Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package msgpack-c for openSUSE:Factory checked in at 2026-08-27 18:51:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/msgpack-c (Old) and /work/SRC/openSUSE:Factory/.msgpack-c.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "msgpack-c" Thu Aug 27 18:51:45 2026 rev:8 rq:1373891 version:7.0.2 Changes: -------- --- /work/SRC/openSUSE:Factory/msgpack-c/msgpack-c.changes 2026-06-15 19:45:40.997044825 +0200 +++ /work/SRC/openSUSE:Factory/.msgpack-c.new.1265/msgpack-c.changes 2026-08-27 18:55:13.903656241 +0200 @@ -1,0 +2,6 @@ +Wed Aug 26 19:47:53 UTC 2026 - Jan Engelhardt <[email protected]> + +- Update to release 7.0.2 + * Fix integer overflow on `msgpack_unpacker_expand_buffer` + +------------------------------------------------------------------- Old: ---- msgpack-c-7.0.1.tar.gz New: ---- msgpack-c-7.0.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ msgpack-c.spec ++++++ --- /var/tmp/diff_new_pack.adxhfR/_old 2026-08-27 18:55:14.682683439 +0200 +++ /var/tmp/diff_new_pack.adxhfR/_new 2026-08-27 18:55:14.684683509 +0200 @@ -17,7 +17,7 @@ Name: msgpack-c -Version: 7.0.1 +Version: 7.0.2 Release: 0 Summary: Object serialization library for cross-language communication License: BSL-1.0 @@ -68,8 +68,7 @@ %cmake_install %fdupes %{buildroot}/%{_includedir}/%{name} -%post -n libmsgpack-c2 -p /sbin/ldconfig -%postun -n libmsgpack-c2 -p /sbin/ldconfig +%ldconfig_scriptlets -n libmsgpack-c2 %files -n libmsgpack-c2 %license COPYING ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.adxhfR/_old 2026-08-27 18:55:14.720684766 +0200 +++ /var/tmp/diff_new_pack.adxhfR/_new 2026-08-27 18:55:14.723684870 +0200 @@ -1,5 +1,5 @@ -mtime: 1780994529 -commit: 23a9503fd716ffd306731eb7c9329a6469824924068e5afd088602f87bb5f7e7 +mtime: 1787773733 +commit: 2fb6b913821a67bcc03206c5189c8125ca80c3598efb5513a1aefddc56db4cde url: https://src.opensuse.org/clibs/msgpack-c revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-26 21:48:53.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ msgpack-c-7.0.1.tar.gz -> msgpack-c-7.0.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/msgpack-c-7.0.1/README.md new/msgpack-c-7.0.2/README.md --- old/msgpack-c-7.0.1/README.md 2026-06-09 08:59:33.000000000 +0200 +++ new/msgpack-c-7.0.2/README.md 2026-08-25 05:15:29.000000000 +0200 @@ -1,7 +1,7 @@ `msgpack` for C =================== -Version 7.0.1 [](https://github.com/msgpack/msgpack-c/actions) [](https://ci.appveyor.com/project/redboltz/msgpack-c/branch/c_master) +Version 7.0.2 [](https://github.com/msgpack/msgpack-c/actions) [](https://ci.appveyor.com/project/redboltz/msgpack-c/branch/c_master) [](https://app.codecov.io/gh/msgpack/msgpack-c/tree/c_master) It's like JSON but smaller and faster. