Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-hiredis for openSUSE:Factory checked in at 2026-08-22 21:34:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-hiredis (Old) and /work/SRC/openSUSE:Factory/.python-hiredis.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-hiredis" Sat Aug 22 21:34:52 2026 rev:17 rq:1372923 version:3.4.1 Changes: -------- --- /work/SRC/openSUSE:Factory/python-hiredis/python-hiredis.changes 2026-06-15 19:46:05.882087690 +0200 +++ /work/SRC/openSUSE:Factory/.python-hiredis.new.1258/python-hiredis.changes 2026-08-22 21:36:55.868898962 +0200 @@ -1,0 +2,9 @@ +Fri Aug 21 19:48:50 UTC 2026 - Dirk Müller <[email protected]> + +- update to 3.4.1 (bsc#1276205): + * Updates the bundled hiredis C library to v1.4.1, which fixes: + * Prevent arbitrarily nested replies from causing a stack + overflow (redis/hiredis#1340) + * Protect against overflow of map elements (redis/hiredis#1341) + +------------------------------------------------------------------- Old: ---- hiredis-3.4.0.tar.gz New: ---- hiredis-3.4.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-hiredis.spec ++++++ --- /var/tmp/diff_new_pack.qgGVvG/_old 2026-08-22 21:36:56.525923292 +0200 +++ /var/tmp/diff_new_pack.qgGVvG/_new 2026-08-22 21:36:56.526923329 +0200 @@ -18,7 +18,7 @@ %{?sle15_python_module_pythons} Name: python-hiredis -Version: 3.4.0 +Version: 3.4.1 Release: 0 Summary: Python wrapper for hiredis License: BSD-3-Clause ++++++ hiredis-3.4.0.tar.gz -> hiredis-3.4.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hiredis-3.4.0/PKG-INFO new/hiredis-3.4.1/PKG-INFO --- old/hiredis-3.4.0/PKG-INFO 2026-06-03 16:46:41.431964200 +0200 +++ new/hiredis-3.4.1/PKG-INFO 2026-08-07 10:46:41.959965000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: hiredis -Version: 3.4.0 +Version: 3.4.1 Summary: Python wrapper for hiredis Home-page: https://github.com/redis/hiredis-py Author: Jan-Erik Rediger, Pieter Noordhuis diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hiredis-3.4.0/hiredis/version.py new/hiredis-3.4.1/hiredis/version.py --- old/hiredis-3.4.0/hiredis/version.py 2026-06-03 16:46:37.000000000 +0200 +++ new/hiredis-3.4.1/hiredis/version.py 2026-08-07 10:46:37.000000000 +0200 @@ -1 +1 @@ -__version__ = "3.4.0" +__version__ = "3.4.1" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hiredis-3.4.0/hiredis.egg-info/PKG-INFO new/hiredis-3.4.1/hiredis.egg-info/PKG-INFO --- old/hiredis-3.4.0/hiredis.egg-info/PKG-INFO 2026-06-03 16:46:41.000000000 +0200 +++ new/hiredis-3.4.1/hiredis.egg-info/PKG-INFO 2026-08-07 10:46:41.000000000 +0200 @@ -1,6 +1,6 @@ Metadata-Version: 2.4 Name: hiredis -Version: 3.4.0 +Version: 3.4.1 Summary: Python wrapper for hiredis Home-page: https://github.com/redis/hiredis-py Author: Jan-Erik Rediger, Pieter Noordhuis diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hiredis-3.4.0/vendor/hiredis/read.c new/hiredis-3.4.1/vendor/hiredis/read.c --- old/hiredis-3.4.0/vendor/hiredis/read.c 2026-06-03 16:46:39.000000000 +0200 +++ new/hiredis-3.4.1/vendor/hiredis/read.c 2026-08-07 10:46:40.000000000 +0200 @@ -71,6 +71,9 @@ /* Initial size of our nested reply stack and how much we grow it when needd */ #define REDIS_READER_STACK_SIZE 9 +/* Maximum depth of nested aggregate replies. */ +#define REDIS_READER_MAX_REPLY_DEPTH 1024 + static void __redisReaderSetError(redisReader *r, int type, const char *str) { size_t len; @@ -557,6 +560,12 @@ long long elements; int root = 0, len; + if (r->ridx >= REDIS_READER_MAX_REPLY_DEPTH) { + __redisReaderSetError(r,REDIS_ERR_PROTOCOL, + "Max nesting depth exceeded"); + return REDIS_ERR; + } + if (r->ridx == r->tasks - 1) { if (redisReaderGrow(r) == REDIS_ERR) return REDIS_ERR; @@ -592,7 +601,21 @@ moveToNextTask(r); } else { - if (cur->type == REDIS_REPLY_MAP || cur->type == REDIS_REPLY_ATTR) elements *= 2; + if (cur->type == REDIS_REPLY_MAP || cur->type == REDIS_REPLY_ATTR) { + long long maxelements = LLONG_MAX / 2; + if (LLONG_MAX > SIZE_MAX && + maxelements > (long long)(SIZE_MAX / 2)) { + maxelements = (long long)(SIZE_MAX / 2); + } + + if (elements > maxelements) { + __redisReaderSetError(r,REDIS_ERR_PROTOCOL, + "Multi-bulk length out of range"); + return REDIS_ERR; + } + + elements *= 2; + } if (r->fn && r->fn->createArray) obj = r->fn->createArray(cur,elements); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/hiredis-3.4.0/vendor/hiredis/test.c new/hiredis-3.4.1/vendor/hiredis/test.c --- old/hiredis-3.4.0/vendor/hiredis/test.c 2026-06-03 16:46:39.000000000 +0200 +++ new/hiredis-3.4.1/vendor/hiredis/test.c 2026-08-07 10:46:40.000000000 +0200 @@ -476,7 +476,7 @@ redisReaderFree(reader); reader = redisReaderCreate(); - test("Can handle arbitrarily nested multi-bulks: "); + test("Can handle deeply nested multi-bulks: "); for (i = 0; i < 128; i++) { redisReaderFeed(reader,(char*)"*1\r\n", 4); } @@ -487,7 +487,7 @@ ((redisReply*)reply)->type == REDIS_REPLY_ARRAY && ((redisReply*)reply)->elements == 1); - test("Can parse arbitrarily nested multi-bulks correctly: "); + test("Can parse deeply nested multi-bulks correctly: "); while(i--) { assert(reply != NULL && ((redisReply*)reply)->type == REDIS_REPLY_ARRAY); reply = ((redisReply*)reply)->element[0]; @@ -497,6 +497,29 @@ freeReplyObject(root); redisReaderFree(reader); + test("Can parse a reply at the maximum nesting depth: "); + reader = redisReaderCreate(); + reader->fn = NULL; + for (i = 0; i < 1024; i++) { + redisReaderFeed(reader,(char*)"*1\r\n",4); + } + redisReaderFeed(reader,(char*)"+OK\r\n",5); + ret = redisReaderGetReply(reader,&reply); + test_cond(ret == REDIS_OK && reply == (void*)REDIS_REPLY_ARRAY); + redisReaderFree(reader); + + test("Set error when nesting depth exceeds the maximum: "); + reader = redisReaderCreate(); + for (i = 0; i <= 1024; i++) { + redisReaderFeed(reader,(char*)"*1\r\n",4); + } + redisReaderFeed(reader,(char*)"+OK\r\n",5); + ret = redisReaderGetReply(reader,&reply); + test_cond(ret == REDIS_ERR && + strcasecmp(reader->errstr,"Max nesting depth exceeded") == 0); + freeReplyObject(reply); + redisReaderFree(reader); + test("Correctly parses LLONG_MAX: "); reader = redisReaderCreate(); redisReaderFeed(reader, ":9223372036854775807\r\n",22); @@ -836,6 +859,15 @@ freeReplyObject(reply); redisReaderFree(reader); + test("A RESP3 MAP/ATTR can't overflow: "); + reader = redisReaderCreate(); + reader->maxelements = 0; /* Don't rely on default limit */ + redisReaderFeed(reader, "%4611686018427387904\r\n", 22); + ret = redisReaderGetReply(reader, &reply); + test_cond(ret == REDIS_ERR && + strcasecmp(reader->errstr, "Multi-bulk length out of range") == 0); + redisReaderFree(reader); + test("Can parse RESP3 attribute: "); reader = redisReaderCreate(); redisReaderFeed(reader, "|2\r\n+foo\r\n:123\r\n+bar\r\n#t\r\n",26);
