Bug#1136102: trixie-pu: package kissfft/131.1.0-4.1~deb13u1

2026-05-14 Thread Adrian Bunk 
On Sun, May 10, 2026 at 07:25:21PM +0100, Jonathan Wiltshire wrote:
> Hi,
> 
> On Sat, May 09, 2026 at 05:39:40PM +0300, Adrian Bunk wrote:
> > +@@ -34,18 +34,30 @@ kiss_fftndr_cfg kiss_fftndr_alloc(const int *dims,int 
> > ndims,int inverse_fft,void
> > + kiss_fftndr_cfg st = NULL;
> > + size_t nr=0 , nd=0,ntmp=0;
> > + int dimReal = dims[ndims-1];
> > +-int dimOther = prod(dims,ndims-1);
> > ++size_t dimOther = prod(dims,ndims-1);
> > + size_t memneeded;
> > + char * ptr = NULL;
> > ++int k,check;
> > + 
> > + (void)kiss_fftr_alloc(dimReal,inverse_fft,NULL,&nr);
> > + (void)kiss_fftnd_alloc(dims,ndims-1,inverse_fft,NULL,&nd);
> > + ntmp =
> > + MAX( 2*dimOther , dimReal+2) * sizeof(kiss_fft_scalar)  // freq 
> > buffer for one pass
> > +-+ dimOther*(dimReal+2) * sizeof(kiss_fft_scalar);  // large 
> > enough to hold entire input in case of in-place
> > +++ dimOther*(size_t)(dimReal+2) * sizeof(kiss_fft_scalar);  // 
> > large enough to hold entire input in case of in-place
> > + 
> > + memneeded = KISS_FFT_ALIGN_SIZE_UP(sizeof( struct kiss_fftndr_state 
> > )) + KISS_FFT_ALIGN_SIZE_UP(nr) + KISS_FFT_ALIGN_SIZE_UP(nd) + 
> > KISS_FFT_ALIGN_SIZE_UP(ntmp);
> > + 
> > ++/* check for overflow */
> > ++check = memneeded;
> 
> Not being familiar with the codebase I very much could be wrong, but as
> check is int and memneeded is size_t could it get truncated or wrapped on
> large values?

Good catch, I'll ask upstream about it.

check is only used for checking whether memneeded is big enough,
my reading of the code is that the impact might be rejecting valid
very large input.

cu
Adrian

Bug#1136102: trixie-pu: package kissfft/131.1.0-4.1~deb13u1

2026-05-10 Thread Jonathan Wiltshire 
Hi,

On Sat, May 09, 2026 at 05:39:40PM +0300, Adrian Bunk wrote:
> +@@ -34,18 +34,30 @@ kiss_fftndr_cfg kiss_fftndr_alloc(const int *dims,int 
> ndims,int inverse_fft,void
> + kiss_fftndr_cfg st = NULL;
> + size_t nr=0 , nd=0,ntmp=0;
> + int dimReal = dims[ndims-1];
> +-int dimOther = prod(dims,ndims-1);
> ++size_t dimOther = prod(dims,ndims-1);
> + size_t memneeded;
> + char * ptr = NULL;
> ++int k,check;
> + 
> + (void)kiss_fftr_alloc(dimReal,inverse_fft,NULL,&nr);
> + (void)kiss_fftnd_alloc(dims,ndims-1,inverse_fft,NULL,&nd);
> + ntmp =
> + MAX( 2*dimOther , dimReal+2) * sizeof(kiss_fft_scalar)  // freq 
> buffer for one pass
> +-+ dimOther*(dimReal+2) * sizeof(kiss_fft_scalar);  // large enough 
> to hold entire input in case of in-place
> +++ dimOther*(size_t)(dimReal+2) * sizeof(kiss_fft_scalar);  // large 
> enough to hold entire input in case of in-place
> + 
> + memneeded = KISS_FFT_ALIGN_SIZE_UP(sizeof( struct kiss_fftndr_state )) 
> + KISS_FFT_ALIGN_SIZE_UP(nr) + KISS_FFT_ALIGN_SIZE_UP(nd) + 
> KISS_FFT_ALIGN_SIZE_UP(ntmp);
> + 
> ++/* check for overflow */
> ++check = memneeded;

Not being familiar with the codebase I very much could be wrong, but as
check is int and memneeded is size_t could it get truncated or wrapped on
large values?


-- 
Jonathan Wiltshire  [email protected]
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1

Bug#1136102: trixie-pu: package kissfft/131.1.0-4.1~deb13u1

2026-05-09 Thread Adrian Bunk 
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:kissfft
User: [email protected]
Usertags: pu

