Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package coreutils for openSUSE:Factory checked in at 2026-09-12 21:15:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/coreutils (Old) and /work/SRC/openSUSE:Factory/.coreutils.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "coreutils" Sat Sep 12 21:15:08 2026 rev:175 rq:1377345 version:9.11 Changes: -------- --- /work/SRC/openSUSE:Factory/coreutils/coreutils.changes 2026-06-25 10:48:01.070293466 +0200 +++ /work/SRC/openSUSE:Factory/.coreutils.new.1265/coreutils.changes 2026-09-12 21:15:09.743005876 +0200 @@ -1,0 +2,19 @@ +Wed Sep 9 13:23:01 UTC 2026 - [email protected] + +- coreutils-uniq-fix-read-overrun-with-w.patch: Add upstream + security fix (CVE-2026-56391, bsc#1272698) + * uniq: '-w' no longer overruns the read buffer in multibyte locales. + [bug introduced in coreutils-9.5] +- coreutils-unexpand-fix-heap-overflow.patch: Add upstream + security fix (CVE-2026-56392, bsc#1272699) + * unexpand: '-t' no longer overflows a heap buffer for tab + values > SIZE_MAX/16. + [bug introduced in coreutils-9.11] + +------------------------------------------------------------------- +Wed Aug 9 12:58:58 UTC 2026 - [email protected] + +- coreutils-tests-df-sync-fix-strace.patch: Add test patch + to let df-sync test succeed on more architecures. + +------------------------------------------------------------------- @@ -16 +34,0 @@ - New: ---- coreutils-tests-df-sync-fix-strace.patch coreutils-unexpand-fix-heap-overflow.patch coreutils-uniq-fix-read-overrun-with-w.patch ----------(New B)---------- New: - coreutils-tests-df-sync-fix-strace.patch: Add test patch to let df-sync test succeed on more architecures. New: [bug introduced in coreutils-9.5] - coreutils-unexpand-fix-heap-overflow.patch: Add upstream security fix (CVE-2026-56392, bsc#1272699) New: - coreutils-uniq-fix-read-overrun-with-w.patch: Add upstream security fix (CVE-2026-56391, bsc#1272698) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ coreutils.spec ++++++ --- /var/tmp/diff_new_pack.Jziq9z/_old 2026-09-12 21:15:10.688045179 +0200 +++ /var/tmp/diff_new_pack.Jziq9z/_new 2026-09-12 21:15:10.690045262 +0200 @@ -64,7 +64,14 @@ Patch810: coreutils-skip-tests-rm-ext3-perf.patch Patch900: coreutils-tests-workaround-make-fdleak.patch Patch901: coreutils-tests-misc-tty-eof-avoid-false-failure.patch -Patch902: coreutils-tee-fix-infloop-on-EAGAIN-and-short-write.patch +Patch902: coreutils-tests-df-sync-fix-strace.patch + +# Upstream fix for bsc#1265378 +Patch920: coreutils-tee-fix-infloop-on-EAGAIN-and-short-write.patch +# Upstream security fix for CVE-2026-56391 / bsc#1272698 +Patch922: coreutils-uniq-fix-read-overrun-with-w.patch +# Upstream security fix for CVE-2026-56392 / bsc#1272699 +Patch923: coreutils-unexpand-fix-heap-overflow.patch BuildRequires: automake BuildRequires: gmp-devel @@ -182,6 +189,9 @@ %patch -P 900 %patch -P 901 -p 1 %patch -P 902 -p 1 +%patch -P 920 -p 1 +%patch -P 922 -p 1 +%patch -P 923 -p 1 # ================================================ %build ++++++ coreutils-tests-df-sync-fix-strace.patch ++++++ --- tests/df/sync.sh | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) --- a/tests/df/sync.sh +++ b/tests/df/sync.sh @@ -22,7 +22,9 @@ print_ver_ df # This test is marked "very expensive" since calling sync() can take a long # time on a busy system. very_expensive_ -require_strace_ 'sync,statfs,fstatfs' + +STRACE="trace=/^(sync|statfs|fstatfs)" +require_strace_ "$STRACE" # Check that sync was called before statfs or statvfs. check_sync () @@ -31,7 +33,9 @@ check_sync () while IFS= read line; do case "$line" in sync\(*) seen_sync=1 ;; - statfs\(*|fstatfs\(*) +# statfs\(*|fstatfs\(*) +# statfs\(*|statfs64\(*|fstatfs\(*) + statfs*|fstatfs*) if test "$seen_sync" -eq 1; then return 0 else @@ -45,11 +49,14 @@ check_sync () } # Make sure that 'df --sync' calls sync() before gathering usage information. -strace -o strace.out -e trace=sync,statfs,fstatfs df --sync || fail=1 +strace -o strace.out -e "$STRACE" df --sync || fail=1 check_sync strace.out || fail=1 +[ "$fail" -ne 1 ] || cat strace.out # Also check it with a file given as the argument. -strace -o strace.out -e trace=sync,statfs,fstatfs df --sync . || fail=1 +strace -o strace.out -e "$STRACE" df --sync . || fail=1 check_sync strace.out || fail=1 +[ "$fail" -ne 1 ] || cat strace.out +cat strace.out >&$stderr_fileno_ Exit $fail ++++++ coreutils-unexpand-fix-heap-overflow.patch ++++++ author Pádraig Brady <[email protected]> 2026-04-28 20:33:10 +0100 committer Pádraig Brady <[email protected]> 2026-04-29 13:16:43 +0100 commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d (patch) tree f7f139bd69bacd6525e190584407d3749897a40c parent 00cd91288cce5e781dbc750e85ef00a74bc49def (diff) unexpand: fix heap overflow * src/unexpand.c (unexpand): Use xinmalloc() to gracefully handle overflow. Also use the runtime locale specific MB_CUR_MAX rather than the worst case MB_LEN_MAX. * tests/unexpand/mb.sh: Add a test case that fails in a default glibc build with either MB_CUR_MAX or MB_LEN_MAX. * NEWS: Mention the bug fix. Reported by Michał Majchrowicz. 