Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package alsa for openSUSE:Factory checked in at 2026-09-15 12:47:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/alsa (Old) and /work/SRC/openSUSE:Factory/.alsa.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "alsa" Tue Sep 15 12:47:57 2026 rev:238 rq:1377914 version:1.2.16.1 Changes: -------- --- /work/SRC/openSUSE:Factory/alsa/alsa.changes 2026-06-16 13:47:28.922343799 +0200 +++ /work/SRC/openSUSE:Factory/.alsa.new.383539/alsa.changes 2026-09-15 12:48:01.168930474 +0200 @@ -1,0 +2,8 @@ +Mon Sep 14 13:47:48 UTC 2026 - Takashi Iwai <[email protected]> + +- Fix Denial of Service via off-by-one stack buffer overflow + (CVE-2026-90781, bsc#1280204): + 0001-Fix-theoretical-one-byte-buffer-overrun.patch + 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch + +------------------------------------------------------------------- New: ---- 0001-Fix-theoretical-one-byte-buffer-overrun.patch 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch ----------(New B)---------- New: (CVE-2026-90781, bsc#1280204): 0001-Fix-theoretical-one-byte-buffer-overrun.patch 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch New: 0001-Fix-theoretical-one-byte-buffer-overrun.patch 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ alsa.spec ++++++ --- /var/tmp/diff_new_pack.bz6MpE/_old 2026-09-15 12:48:02.625991166 +0200 +++ /var/tmp/diff_new_pack.bz6MpE/_new 2026-09-15 12:48:02.630991374 +0200 @@ -63,6 +63,8 @@ # from https://www.alsa-project.org/files/pub/gpg-release-key-v1.txt Source35: alsa.keyring # upstream fixes +Patch1: 0001-Fix-theoretical-one-byte-buffer-overrun.patch +Patch2: 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch # rest suse fixes Patch101: alsa-lib-ignore-non-accessible-ALSA_CONFIG_PATH.patch BuildRequires: doxygen ++++++ 0001-Fix-theoretical-one-byte-buffer-overrun.patch ++++++ >From 1e27d63ef6d1dcf7d1f1a1e1eca3ea779e7de377 Mon Sep 17 00:00:00 2001 From: Dirk Müller <[email protected]> Date: Tue, 2 Jun 2026 11:17:31 +0200 Subject: [PATCH] Fix theoretical one-byte buffer overrun MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If 64 (sizeof(buf))= or more characters were provided in the input string, this unconditionally writes a null byte to `buf[64]`, which is one byte past the end of the array. Closes: https://github.com/alsa-project/alsa-lib/pull/509 Signed-off-by: Dirk Müller <[email protected]> Signed-off-by: Jaroslav Kysela <[email protected]> --- src/control/ctlparse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/control/ctlparse.c b/src/control/ctlparse.c index 3bd86435d0e3..c40de2bd28e5 100644 --- a/src/control/ctlparse.c +++ b/src/control/ctlparse.c @@ -173,7 +173,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str, ptr = buf; size = 0; while (*str && *str != ',') { - if (size < (int)sizeof(buf)) { + if (size < (int)sizeof(buf) - 1) { *ptr++ = *str; size++; } -- 2.55.0 ++++++ 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch ++++++ >From f84cd4ced7b36fddb8e4ee24404cf7c091d27020 Mon Sep 17 00:00:00 2001 From: Jaroslav Kysela <[email protected]> Date: Sun, 30 Aug 2026 20:20:30 +0200 Subject: [PATCH] control: ctlparse - another fix for one-byte overrrun in __snd_ctl_ascii_elem_id_parse Follows 1e27d63ef6d1dcf7d1f1a1e1eca3ea779e7de377 . Link: https://lore.kernel.org/alsa-devel/CACBQ=p2fho3m6dkv3cwukb6qhs92ouv+fj3sjz_pvbssdjw...@mail.gmail.com/ Reported-by: Harsh Raj Singhania <[email protected]> Signed-off-by: Jaroslav Kysela <[email protected]> --- src/control/ctlparse.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/control/ctlparse.c b/src/control/ctlparse.c index c40de2bd28e5..7132210e255f 100644 --- a/src/control/ctlparse.c +++ b/src/control/ctlparse.c @@ -219,7 +219,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str, if (*str == '\'' || *str == '\"') { c = *str++; while (*str && *str != c) { - if (size < (int)sizeof(buf)) { + if (size < (int)sizeof(buf) - 1) { *ptr++ = *str; size++; } @@ -229,7 +229,7 @@ int __snd_ctl_ascii_elem_id_parse(snd_ctl_elem_id_t *dst, const char *str, str++; } else { while (*str && *str != ',') { - if (size < (int)sizeof(buf)) { + if (size < (int)sizeof(buf) - 1) { *ptr++ = *str; size++; } -- 2.55.0