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/msgpack-c-7.0.1/include/msgpack/version_master.h new/msgpack-c-7.0.2/include/msgpack/version_master.h --- old/msgpack-c-7.0.1/include/msgpack/version_master.h 2026-06-09 08:59:33.000000000 +0200 +++ new/msgpack-c-7.0.2/include/msgpack/version_master.h 2026-08-25 05:15:29.000000000 +0200 @@ -1,3 +1,3 @@ #define MSGPACK_VERSION_MAJOR 7 #define MSGPACK_VERSION_MINOR 0 -#define MSGPACK_VERSION_REVISION 1 +#define MSGPACK_VERSION_REVISION 2 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/msgpack-c-7.0.1/src/unpack.c new/msgpack-c-7.0.2/src/unpack.c --- old/msgpack-c-7.0.1/src/unpack.c 2023-08-29 16:30:36.000000000 +0200 +++ new/msgpack-c-7.0.2/src/unpack.c 2026-08-25 05:15:29.000000000 +0200 @@ -442,7 +442,11 @@ if(mpac->off == COUNTER_SIZE) { char* tmp; - size_t next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE + size_t next_size; + if(size > SIZE_MAX - mpac->used) { + return false; + } + next_size = (mpac->used + mpac->free) * 2; // include COUNTER_SIZE while(next_size < size + mpac->used) { size_t tmp_next_size = next_size * 2; if (tmp_next_size <= next_size) { @@ -464,6 +468,9 @@ char* tmp; size_t next_size = mpac->initial_buffer_size; // include COUNTER_SIZE size_t not_parsed = mpac->used - mpac->off; + if(size > SIZE_MAX - not_parsed - COUNTER_SIZE) { + return false; + } while(next_size < size + not_parsed + COUNTER_SIZE) { size_t tmp_next_size = next_size * 2; if (tmp_next_size <= next_size) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/msgpack-c-7.0.1/test/streaming_c.cpp new/msgpack-c-7.0.2/test/streaming_c.cpp --- old/msgpack-c-7.0.1/test/streaming_c.cpp 2023-08-29 16:30:36.000000000 +0200 +++ new/msgpack-c-7.0.2/test/streaming_c.cpp 2026-08-25 05:15:29.000000000 +0200 @@ -192,3 +192,54 @@ msgpack_unpacker_free(unp); msgpack_sbuffer_free(buffer); } + +// https://github.com/msgpack/msgpack-c/issues/1181 +TEST(streaming, reserve_buffer_overflow_rewound) +{ + msgpack_unpacker mpac; + ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8)); + + // off == COUNTER_SIZE path: size + used would wrap + size_t request = SIZE_MAX - 2; + EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request)); + + // a sane request still works + EXPECT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, 64)); + EXPECT_GE(msgpack_unpacker_buffer_capacity(&mpac), static_cast<size_t>(64)); + + msgpack_unpacker_destroy(&mpac); +} + +TEST(streaming, reserve_buffer_overflow_not_rewound) +{ + msgpack_unpacker mpac; + ASSERT_TRUE(msgpack_unpacker_init(&mpac, 8)); + + // consume part of the buffer so off != COUNTER_SIZE + msgpack_sbuffer sbuf; + msgpack_sbuffer_init(&sbuf); + msgpack_packer pk; + msgpack_packer_init(&pk, &sbuf, msgpack_sbuffer_write); + msgpack_pack_int(&pk, 1); + msgpack_pack_int(&pk, 2); + + ASSERT_TRUE(msgpack_unpacker_reserve_buffer(&mpac, sbuf.size)); + memcpy(msgpack_unpacker_buffer(&mpac), sbuf.data, sbuf.size); + msgpack_unpacker_buffer_consumed(&mpac, sbuf.size); + + msgpack_unpacked result; + msgpack_unpacked_init(&result); + ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result)); + EXPECT_EQ(1, result.data.via.i64); + + size_t request = SIZE_MAX - 2; + EXPECT_FALSE(msgpack_unpacker_reserve_buffer(&mpac, request)); + + // remaining data must still be parsable + ASSERT_EQ(MSGPACK_UNPACK_SUCCESS, msgpack_unpacker_next(&mpac, &result)); + EXPECT_EQ(2, result.data.via.i64); + + msgpack_unpacked_destroy(&result); + msgpack_sbuffer_destroy(&sbuf); + msgpack_unpacker_destroy(&mpac); +}
