Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package live555 for openSUSE:Factory checked in at 2026-10-15 18:20:16 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/live555 (Old) and /work/SRC/openSUSE:Factory/.live555.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "live555" Thu Oct 15 18:20:16 2026 rev:49 rq:1384814 version:2026.10.13 Changes: -------- --- /work/SRC/openSUSE:Factory/live555/live555.changes 2026-09-11 19:00:59.590772817 +0200 +++ /work/SRC/openSUSE:Factory/.live555.new.3698736/live555.changes 2026-10-15 18:20:26.399183011 +0200 @@ -1,0 +2,8 @@ +Wed Oct 14 14:39:17 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 2026.10.13: + * Updated the "H263plusVideoRTPSource" code to protect against a + malicious series of incoming packets possibly overflowing a + buffer. + +------------------------------------------------------------------- Old: ---- live.2026.08.25.tar.gz New: ---- live.2026.10.13.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ live555.spec ++++++ --- /var/tmp/diff_new_pack.FDqinX/_old 2026-10-15 18:20:27.484228440 +0200 +++ /var/tmp/diff_new_pack.FDqinX/_new 2026-10-15 18:20:27.486228524 +0200 @@ -20,7 +20,7 @@ %define lmdmaj 120 Name: live555 -Version: 2026.08.25 +Version: 2026.10.13 Release: 0 Summary: LIVE555 Streaming Media License: LGPL-2.1-only ++++++ live.2026.08.25.tar.gz -> live.2026.10.13.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/BasicUsageEnvironment/include/BasicUsageEnvironment_version.hh new/live/BasicUsageEnvironment/include/BasicUsageEnvironment_version.hh --- old/live/BasicUsageEnvironment/include/BasicUsageEnvironment_version.hh 2026-08-25 22:31:29.000000000 +0200 +++ new/live/BasicUsageEnvironment/include/BasicUsageEnvironment_version.hh 2026-10-13 23:43:35.000000000 +0200 @@ -19,8 +19,8 @@ #ifndef _BASICUSAGEENVIRONMENT_VERSION_HH #define _BASICUSAGEENVIRONMENT_VERSION_HH -#define BASICUSAGEENVIRONMENT_LIBRARY_VERSION_STRING "2026.08.25" -#define BASICUSAGEENVIRONMENT_LIBRARY_VERSION_INT 1787616000 +#define BASICUSAGEENVIRONMENT_LIBRARY_VERSION_STRING "2026.10.13" +#define BASICUSAGEENVIRONMENT_LIBRARY_VERSION_INT 1791849600 extern char const* const BasicUsageEnvironmentLibraryVersionStr; extern int const BasicUsageEnvironmentLibraryVersionInt; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/UsageEnvironment/include/UsageEnvironment_version.hh new/live/UsageEnvironment/include/UsageEnvironment_version.hh --- old/live/UsageEnvironment/include/UsageEnvironment_version.hh 2026-08-25 22:31:29.000000000 +0200 +++ new/live/UsageEnvironment/include/UsageEnvironment_version.hh 2026-10-13 23:43:35.000000000 +0200 @@ -19,8 +19,8 @@ #ifndef _USAGEENVIRONMENT_VERSION_HH #define _USAGEENVIRONMENT_VERSION_HH -#define USAGEENVIRONMENT_LIBRARY_VERSION_STRING "2026.08.25" -#define USAGEENVIRONMENT_LIBRARY_VERSION_INT 1787616000 +#define USAGEENVIRONMENT_LIBRARY_VERSION_STRING "2026.10.13" +#define USAGEENVIRONMENT_LIBRARY_VERSION_INT 1791849600 extern char const* const UsageEnvironmentLibraryVersionStr; extern int const UsageEnvironmentLibraryVersionInt; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/config.linux-with-shared-libraries new/live/config.linux-with-shared-libraries --- old/live/config.linux-with-shared-libraries 2026-08-25 22:32:59.000000000 +0200 +++ new/live/config.linux-with-shared-libraries 2026-10-13 23:44:17.000000000 +0200 @@ -4,7 +4,7 @@ # One or more interfaces were added, but no existing interfaces were changed or removed => CURRENT += 1; REVISION = 0; AGE += 1 libliveMedia_VERSION_CURRENT=120 -libliveMedia_VERSION_REVISION=9 +libliveMedia_VERSION_REVISION=12 libliveMedia_VERSION_AGE=0 libliveMedia_LIB_SUFFIX=so.$(shell expr $(libliveMedia_VERSION_CURRENT) - $(libliveMedia_VERSION_AGE)).$(libliveMedia_VERSION_AGE).