Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package OpenImageIO for openSUSE:Factory checked in at 2026-08-04 21:32:56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/OpenImageIO (Old) and /work/SRC/openSUSE:Factory/.OpenImageIO.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "OpenImageIO" Tue Aug 4 21:32:56 2026 rev:87 rq:1369201 version:3.1.16.0 Changes: -------- --- /work/SRC/openSUSE:Factory/OpenImageIO/OpenImageIO.changes 2026-07-17 01:45:32.621422593 +0200 +++ /work/SRC/openSUSE:Factory/.OpenImageIO.new.16738/OpenImageIO.changes 2026-08-04 21:33:22.189953899 +0200 @@ -1,0 +2,123 @@ +Sat Aug 1 20:30:35 UTC 2026 - Marcus Rueckert <[email protected]> + +- Skip openexr-partialtile imagebufalgo-opencv: it seems they + expect the OIIO files already installed into the real + destination. + + https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/5358 + +------------------------------------------------------------------- +Sat Aug 1 12:13:57 UTC 2026 - Marcus Rueckert <[email protected]> + +- Update to 3.1.16.0 + - oiiotool: Add thumbnail get/set commands and fix TGA thumbnail + I/O. #5236 (by @jinhgkim / Jinnie Kim) + - api: Add "limits:resolution" global attribute to cap + per-dimension image size, used for guarding against + decompression-bomb attacks. #5297 (by @lgritz / Larry Gritz) + - testing: Add libFuzzer-based fuzzing infrastructure for format + readers. #5314 + - texture: Experimental GPU texture system prototype, implemented + as a standalone testsuite executable (does not modify the core + library). #5228 (by @aconty / Alejandro Conty) + - bmp: Validate scanline file position before reading, guarding + against corrupt files. #5274 + - cineon: Validate bit depth against libcineon's supported set, + fixing a heap out-of-bounds write on invalid bit depths. #5283 + (CVE-2026-63638) + - dds: Reject corrupt bytes-per-pixel before it forces a huge + allocation, and clamp pixel memcpy to sizeof(uint32_t) to + prevent stack overflow. #5286 #5287 + - dpx: Detect corrupt userbuf size with an overflow guard, and + fix a heap overflow in 1-channel 10-bit filled scanline swap. + #5271 #5298 + - exif: Beef up Exif error detection for corrupt or malformed + blocks (affects all formats that embed Exif). #5322 + - exr: Use rectangle row stride for partial edge tile reads, + fixing a heap out-of-bounds write. #5295 (CVE-2026-63422) + - exr: Add check_open() guard to the exrinput_c C API. #5280 + - ffmpeg: Align swscale output buffers. #5301 (by @br0nzu / + Dongju Lee) + - filesystem: Overflow-safe bounds check in IOMemReader::pread. + #5262 + - gif: Handle empty error from gif_lib, and address corrupt files + with bad resolutions and int overflow. #5269 #5257 + - gif, targa: Avoid int32 overflow in palette-split pixel-count + math and reject implausible image dimensions before allocating, + fixing a signed overflow that could crash TGA-to-GIF + conversion. #5292 #5293 (CVE-2026-65969) + - gif: Guard canvas index overflow. #5299 (by @br0nzu / Dongju + Lee) + - hdr: Validate resolution to detect corrupted files, and resolve + a format-detection conflict between the HDR and RAW readers for + .hdr files. #5256 #5339 + - ico: Better error checking for PNG-in-ICO files, and avoid + leaking an error string across a png_chunk_error longjmp. #5264 + #5289 + - iff: Detect corrupt chunk sizes, flags, and channel configs, + fixing a tile read that could write past the caller's buffer. + #5268 (CVE-2026-63419) + - iff: Add resolution validity checking, and reject implausible + image dimensions before allocating the tile buffer. #5285 #5284 + - imagebuf: Fix a data race that could corrupt multithreaded + reads. #5325 + - imageio: Ignore invalid RowsPerStrip chunking. #5300 (by + @br0nzu / Dongju Lee) + - jpeg2000: Reject corrupt component geometry and subsampling, + and guard against oversized and decompression-bomb headers + before decode. #5270 #5327 + - jxl: Guard corrupt basic-info dimensions early. #5305 + - ptex: More comprehensive valid_file and header validation. + #5265 + - psd: Validate color_mode before the RawColor early return, + fixing an out-of-bounds read and allocation DoS. #5282 + (CVE-2026-63635) + - psd: Detect implausibly large ICC, Exif, and XMP blocks before + allocating, and identify corruption of layer resolutions and + EOF in strings. #5288 #5259 + - psd: Guard row interleave bounds on corrupt data, fixing an + out-of-bounds read in interleave_row. #5307 (CVE-2026-63420) + - psd: Avoid signed overflow computing layer/mask extents. #5306 + - raw: Apply LibRaw memory cap before unpack to prevent OOM, and + reject decompression-bomb / corrupt headers before unpack. + #5275 #5312 + - raw: Pass the bad-pixels parameter through to LibRaw. #5323 (by + @antond-weta / Anton Dukhovnikov) + - rla: Better detection of corrupted RLE encoding. #5337 #5258 + - sgi: Size RLE offset tables by spec dimensions to prevent OOB + on corrupt headers, prevent an oversized-allocation crash from + a bogus RLE length/offset table, and handle corrupt 16-bit RLE + runs with odd byte counts. #5279 #5303 #5321 + - softimage: Support channel packets with differing bit depths. + #5309 + - tiff: Avoid use-after-scope in multithreaded scanline reads. + #5294 (CVE-2026-65970) + - tiff: Fix heap overflow unpacking sub-8-bit contiguous CMYK + samples. #5296 (CVE-2026-67549) + - tiff: Fix additional int32 overflows, and guard against + decompression bombs. #5319 + - webp: Improve valid_file to check the header for magic words. + #5266 + - int: Consolidate the decompression-bomb guard used across + format readers into a shared helper. #5328 + - build: Fix EMBEDPLUGINS=0, and make many build options + environment-overridable. #5272 + - build: Support building to WebAssembly (wasm). #5304 (by + @nickdademo / Nick D'Ademo) + - build: Support OpenCV 5, and add a standalone header smoke + test. #5326 + - build: Recommend libtiff >= 4.5 for security fixes. #5277 + - build: Fix clang warnings about giflib headers on some + platforms/versions. #5263 + - ci: Add vfx2027 container tests; test against and document the + latest dependency versions. #5302 #5330 + - docs: Fix typos. #5349 (by @jinhgkim / Jinnie Kim) + - docs: Update ImageCache docs, clean up outdated docs, and fix + typos. #5352 (by @luna-y-kim / Luna Kim) + - docs: Fix vcpkg install command syntax in INSTALL.md. #5332 (by + @BrianHanke / Brian R Hanke) + - admin: SECURITY.md updates; very minor fixes to README & + SECURITY; update SECURITY with new CVE assignments; document + more security CVE number assignments. #5311 #5320 #5329 + +------------------------------------------------------------------- Old: ---- OpenImageIO-3.1.15.0.tar.gz New: ---- OpenImageIO-3.1.16.0.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ OpenImageIO.spec ++++++ --- /var/tmp/diff_new_pack.JQ4Itb/_old 2026-08-04 21:33:24.242025640 +0200 +++ /var/tmp/diff_new_pack.JQ4Itb/_new 2026-08-04 21:33:24.246025780 +0200 @@ -51,8 +51,7 @@ %global major_minor_ver 3.1 Name: OpenImageIO -# Next version will have the jxl checks fixed - please correct disabled_tests below: remove jxl -Version: 3.1.15.0 +Version: 3.1.16.0 Release: 0 Summary: Library for Reading and Writing Images License: Apache-2.0 @@ -285,7 +284,12 @@ # jpeg-ultrahdr -> fileformat which we do not support # cmake-consumer docs-examples-cpp -> currently failing tests as they assume normal cmake search paths will work to find the OIIO devel files in the final location # docs-examples-python -> fails if docs-examples-cpp was not attempted -export disabled_tests="heif|ptex|jxl|jpeg-ultrahdr|cmake-consumer|docs-examples-cpp|docs-examples-python" +# +# https://github.com/AcademySoftwareFoundation/OpenImageIO/issues/5358 +# +# openexr-partialtile imagebufalgo-opencv -> currently failing tests as they assume normal cmake search paths will work to find the OIIO devel files in the final location +# +export disabled_tests="heif|ptex|jpeg-ultrahdr|cmake-consumer|docs-examples-cpp|docs-examples-python|imagebufalgo-opencv|openexr-partialtile" %ifarch x86_64 %ctest '-E' ${disabled_tests} %else ++++++ OpenImageIO-3.1.15.0.tar.gz -> OpenImageIO-3.1.16.0.tar.gz ++++++ /work/SRC/openSUSE:Factory/OpenImageIO/OpenImageIO-3.1.15.0.tar.gz /work/SRC/openSUSE:Factory/.OpenImageIO.new.16738/OpenImageIO-3.1.16.0.tar.gz differ: char 13, line 1
