: ---- libsndfile-CVE-2022-33065-2.patch libsndfile-CVE-2026-88386.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes-- Add another fix for CVE-2022-33065: /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes: libsndfile-CVE-2022-33065-2.patch /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes-- Fix misaligned memory access issue in psf_binheader_readf() -- /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes-- Add another fix for CVE-2022-33065: /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes: libsndfile-CVE-2022-33065-2.patch /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes-- Fix misaligned memory access issue in psf_binheader_readf() New:/work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes- (bsc#1282670, CVE-2026-88386) /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes: libsndfile-CVE-2026-88386.patch /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile-progs.changes- -- /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes- (bsc#1282670, CVE-2026-88386) /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes: libsndfile-CVE-2026-88386.patch /work/SRC/openSUSE:Factory/.libsndfile.new.3698736/libsndfile.changes- ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsndfile-progs.spec ++++++ --- /var/tmp/diff_new_pack.MT1TQ7/_old 2026-10-15 18:20:38.952708605 +0200 +++ /var/tmp/diff_new_pack.MT1TQ7/_new 2026-10-15 18:20:38.956708772 +0200 @@ -30,6 +30,8 @@ Patch2: libsndfile-CVE-2024-50612.patch Patch3: libsndfile-CVE-2025-56226.patch Patch4: sndfile-convert-CVE-2025-56226.patch +Patch10: libsndfile-CVE-2022-33065-2.patch +Patch11: libsndfile-CVE-2026-88386.patch # not merged yet to the upstream Patch5: libsndfile-CVE-2025-52194.patch Patch6: libsndfile-CVE-2026-37555.patch ++++++ libsndfile.spec ++++++ --- /var/tmp/diff_new_pack.MT1TQ7/_old 2026-10-15 18:20:39.024711619 +0200 +++ /var/tmp/diff_new_pack.MT1TQ7/_new 2026-10-15 18:20:39.029711829 +0200 @@ -32,6 +32,8 @@ Patch2: libsndfile-CVE-2024-50612.patch Patch3: libsndfile-CVE-2025-56226.patch Patch4: sndfile-convert-CVE-2025-56226.patch +Patch10: libsndfile-CVE-2022-33065-2.patch +Patch11: libsndfile-CVE-2026-88386.patch # not merged yet to the upstream Patch5: libsndfile-CVE-2025-52194.patch Patch6: libsndfile-CVE-2026-37555.patch ++++++ libsndfile-CVE-2022-33065-2.patch ++++++ >From 6be8906740cdca067f12920bb4a63f728485aff0 Mon Sep 17 00:00:00 2001 From: Alex Stewart <[email protected]> Date: Mon, 16 Oct 2023 12:37:47 -0400 Subject: [PATCH] common: fix int overflow in psf_binheader_readf() The psf_binheader_readf() function attempts to count and return the number of bytes traversed in the header. During this accumulation, it is possible to overflow the int-sized byte_count variable. Avoid this overflow by checking that the accumulated bytes do not exceed INT_MAX and throwing an error if they do. This implies that files with multi-gigabyte headers threaten to produce this error, but I imagine those files don't really exist - and this error is better than the undefined behavior which would have resulted previously. CVE: CVE-2022-33065 Fixes: https://github.com/libsndfile/libsndfile/issues/833 Signed-off-by: Alex Stewart <[email protected]> --- src/common.c | 36 ++++++++++++++++++++++++------------ 1 file changed, 24 insertions(+), 12 deletions(-) diff --git a/src/common.c b/src/common.c index b877aa8640dc..8982379a4104 100644 --- a/src/common.c +++ b/src/common.c @@ -18,6 +18,7 @@ #include <config.h> +#include <limits.h> #include <stdarg.h> #include <string.h> #if HAVE_UNISTD_H @@ -990,6 +991,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) double *doubleptr ; char c ; int byte_count = 0, count = 0 ; + int read_bytes = 0 ; if (! format) return psf_ftell (psf) ; @@ -998,6 +1000,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) while ((c = *format++)) { + read_bytes = 0 ; if (psf->header.indx + 16 >= psf->header.len && psf_bump_header_allocation (psf, 16)) break ; @@ -1014,7 +1017,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) intptr = va_arg (argptr, unsigned int*) ; *intptr = 0 ; ucptr = (unsigned char*) intptr ; - byte_count += header_read (psf, ucptr, sizeof (int)) ; + read_bytes = header_read (psf, ucptr, sizeof (int)) ; *intptr = GET_MARKER (ucptr) ; break ; @@ -1022,7 +1025,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) intptr = va_arg (argptr, unsigned int*) ; *intptr = 0 ; ucptr = (unsigned char*) intptr ; - byte_count += header_read (psf, sixteen_bytes, sizeof (sixteen_bytes)) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (sixteen_bytes)) ; { int k ; intdata = 0 ; for (k = 0 ; k < 16 ; k++) @@ -1034,14 +1037,14 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case '1' : charptr = va_arg (argptr, char*) ; *charptr = 0 ; - byte_count += header_read (psf, charptr, sizeof (char)) ; + read_bytes = header_read (psf, charptr, sizeof (char)) ; break ; case '2' : /* 2 byte value with the current endian-ness */ shortptr = va_arg (argptr, unsigned short*) ; *shortptr = 0 ; ucptr = (unsigned char*) shortptr ; - byte_count += header_read (psf, ucptr, sizeof (short)) ; + read_bytes = header_read (psf, ucptr, sizeof (short)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) *shortptr = GET_BE_SHORT (ucptr) ; else @@ -1051,7 +1054,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case '3' : /* 3 byte value with the current endian-ness */ intptr = va_arg (argptr, unsigned int*) ; *intptr = 0 ; - byte_count += header_read (psf, sixteen_bytes, 3) ; + read_bytes = header_read (psf, sixteen_bytes, 3) ; if (psf->rwf_endian == SF_ENDIAN_BIG) *intptr = GET_BE_3BYTE (sixteen_bytes) ; else @@ -1062,7 +1065,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) intptr = va_arg (argptr, unsigned int*) ; *intptr = 0 ; ucptr = (unsigned char*) intptr ; - byte_count += header_read (psf, ucptr, sizeof (int)) ; + read_bytes = header_read (psf, ucptr, sizeof (int)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) *intptr = psf_get_be32 (ucptr, 0) ; else @@ -1072,7 +1075,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case '8' : /* 8 byte value with the current endian-ness */ countptr = va_arg (argptr, sf_count_t *) ; *countptr = 0 ; - byte_count += header_read (psf, sixteen_bytes, 8) ; + read_bytes = header_read (psf, sixteen_bytes, 8) ; if (psf->rwf_endian == SF_ENDIAN_BIG) countdata = psf_get_be64 (sixteen_bytes, 0) ; else @@ -1083,7 +1086,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case 'f' : /* Float conversion */ floatptr = va_arg (argptr, float *) ; *floatptr = 0.0 ; - byte_count += header_read (psf, floatptr, sizeof (float)) ; + read_bytes = header_read (psf, floatptr, sizeof (float)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) *floatptr = float32_be_read ((unsigned char*) floatptr) ; else @@ -1093,7 +1096,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case 'd' : /* double conversion */ doubleptr = va_arg (argptr, double *) ; *doubleptr = 0.0 ; - byte_count += header_read (psf, doubleptr, sizeof (double)) ; + read_bytes = header_read (psf, doubleptr, sizeof (double)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) *doubleptr = double64_be_read ((unsigned char*) doubleptr) ; else @@ -1117,7 +1120,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) charptr = va_arg (argptr, char*) ; count = va_arg (argptr, size_t) ; memset (charptr, 0, count) ; - byte_count += header_read (psf, charptr, count) ; + read_bytes = header_read (psf, charptr, count) ; break ; case 'G' : @@ -1128,7 +1131,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) if (psf->header.indx + count >= psf->header.len && psf_bump_header_allocation (psf, count)) break ; - byte_count += header_gets (psf, charptr, count) ; + read_bytes = header_gets (psf, charptr, count) ; break ; case 'z' : @@ -1152,7 +1155,7 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case 'j' : /* Seek to position from current position. */ count = va_arg (argptr, size_t) ; header_seek (psf, count, SEEK_CUR) ; - byte_count += count ; + read_bytes = count ; break ; case '!' : /* Clear buffer, forcing re-read. */ @@ -1164,8 +1167,17 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) psf->error = SFE_INTERNAL ; break ; } ; + + if (read_bytes > 0 && byte_count > (INT_MAX - read_bytes)) + { psf_log_printf (psf, "Header size exceeds INT_MAX. Aborting.", c) ; + psf->error = SFE_INTERNAL ; + break ; + } else + { byte_count += read_bytes ; } ; + } ; /*end while*/ + va_end (argptr) ; return byte_count ; -- 2.55.0 ++++++ libsndfile-CVE-2026-88386.patch ++++++ >From 474e4d328b1e6240b93ec6ed14efb7c6a44bee57 Mon Sep 17 00:00:00 2001 From: 4ktluffy <[email protected]> Date: Mon, 10 Aug 2026 21:50:38 +0300 Subject: [PATCH] common: Use memcpy for unaligned field stores psf_binheader_readf() stores decoded header values through pointers obtained from va_arg and cast to a wider type. The destination fields live inside packed on-disk header structs and are not guaranteed to be naturally aligned, so these stores are undefined behaviour. They work on x86 but fault on strict-alignment targets, and UBSan traps them. A crafted WAV file with wFormatTag 0x0055 makes wavlike_read_fmt_chunk() read into a field at an address that is not 4 byte aligned: common.c:1066: runtime error: store to misaligned address for type 'unsigned int', which requires 4 byte alignment The same pattern is used by every multi-byte specifier, so route them all through small memcpy based helpers, which impose no alignment requirement. The 'f' and 'd' cases additionally read directly into the unaligned destination; they now read into the scratch buffer first, as the other cases already do. The single byte '1' case is left alone since it cannot be misaligned. Fixes #1150 --- src/common.c | 89 ++++++++++++++++++++++++++++++++++------------------ 1 file changed, 58 insertions(+), 31 deletions(-) diff --git a/src/common.c b/src/common.c index 8982379a4104..3c9a4c36a3d0 100644 --- a/src/common.c +++ b/src/common.c @@ -979,11 +979,42 @@ header_gets (SF_PRIVATE *psf, char *ptr, int bufsize) return k ; } /* header_gets */ +/* +** Destination fields passed to psf_binheader_readf() live inside packed +** on-disk header structs and are not guaranteed to be naturally aligned. +** Storing through a cast pointer is undefined behaviour and faults on +** strict-alignment targets, so route every multi-byte store through memcpy(). +*/ +static inline void +store_uint (void *ptr, unsigned int value) +{ memcpy (ptr, &value, sizeof (value)) ; +} /* store_uint */ + +static inline void +store_ushort (void *ptr, unsigned short value) +{ memcpy (ptr, &value, sizeof (value)) ; +} /* store_ushort */ + +static inline void +store_count (void *ptr, sf_count_t value) +{ memcpy (ptr, &value, sizeof (value)) ; +} /* store_count */ + +static inline void +store_float (void *ptr, float value) +{ memcpy (ptr, &value, sizeof (value)) ; +} /* store_float */ + +static inline void +store_double (void *ptr, double value) +{ memcpy (ptr, &value, sizeof (value)) ; +} /* store_double */ + int psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) { va_list argptr ; sf_count_t *countptr, countdata ; - unsigned char *ucptr, sixteen_bytes [16] = { 0 } ; + unsigned char sixteen_bytes [16] = { 0 } ; unsigned int *intptr, intdata ; unsigned short *shortptr ; char *charptr ; @@ -1015,23 +1046,21 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case 'm' : /* 4 byte marker value eg 'RIFF' */ intptr = va_arg (argptr, unsigned int*) ; - *intptr = 0 ; - ucptr = (unsigned char*) intptr ; - read_bytes = header_read (psf, ucptr, sizeof (int)) ; - *intptr = GET_MARKER (ucptr) ; + store_uint (intptr, 0) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (int)) ; + store_uint (intptr, GET_MARKER (sixteen_bytes)) ; break ; case 'h' : intptr = va_arg (argptr, unsigned int*) ; - *intptr = 0 ; - ucptr = (unsigned char*) intptr ; + store_uint (intptr, 0) ; read_bytes = header_read (psf, sixteen_bytes, sizeof (sixteen_bytes)) ; { int k ; intdata = 0 ; for (k = 0 ; k < 16 ; k++) intdata ^= sixteen_bytes [k] << k ; } - *intptr = intdata ; + store_uint (intptr, intdata) ; break ; case '1' : @@ -1042,65 +1071,63 @@ psf_binheader_readf (SF_PRIVATE *psf, char const *format, ...) case '2' : /* 2 byte value with the current endian-ness */ shortptr = va_arg (argptr, unsigned short*) ; - *shortptr = 0 ; - ucptr = (unsigned char*) shortptr ; - read_bytes = header_read (psf, ucptr, sizeof (short)) ; + store_ushort (shortptr, 0) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (short)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) - *shortptr = GET_BE_SHORT (ucptr) ; + store_ushort (shortptr, GET_BE_SHORT (sixteen_bytes)) ; else - *shortptr = GET_LE_SHORT (ucptr) ; + store_ushort (shortptr, GET_LE_SHORT (sixteen_bytes)) ; break ; case '3' : /* 3 byte value with the current endian-ness */ intptr = va_arg (argptr, unsigned int*) ; - *intptr = 0 ; + store_uint (intptr, 0) ; read_bytes = header_read (psf, sixteen_bytes, 3) ; if (psf->rwf_endian == SF_ENDIAN_BIG) - *intptr = GET_BE_3BYTE (sixteen_bytes) ; + store_uint (intptr, GET_BE_3BYTE (sixteen_bytes)) ; else - *intptr = GET_LE_3BYTE (sixteen_bytes) ; + store_uint (intptr, GET_LE_3BYTE (sixteen_bytes)) ; break ; case '4' : /* 4 byte value with the current endian-ness */ intptr = va_arg (argptr, unsigned int*) ; - *intptr = 0 ; - ucptr = (unsigned char*) intptr ; - read_bytes = header_read (psf, ucptr, sizeof (int)) ; + store_uint (intptr, 0) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (int)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) - *intptr = psf_get_be32 (ucptr, 0) ; + store_uint (intptr, psf_get_be32 (sixteen_bytes, 0)) ; else - *intptr = psf_get_le32 (ucptr, 0) ; + store_uint (intptr, psf_get_le32 (sixteen_bytes, 0)) ; break ; case '8' : /* 8 byte value with the current endian-ness */ countptr = va_arg (argptr, sf_count_t *) ; - *countptr = 0 ; + store_count (countptr, 0) ; read_bytes = header_read (psf, sixteen_bytes, 8) ; if (psf->rwf_endian == SF_ENDIAN_BIG) countdata = psf_get_be64 (sixteen_bytes, 0) ; else countdata = psf_get_le64 (sixteen_bytes, 0) ; - *countptr = countdata ; + store_count (countptr, countdata) ; break ; case 'f' : /* Float conversion */ floatptr = va_arg (argptr, float *) ; - *floatptr = 0.0 ; - read_bytes = header_read (psf, floatptr, sizeof (float)) ; + store_float (floatptr, 0.0) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (float)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) - *floatptr = float32_be_read ((unsigned char*) floatptr) ; + store_float (floatptr, float32_be_read (sixteen_bytes)) ; else - *floatptr = float32_le_read ((unsigned char*) floatptr) ; + store_float (floatptr, float32_le_read (sixteen_bytes)) ; break ; case 'd' : /* double conversion */ doubleptr = va_arg (argptr, double *) ; - *doubleptr = 0.0 ; - read_bytes = header_read (psf, doubleptr, sizeof (double)) ; + store_double (doubleptr, 0.0) ; + read_bytes = header_read (psf, sixteen_bytes, sizeof (double)) ; if (psf->rwf_endian == SF_ENDIAN_BIG) - *doubleptr = double64_be_read ((unsigned char*) doubleptr) ; + store_double (doubleptr, double64_be_read (sixteen_bytes)) ; else - *doubleptr = double64_le_read ((unsigned char*) doubleptr) ; + store_double (doubleptr, double64_le_read (sixteen_bytes)) ; break ; case 's' : -- 2.55.0