$(libliveMedia_VERSION_REVISION) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/groupsock/include/groupsock_version.hh new/live/groupsock/include/groupsock_version.hh --- old/live/groupsock/include/groupsock_version.hh 2026-08-25 22:31:29.000000000 +0200 +++ new/live/groupsock/include/groupsock_version.hh 2026-10-13 23:43:35.000000000 +0200 @@ -19,8 +19,8 @@ #ifndef _GROUPSOCK_VERSION_HH #define _GROUPSOCK_VERSION_HH -#define GROUPSOCK_LIBRARY_VERSION_STRING "2026.08.25" -#define GROUPSOCK_LIBRARY_VERSION_INT 1787616000 +#define GROUPSOCK_LIBRARY_VERSION_STRING "2026.10.13" +#define GROUPSOCK_LIBRARY_VERSION_INT 1791849600 extern char const* const groupsockLibraryVersionStr; extern int const groupsockLibraryVersionInt; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/H263plusVideoRTPSource.cpp new/live/liveMedia/H263plusVideoRTPSource.cpp --- old/live/liveMedia/H263plusVideoRTPSource.cpp 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/H263plusVideoRTPSource.cpp 2026-10-13 23:43:35.000000000 +0200 @@ -74,17 +74,14 @@ fNumSpecialHeaders = fSpecialHeaderBytesLength = 0; } - // Make a copy of the special header bytes, in case a reader - // can use them: - unsigned bytesAvailable - = SPECIAL_HEADER_BUFFER_SIZE - fSpecialHeaderBytesLength - 1; - if (expectedHeaderSize <= bytesAvailable) { - fSpecialHeaderBytes[fSpecialHeaderBytesLength++] = expectedHeaderSize; - for (unsigned i = 0; i < expectedHeaderSize; ++i) { - fSpecialHeaderBytes[fSpecialHeaderBytesLength++] = headerStart[i]; - } - fPacketSizes[fNumSpecialHeaders++] = packetSize; + // Make a copy of the special header bytes, in case a reader can use them: + if (fSpecialHeaderBytesLength + (1+expectedHeaderSize) > SPECIAL_HEADER_BUFFER_SIZE + || fNumSpecialHeaders == 0xFF) return False; // no more space available for the copy + fSpecialHeaderBytes[fSpecialHeaderBytesLength++] = expectedHeaderSize; + for (unsigned i = 0; i < expectedHeaderSize; ++i) { + fSpecialHeaderBytes[fSpecialHeaderBytesLength++] = headerStart[i]; } + fPacketSizes[fNumSpecialHeaders++] = packetSize; if (P) { // Prepend two zero bytes to the start of the payload proper. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/JPEGVideoRTPSource.cpp new/live/liveMedia/JPEGVideoRTPSource.cpp --- old/live/liveMedia/JPEGVideoRTPSource.cpp 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/JPEGVideoRTPSource.cpp 2026-10-13 23:43:35.000000000 +0200 @@ -451,8 +451,9 @@ ::nextEnclosedFrameSize(unsigned char*& framePtr, unsigned dataSize) { // Normally, the enclosed frame size is just "dataSize". If, however, // the frame does not end with the "EOI" marker, then add this now: - if (completesFrame && dataSize >= 2 && - !(framePtr[dataSize-2] == 0xFF && framePtr[dataSize-1] == MARKER_EOI)) { + if (completesFrame && dataSize >= 2 + && !(framePtr[dataSize-2] == 0xFF && framePtr[dataSize-1] == MARKER_EOI) + && framePtr + dataSize + 2 <= fBuf + fPacketSize /* do we have enough space for this */) { framePtr[dataSize++] = 0xFF; framePtr[dataSize++] = MARKER_EOI; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/MediaSession.cpp new/live/liveMedia/MediaSession.cpp --- old/live/liveMedia/MediaSession.cpp 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/MediaSession.cpp 2026-10-13 23:43:35.000000000 +0200 @@ -1490,8 +1490,10 @@ ////////// SDPAttribute implementation ////////// SDPAttribute::SDPAttribute(char const* strValue, Boolean valueIsHexadecimal) - : fStrValue(strDup(strValue)), fStrValueToLower(NULL), fValueIsHexadecimal(valueIsHexadecimal) { + : fStrValue(strDup(strValue)), fStrValueToLower(NULL), + fIntValue(0), fValueIsHexadecimal(valueIsHexadecimal) { if (fStrValue == NULL) { + fStrValue = strDup(""); // No value was given for this attribute, so consider it to be a Boolean, with value True: fIntValue = 1; } else { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/RTSPClient.cpp new/live/liveMedia/RTSPClient.cpp --- old/live/liveMedia/RTSPClient.cpp 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/RTSPClient.cpp 2026-10-13 23:43:35.000000000 +0200 @@ -1324,7 +1324,6 @@ rangeOK = True; MediaSubsessionIterator iter(*session); - MediaSubsession* subsession; while ((subsession = iter.next()) != NULL) { subsession->scale() = session->scale(); subsession->speed() = session->speed(); @@ -1340,7 +1339,7 @@ if (subsession->rtpSource() != NULL) subsession->rtpSource()->enableRTCPReports() = True; // start sending RTCP "RR"s now } } else { - // The command was on a subsession + // The command was on a subsession (ASSERT: subsession != NULL) if (scaleParamsStr != NULL && !parseScaleParam(scaleParamsStr, subsession->scale())) break; scaleOK = True; if (speedParamsStr != NULL && !parseSpeedParam(speedParamsStr, subsession->speed())) break; @@ -1380,8 +1379,9 @@ return False; } -Boolean RTSPClient::handleTEARDOWNResponse(MediaSession& /*session*/, MediaSubsession& /*subsession*/) { - // Because we don't expect to always get a response to "TEARDOWN", we don't need to do anything if we do get one: +Boolean RTSPClient::handleTEARDOWNResponse() { + // Because we don't expect to always get a response to "TEARDOWN", + // we don't need to do anything if we do get one: return True; } @@ -1943,11 +1943,11 @@ if (responseCode == 200) { // Do special-case response handling for some commands: if (strcmp(foundRequest->commandName(), "SETUP") == 0) { - if (!handleSETUPResponse(*foundRequest->subsession(), sessionParamsStr, transportParamsStr, foundRequest->booleanFlags()&0x1)) break; + if (!handleSETUPResponse(*foundRequest->subsession(), sessionParamsStr, transportParamsStr, foundRequest->booleanFlags()&0x1)) break; } else if (strcmp(foundRequest->commandName(), "PLAY") == 0) { - if (!handlePLAYResponse(foundRequest->session(), foundRequest->subsession(), scaleParamsStr, speedParamsStr, rangeParamsStr, rtpInfoParamsStr)) break; + if (!handlePLAYResponse(foundRequest->session(), foundRequest->subsession(), scaleParamsStr, speedParamsStr, rangeParamsStr, rtpInfoParamsStr)) break; } else if (strcmp(foundRequest->commandName(), "TEARDOWN") == 0) { - if (!handleTEARDOWNResponse(*foundRequest->session(), *foundRequest->subsession())) break; + if (!handleTEARDOWNResponse()) break; } else if (strcmp(foundRequest->commandName(), "GET_PARAMETER") == 0) { if (!handleGET_PARAMETERResponse(foundRequest->contentStr(), bodyStart, responseEnd)) break; } @@ -1963,6 +1963,7 @@ } } else if (responseCode == 301 || responseCode == 302) { // redirection resetTCPSockets(); // because we need to connect somewhere else next + fCurrentAuthenticator.reset(); needToResendCommand = True; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/include/RTSPClient.hh new/live/liveMedia/include/RTSPClient.hh --- old/live/liveMedia/include/RTSPClient.hh 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/include/RTSPClient.hh 2026-10-13 23:43:35.000000000 +0200 @@ -298,7 +298,7 @@ Boolean handlePLAYResponse(MediaSession* session, MediaSubsession* subsession, char const* scaleParamsStr, const char* speedParamsStr, char const* rangeParamsStr, char const* rtpInfoParamsStr); - Boolean handleTEARDOWNResponse(MediaSession& session, MediaSubsession& subsession); + Boolean handleTEARDOWNResponse(); Boolean handleGET_PARAMETERResponse(char const* parameterName, char*& resultValueString, char* resultValueStringEnd); Boolean handleAuthenticationFailure(char const* wwwAuthenticateParamsStr); Boolean resendCommand(RequestRecord* request); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/live/liveMedia/include/liveMedia_version.hh new/live/liveMedia/include/liveMedia_version.hh --- old/live/liveMedia/include/liveMedia_version.hh 2026-08-25 22:31:29.000000000 +0200 +++ new/live/liveMedia/include/liveMedia_version.hh 2026-10-13 23:43:35.000000000 +0200 @@ -19,8 +19,8 @@ #ifndef _LIVEMEDIA_VERSION_HH #define _LIVEMEDIA_VERSION_HH -#define LIVEMEDIA_LIBRARY_VERSION_STRING "2026.08.25" -#define LIVEMEDIA_LIBRARY_VERSION_INT 1787616000 +#define LIVEMEDIA_LIBRARY_VERSION_STRING "2026.10.13" +#define LIVEMEDIA_LIBRARY_VERSION_INT 1791849600 extern char const* const liveMediaLibraryVersionStr; extern int const liveMediaLibraryVersionInt;