  * CVE-2025-34297: Integer Overflow on 32-bit Systems
(Closes: #1131147)
  * CVE-2026-41445: Integer Overflow in kiss_fftndr_alloc()
(Closes: #1134493)

cmake_4.patch is disabled in debian/patches/series,
the other changes from 131.1.0-4 look harmless enough.
diffstat for kissfft-131.1.0 kissfft-131.1.0

 changelog   |   33 

 control |4 
 copyright   |4 
 gitlab-ci.yml   |6 
 patches/0001-check-for-overflow-on-32-bit-platform-closes-120.patch |   36 

 patches/0002-kiss_fftndr_alloc-check-for-overflow-and-_perhaps_-l.patch |   82 
++
 patches/cmake_4.patch   |   27 
+++
 patches/series  |3 
 salsa-ci.yml|3 
 9 files changed, 188 insertions(+), 10 deletions(-)

diff -Nru kissfft-131.1.0/debian/changelog kissfft-131.1.0/debian/changelog
--- kissfft-131.1.0/debian/changelog2022-11-18 23:57:24.0 +0200
+++ kissfft-131.1.0/debian/changelog2026-05-09 17:31:44.0 +0300
@@ -1,3 +1,36 @@
+kissfft (131.1.0-4.1~deb13u1) trixie; urgency=medium
+
+  * Non-maintainer upload.
+  * Rebuild for trixie.
+- Don't include the CMake 4 fix.
+
+ -- Adrian Bunk   Sat, 09 May 2026 17:31:44 +0300
+
+kissfft (131.1.0-4.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * CVE-2025-34297: Integer Overflow on 32-bit Systems
+(Closes: #1131147)
+  * CVE-2026-41445: Integer Overflow in kiss_fftndr_alloc()
+(Closes: #1134493)
+
+ -- Adrian Bunk   Thu, 07 May 2026 14:02:10 +0300
+
+kissfft (131.1.0-4) unstable; urgency=medium
+
+  * Team upload.
+
+  [ Vasyl Gello ]
+  * Fix lintian warnings
+
+  [ Dylan Aïssi ]
+  * Cherry-pick upstream patch to improve compatibility with cmake 4
+  * Update debian/salsa-ci.yml
+  * Switch Build-Dep from pkg-config to pkgconf
+  * Standards-Version: 4.7.2 (routine-update)
+
+ -- Dylan Aïssi   Thu, 25 Sep 2025 23:32:11 +0200
+
 kissfft (131.1.0-3) unstable; urgency=medium
 
   * [DNM] Try unmerged PRs
diff -Nru kissfft-131.1.0/debian/control kissfft-131.1.0/debian/control
--- kissfft-131.1.0/debian/control  2021-10-07 16:30:50.0 +0300
+++ kissfft-131.1.0/debian/control  2025-09-26 00:32:11.0 +0300
@@ -9,10 +9,10 @@
  debhelper-compat (= 13),
  libfftw3-dev,
  libpng-dev,
- pkg-config,
+ pkgconf,
  python3,
  python3-numpy,
-Standards-Version: 4.6.0
+Standards-Version: 4.7.2
 Rules-Requires-Root: no
 Homepage: https://github.com/mborgerding/kissfft
 Vcs-Git: https://salsa.debian.org/multimedia-team/kissfft.git
diff -Nru kissfft-131.1.0/debian/copyright kissfft-131.1.0/debian/copyright
--- kissfft-131.1.0/debian/copyright2021-01-15 04:04:49.0 +0200
+++ kissfft-131.1.0/debian/copyright2025-09-26 00:32:11.0 +0300
@@ -3,13 +3,13 @@
 Source: https://github.com/mborgerding/kissfft
 
 Files: *
-Copyright: 2003-2020, Mark Borgerding
+Copyright: 2003-2022, Mark Borgerding
 License: BSD-3-clause
 Comment: Full list of contributors available from
  Github commit history
 
 Files: debian/*
-Copyright: 2020 Vasyl Gello 
+Copyright: 2020-2022 Vasyl Gello 
 License: BSD-3-clause
 Comment: License text retrieved from upstream LICENSES/BSD-3-Clause file
 
diff -Nru kissfft-131.1.0/debian/gitlab-ci.yml 
kissfft-131.1.0/debian/gitlab-ci.yml
--- kissfft-131.1.0/debian/gitlab-ci.yml2021-01-15 04:04:49.0 
+0200
+++ kissfft-131.1.0/debian/gitlab-ci.yml1970-01-01 02:00:00.0 
+0200
@@ -1,6 +0,0 @@
-include:
- - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
- - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
-
-variables:
- RELEASE: 'unstable'
diff -Nru 
kissfft-131.1.0/debian/patches/0001-check-for-overflow-on-32-bit-platform-closes-120.patch
 
kissfft-131.1.0/debian/patches/0001-check-for-overflow-on-32-bit-platform-closes-120.patch
--- 
kissfft-131.1.0/debian/patches/0001-check-for-overflow-on-32-bit-platform-closes-120.patch
  1970-01-01 02:00:00.0 +0200
+++ 
kissfft-131.1.0/debian/patches/0001-check-for-overflow-on-32-bit-platform-closes-120.patch
  2026-05-07 14:01:40.0 +0300
@@ -0,0 +1,36 @@
+From 9a13b3b7f8568ebdad4508447708ce6f509667ee Mon Sep 17 00:00:00 2001
+From: Mark Borgerding 
+Date: Wed, 26 Nov 2025 10:39:17 -0500
+Subject: check for overflow on 32 bit platform (closes #120)
+
+---
+ kiss_fft.c | 6 +-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/