3 files changed, 12 insertions, 1 deletions Index: coreutils-9.11/NEWS =================================================================== --- coreutils-9.11.orig/NEWS +++ coreutils-9.11/NEWS @@ -4,6 +4,9 @@ GNU coreutils NEWS ** Bug fixes + 'unexpand -t' no longer overflows a heap buffer, for tab values > SIZE_MAX/16. + [bug introduced in coreutils-9.11] + 'uniq -w' no longer overruns the read buffer in multibyte locales. [bug introduced in coreutils-9.5] Index: coreutils-9.11/src/unexpand.c =================================================================== --- coreutils-9.11.orig/src/unexpand.c +++ coreutils-9.11/src/unexpand.c @@ -131,7 +131,7 @@ unexpand (void) /* The worst case is a non-blank character, then one blank, then a tab stop, then MAX_COLUMN_WIDTH - 1 blanks, then a non-blank; so allocate MAX_COLUMN_WIDTH bytes to store the blanks. */ - pending_blank = ximalloc (max_column_width * sizeof (char) * MB_LEN_MAX); + pending_blank = xinmalloc (max_column_width, MB_CUR_MAX); while (true) { Index: coreutils-9.11/tests/unexpand/mb.sh =================================================================== --- coreutils-9.11.orig/tests/unexpand/mb.sh +++ coreutils-9.11/tests/unexpand/mb.sh @@ -17,6 +17,7 @@ . "${srcdir=.}/tests/init.sh"; path_prepend_ ./src print_ver_ unexpand printf +getlimits_ test "$LOCALE_FR_UTF8" != none || skip_ "French UTF-8 locale not available" export LC_ALL="$LOCALE_FR_UTF8" @@ -161,4 +162,11 @@ EOF unexpand -a ./in ./in > out || fail=1 compare exp out > /dev/null 2>&1 || fail=1 +# Ensure overflow is handed gracefully +# coreutils v9.11 induced a buffer overflow with mb_mul=4 (or 16). +for mb_mul in 4 6; do + printf ' \n' | unexpand -t $(expr $SIZE_MAX / $mb_mul + 1) 2>err; ret=$? + test "$ret" = 1 || test "$ret" = 0 || { cat err; fail=1; } +done + Exit $fail ++++++ coreutils-uniq-fix-read-overrun-with-w.patch ++++++ >From c131653bc516a963e8ff02853f64069ee9b344f7 Mon Sep 17 00:00:00 2001 From: Paul Eggert <[email protected]> Date: Tue, 28 Apr 2026 11:25:00 -0700 Subject: [PATCH] uniq: fix read overrun with -w MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Problem reported by Michał Majchrowicz. * src/uniq.c (find_field): Fix typo. * tests/uniq/uniq.pl (add_z_variants): Test for the bug. --- THANKS.in | 1 + src/uniq.c | 4 ++-- tests/uniq/uniq.pl | 3 +++ 3 files changed, 6 insertions(+), 2 deletions(-) Index: coreutils-9.11/THANKS.in =================================================================== --- coreutils-9.11.orig/THANKS.in +++ coreutils-9.11/THANKS.in @@ -460,6 +460,7 @@ Michail Litvak mci@ Michal Politowski [email protected] Michal Svec [email protected] Michal Trunecka [email protected] +Michał Majchrowicz [email protected] Michel Robitaille [email protected] Michiel Bacchiani [email protected] Mike Castle [email protected] Index: coreutils-9.11/src/uniq.c =================================================================== --- coreutils-9.11.orig/src/uniq.c +++ coreutils-9.11/src/uniq.c @@ -285,8 +285,8 @@ find_field (struct linebuffer const *lin else { char *ep = lp; - for (idx_t i = check_chars; 0 < i && lp < lim; i--) - ep += mcel_scan (lp, lim).len; + for (idx_t i = check_chars; 0 < i && ep < lim; i--) + ep += mcel_scan (ep, lim).len; len = ep - lp; } Index: coreutils-9.11/tests/uniq/uniq.pl =================================================================== --- coreutils-9.11.orig/tests/uniq/uniq.pl +++ coreutils-9.11/tests/uniq/uniq.pl @@ -234,6 +234,9 @@ my @Tests = " - 'separate'\n" . " - 'both'\n" . "Try '$prog --help' for more information.\n"}], + # Test for read buffer overrun. + do { my $longline = "\360\237\230\200" . "A" x 255 . "\n"; + ['146', '-w256', {IN => $longline x 2}, {OUT => $longline}] }, ); # Locale related tests Index: coreutils-9.11/NEWS =================================================================== --- coreutils-9.11.orig/NEWS +++ coreutils-9.11/NEWS @@ -1,5 +1,12 @@ GNU coreutils NEWS -*- outline -*- +* Noteworthy changes in release ?.? (????-??-??) [?] + +** Bug fixes + + 'uniq -w' no longer overruns the read buffer in multibyte locales. + [bug introduced in coreutils-9.5] + * Noteworthy changes in release 9.11 (2026-04-20) [stable] ** Bug fixes
