Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package librecad for openSUSE:Factory checked in at 2026-10-16 20:09:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/librecad (Old) and /work/SRC/openSUSE:Factory/.librecad.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "librecad" Fri Oct 16 20:09:46 2026 rev:40 rq:1385145 version:2.2.1.5 Changes: -------- --- /work/SRC/openSUSE:Factory/librecad/librecad.changes 2026-09-01 15:48:34.011196437 +0200 +++ /work/SRC/openSUSE:Factory/.librecad.new.3698736/librecad.changes 2026-10-16 20:13:46.452469655 +0200 @@ -1,0 +2,6 @@ +Fri Oct 16 06:25:03 UTC 2026 - Jiri Slaby <[email protected]> + +- add libdxfrw-fix-OOB-read-in-dwgReader18-readFileHeader.patch (bsc#1285638 + CVE-2026-110606) + +------------------------------------------------------------------- New: ---- libdxfrw-fix-OOB-read-in-dwgReader18-readFileHeader.patch ----------(New B)---------- New: - add libdxfrw-fix-OOB-read-in-dwgReader18-readFileHeader.patch (bsc#1285638 CVE-2026-110606) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ librecad.spec ++++++ --- /var/tmp/diff_new_pack.05i9c9/_old 2026-10-16 20:13:47.423510432 +0200 +++ /var/tmp/diff_new_pack.05i9c9/_new 2026-10-16 20:13:47.425510516 +0200 @@ -33,6 +33,7 @@ Source4: https://dokuwiki.librecad.org/lib/exe/fetch.php/partlibs:electrical1-lcad.zip#/electrical1-lcad.zip Source10: ttf2lff.1 Source20: %name-rpmlintrc +Patch0: libdxfrw-fix-OOB-read-in-dwgReader18-readFileHeader.patch Patch4: librecad-no-date.diff Patch6: librecad-install.diff Patch7: librecad-plugindir.diff ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.05i9c9/_old 2026-10-16 20:13:47.471512448 +0200 +++ /var/tmp/diff_new_pack.05i9c9/_new 2026-10-16 20:13:47.476512658 +0200 @@ -1,5 +1,5 @@ -mtime: 1788161516 -commit: 2864fc8e849e8d9e92fde09f51724ccd9890287f6a8d700773d313766e2a1f8e +mtime: 1792131986 +commit: 38eac8899c22d5745f817b0028adb321fd32d08731f6101bacf883254c225a96 url: https://src.opensuse.org/jengelh/librecad revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-16 08:26:26.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ libdxfrw-fix-OOB-read-in-dwgReader18-readFileHeader.patch ++++++ From: Jiri Slaby <[email protected]> Date: Fri, 16 Oct 2026 08:19:52 +0200 Subject: libdxfrw: fix OOB read in dwgReader18::readFileHeader() References: bsc#1285638 CVE-2026-110606 Patch-mainline: yes This is to fix CVE-2026-110606. In upstream, this was fixed as a part of a huge commit abd1f4a8e32d ("DWG: round 9: DWG/DXF interoperability support (#2790)"). This version fixes just the CVE. Signed-off-by: Jiri Slaby <[email protected]> --- libraries/libdxfrw/src/intern/dwgreader18.cpp | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/libraries/libdxfrw/src/intern/dwgreader18.cpp b/libraries/libdxfrw/src/intern/dwgreader18.cpp index 78fa9b1da229..9d2fe10546ff 100644 --- a/libraries/libdxfrw/src/intern/dwgreader18.cpp +++ b/libraries/libdxfrw/src/intern/dwgreader18.cpp @@ -10,6 +10,8 @@ ** along with this program. If not, see <http://www.gnu.org/licenses/>. ** ******************************************************************************/ +#include <algorithm> +#include <cstdint> #include <cstdlib> #include <iostream> #include <fstream> @@ -382,9 +384,13 @@ bool dwgReader18::readFileHeader() { secInfo.encrypted = buff3.getRawLong32(); //encrypted (doc: 0 no, 1 yes, 2 unkn) on read: objects 0 and encrypted yes DRW_DBG("\nEncrypted= "); DRW_DBGH(secInfo.encrypted); - duint8 nameCStr[64]; - buff3.getBytes(nameCStr, 64); - secInfo.name = reinterpret_cast<char*>(nameCStr); + std::uint8_t nameCStr[64]{}; + if (!buff3.getBytes(nameCStr, 64)) + return false; + const auto nameEnd = std::find(std::begin(nameCStr), + std::end(nameCStr), std::uint8_t{0}); + secInfo.name.assign(reinterpret_cast<const char*>(nameCStr), + static_cast<std::size_t>(nameEnd - nameCStr)); DRW_DBG("\nSection std::Name= "); DRW_DBG( secInfo.name.c_str() ); DRW_DBG("\n"); for (unsigned int i = 0; i < secInfo.pageCount; i++){ duint32 pn = buff3.getRawLong32(); -- 2.56.0
