Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package gcc15 for openSUSE:Factory checked in at 2026-10-08 11:55:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/gcc15 (Old) and /work/SRC/openSUSE:Factory/.gcc15.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "gcc15" Thu Oct 8 11:55:06 2026 rev:24 rq:1382728 version:15.3.0+git11272 Changes: -------- --- /work/SRC/openSUSE:Factory/gcc15/gcc15.changes 2026-06-13 18:44:50.103191152 +0200 +++ /work/SRC/openSUSE:Factory/.gcc15.new.3698736/gcc15.changes 2026-10-08 11:55:31.298271878 +0200 @@ -1,0 +2,16 @@ +Tue Oct 6 08:06:04 UTC 2026 - Richard Biener <[email protected]> + +- Add gcc15-pr127656.patch to fix use-after-free in + __gnu_pbds::priority_queue. [bsc#1283123] (CVE-2026-102010) + +------------------------------------------------------------------- +Tue Jun 30 10:44:21 UTC 2026 - Richard Biener <[email protected]> + +- Update gcc15-Wtime_t-conversion.patch + +------------------------------------------------------------------- +Sat Jun 20 15:11:37 UTC 2026 - Jan Engelhardt <[email protected]> + +- Make build recipe compatible with POSIX sh + +------------------------------------------------------------------- New: ---- gcc15-pr127656.patch ----------(New B)---------- New: - Add gcc15-pr127656.patch to fix use-after-free in __gnu_pbds::priority_queue. [bsc#1283123] (CVE-2026-102010) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ cross-aarch64-gcc15-bootstrap.spec ++++++ --- /var/tmp/diff_new_pack.nZwh3t/_old 2026-10-08 11:55:33.090346918 +0200 +++ /var/tmp/diff_new_pack.nZwh3t/_new 2026-10-08 11:55:33.092347002 +0200 @@ -127,6 +127,7 @@ Patch20: gcc15-bsc1253043.patch Patch21: gcc15-pr120424.patch Patch22: gcc15-Wtime_t-conversion.patch +Patch23: gcc15-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -340,7 +341,7 @@ %patch -p1 -P 19 %patch -p1 -P 20 %endif -%patch -p1 -P 21 -P 22 +%patch -p1 -P 21 -P 22 -P 23 %patch -P 51 %patch -p1 -P 60 -P 61 @@ -385,13 +386,13 @@ *) add_flag=$flag ;; esac if test -n "$add_flag"; then - optflags+=" $add_flag" + optflags="$optflags $add_flag" case $add_flag in # Filter out -Werror=return-type for D (only valid for C and C++) -Werror=return-type) ;; # Likewise -Wtime_t-conversion -Wtime_t-conversion) ;; - *) optflags_d+=" $add_flag" ;; + *) optflags_d="$optflags_d $add_flag" ;; esac fi done cross-aarch64-gcc15.spec: same change cross-amdgcn-gcc15.spec: same change cross-arm-gcc15.spec: same change cross-arm-none-gcc15-bootstrap.spec: same change cross-arm-none-gcc15.spec: same change cross-avr-gcc15-bootstrap.spec: same change cross-avr-gcc15.spec: same change cross-bpf-gcc15.spec: same change cross-hppa-gcc15-bootstrap.spec: same change cross-hppa-gcc15.spec: same change cross-loongarch64-gcc15-bootstrap.spec: same change cross-loongarch64-gcc15.spec: same change cross-nvptx-gcc15.spec: same change cross-ppc64-gcc15.spec: same change cross-ppc64le-gcc15-bootstrap.spec: same change cross-ppc64le-gcc15.spec: same change cross-pru-gcc15-bootstrap.spec: same change cross-pru-gcc15.spec: same change cross-riscv64-elf-gcc15-bootstrap.spec: same change cross-riscv64-elf-gcc15.spec: same change cross-riscv64-gcc15-bootstrap.spec: same change cross-riscv64-gcc15.spec: same change cross-rx-gcc15-bootstrap.spec: same change cross-rx-gcc15.spec: same change cross-s390x-gcc15-bootstrap.spec: same change cross-s390x-gcc15.spec: same change cross-x86_64-gcc15.spec: same change gcc15-testresults.spec: same change ++++++ gcc15.spec ++++++ --- /var/tmp/diff_new_pack.nZwh3t/_old 2026-10-08 11:55:34.080388374 +0200 +++ /var/tmp/diff_new_pack.nZwh3t/_new 2026-10-08 11:55:34.083388500 +0200 @@ -388,6 +388,7 @@ Patch20: gcc15-bsc1253043.patch Patch21: gcc15-pr120424.patch Patch22: gcc15-Wtime_t-conversion.patch +Patch23: gcc15-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -2481,7 +2482,7 @@ %patch -p1 -P 19 %patch -p1 -P 20 %endif -%patch -p1 -P 21 -P 22 +%patch -p1 -P 21 -P 22 -P 23 %patch -P 51 %patch -p1 -P 60 -P 61 @@ -2526,13 +2527,13 @@ *) add_flag=$flag ;; esac if test -n "$add_flag"; then - optflags+=" $add_flag" + optflags="$optflags $add_flag" case $add_flag in # Filter out -Werror=return-type for D (only valid for C and C++) -Werror=return-type) ;; # Likewise -Wtime_t-conversion -Wtime_t-conversion) ;; - *) optflags_d+=" $add_flag" ;; + *) optflags_d="$optflags_d $add_flag" ;; esac fi done ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.nZwh3t/_old 2026-10-08 11:55:34.221394279 +0200 +++ /var/tmp/diff_new_pack.nZwh3t/_new 2026-10-08 11:55:34.227394530 +0200 @@ -1,5 +1,5 @@ -mtime: 1781244909 -commit: 9c6fed29d08dcef55f8aa0f5e4559e22f15682af5c3646184f8e42c12e5f9c5d +mtime: 1791274201 +commit: 7b0e7d8742662820fe8d77fd3e420b871712075cf2d5d9016b115aeaface33e1 url: https://src.opensuse.org/gcc/gcc15.git revision: main ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-06 10:10:01.000000000 +0200 @@ -0,0 +1 @@ +.osc diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/pre_checkin.sh new/pre_checkin.sh --- old/pre_checkin.sh 1970-01-01 01:00:00.000000000 +0100 +++ new/pre_checkin.sh 2026-10-06 10:10:01.000000000 +0200 @@ -0,0 +1,31 @@ +#!/bin/bash +# This script is called automatically during autobuild checkin. + +case $0 in + \./*) + here=$PWD + ;; + */*) + here=${0%/*} + ;; + *) + here=$PWD + ;; +esac +case ${here##*/} in + gcc*.*) + # Handle maintainance projects with .$REPO suffix + suffix=${here##*/} + suffix=${suffix%%\.*} + set ${suffix#gcc} + ;; + gcc-*) + suffix=${here##*/} + set ${suffix#*-}- + ;; + gcc[0-9]*) + suffix=${here##*/} + set ${suffix#gcc} + ;; +esac +. ${here}/change_spec ++++++ gcc.spec.in ++++++ --- /var/tmp/diff_new_pack.nZwh3t/_old 2026-10-08 11:55:34.620410987 +0200 +++ /var/tmp/diff_new_pack.nZwh3t/_new 2026-10-08 11:55:34.624411154 +0200 @@ -393,6 +393,7 @@ Patch20: gcc15-bsc1253043.patch Patch21: gcc15-pr120424.patch Patch22: gcc15-Wtime_t-conversion.patch +Patch23: gcc15-pr127656.patch # A set of patches from the RH srpm Patch51: gcc41-ppc32-retaddr.patch # Some patches taken from Debian @@ -1400,7 +1401,7 @@ %patch -p1 -P 19 %patch -p1 -P 20 %endif -%patch -p1 -P 21 -P 22 +%patch -p1 -P 21 -P 22 -P 23 %patch -P 51 %patch -p1 -P 60 -P 61 @@ -1445,13 +1446,13 @@ *) add_flag=$flag ;; esac if test -n "$add_flag"; then - optflags+=" $add_flag" + optflags="$optflags $add_flag" case $add_flag in # Filter out -Werror=return-type for D (only valid for C and C++) -Werror=return-type) ;; # Likewise -Wtime_t-conversion -Wtime_t-conversion) ;; - *) optflags_d+=" $add_flag" ;; + *) optflags_d="$optflags_d $add_flag" ;; esac fi done ++++++ gcc15-Wtime_t-conversion.patch ++++++ --- /var/tmp/diff_new_pack.nZwh3t/_old 2026-10-08 11:55:34.643411950 +0200 +++ /var/tmp/diff_new_pack.nZwh3t/_new 2026-10-08 11:55:34.646412075 +0200 @@ -1,4 +1,4 @@ -From 35344d5a9209c58b4c28589d0f43b95c6d5f7c0d Mon Sep 17 00:00:00 2001 +From 818aaaee3e8cda0fa751e0e1e8347285151230aa Mon Sep 17 00:00:00 2001 From: Richard Biener <[email protected]> Date: Thu, 26 Jun 2025 10:14:54 +0200 Subject: [PATCH] c/96570 - diagnostics for conversions to/from time_t @@ -39,15 +39,15 @@ * c-c++-common/Wtime_t-1.c: New testcase. --- - gcc/c-family/c-warn.cc | 36 ++++++++++- + gcc/c-family/c-warn.cc | 37 ++++++++++- gcc/c-family/c.opt | 4 ++ gcc/doc/invoke.texi | 6 ++ - gcc/testsuite/c-c++-common/Wtime_t-1.c | 83 ++++++++++++++++++++++++++ - 4 files changed, 128 insertions(+), 1 deletion(-) + gcc/testsuite/c-c++-common/Wtime_t-1.c | 85 ++++++++++++++++++++++++++ + 4 files changed, 131 insertions(+), 1 deletion(-) create mode 100644 gcc/testsuite/c-c++-common/Wtime_t-1.c diff --git a/gcc/c-family/c-warn.cc b/gcc/c-family/c-warn.cc -index d547b08f55d..956807ac707 100644 +index d547b08f55d..a685aaed936 100644 --- a/gcc/c-family/c-warn.cc +++ b/gcc/c-family/c-warn.cc @@ -1394,6 +1394,17 @@ conversion_warning (location_t loc, tree type, tree expr, tree result) @@ -68,7 +68,7 @@ /* Produce warnings after a conversion. RESULT is the result of converting EXPR to TYPE. This is a helper function for convert_and_check and cp_convert_and_check. */ -@@ -1506,7 +1517,30 @@ warnings_for_convert_and_check (location_t loc, tree type, tree expr, +@@ -1506,7 +1517,31 @@ warnings_for_convert_and_check (location_t loc, tree type, tree expr, exprtype, type, expr); } else @@ -80,6 +80,7 @@ + if (TREE_CODE (result) == INTEGER_CST) + ; + else if (is_time_t (TREE_TYPE (expr)) ++ && !COMPARISON_CLASS_P (result) + && INTEGRAL_TYPE_P (type) + && TYPE_PRECISION (type) < TYPE_PRECISION (TREE_TYPE (expr)) + /* A conversion to uint32_t or larger is OK. */ @@ -116,7 +117,7 @@ C ObjC C++ ObjC++ CppReason(CPP_W_WARNING_DIRECTIVE) ; Documented in common.opt diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi -index e7af79e09ae..a40b47c870d 100644 +index b560ed41ca3..f14adecaa76 100644 --- a/gcc/doc/invoke.texi +++ b/gcc/doc/invoke.texi @@ -9725,6 +9725,12 @@ unsigned integers are disabled by default in C++ unless @@ -134,15 +135,15 @@ @item -Wdangling-else diff --git a/gcc/testsuite/c-c++-common/Wtime_t-1.c b/gcc/testsuite/c-c++-common/Wtime_t-1.c new file mode 100644 -index 00000000000..dc9471ae366 +index 00000000000..e2c091f8005 --- /dev/null +++ b/gcc/testsuite/c-c++-common/Wtime_t-1.c -@@ -0,0 +1,83 @@ +@@ -0,0 +1,85 @@ +/* Test for diagnostics for conversions between time_t and integer types + These tests are based on gcc.dg/Wconversion-integer.c */ + +/* { dg-do compile { target ilp32 } } */ -+/* { dg-options "-std=c99 -fsigned-char -Wtime_t-conversion" } */ ++/* { dg-options "-fsigned-char -Wtime_t-conversion" } */ + +#define __USE_TIME_BITS64 +#include <time.h> @@ -220,6 +221,8 @@ + t = (time_t)sl; + t = (time_t)ul; + t = (time_t)ull; ++ if (t) /* { dg-bogus "conversion" } */ ++ fsc (0); +} -- 2.51.0 ++++++ gcc15-pr127656.patch ++++++ >From 29e51a820d76c766ae417fcba912714337b0eb17 Mon Sep 17 00:00:00 2001 From: Richard Biener <[email protected]> Date: Fri, 25 Sep 2026 18:14:34 +0100 Subject: [PATCH] libstdc++: Fix use-after-free in pbds binary heap (CVE-2026-102010) [PR127656] MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit To: [email protected] From: Jonathan Wakely <[email protected]> After reallocating the storage the m_a_entries pointer is left dangling and the new storage is leaked. libstdc++-v3/ChangeLog: PR libstdc++/127656 * include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp (erase_if): Update m_a_entries after reallocation. * testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc: New test. Reviewed-by: Tomasz Kamiński <[email protected]> (cherry picked from commit aaa8351f4d2e636f9680a1f0a8ebc2f0a60611e6) --- .../detail/binary_heap_/erase_fn_imps.hpp | 1 + .../regression/priority_queues_erase_if.cc | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc diff --git a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp index 752688bb8e9..1eec3c9fb33 100644 --- a/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp +++ b/libstdc++-v3/include/ext/pb_ds/detail/binary_heap_/erase_fn_imps.hpp @@ -121,6 +121,7 @@ erase_if(Pred pred) entry_pointer new_entries = s_entry_allocator.allocate(new_size); std::copy(m_a_entries, m_a_entries + left, new_entries); s_entry_allocator.deallocate(m_a_entries, m_actual_size); + m_a_entries = new_entries; m_actual_size = new_size; resize_policy::notify_arbitrary(m_actual_size); } diff --git a/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc new file mode 100644 index 00000000000..30b8452eff9 --- /dev/null +++ b/libstdc++-v3/testsuite/ext/pb_ds/regression/priority_queues_erase_if.cc @@ -0,0 +1,19 @@ +// { dg-do run } + +// CVE-2026-201020 use-after-free in binary heap erase_if + +#include <ext/pb_ds/priority_queue.hpp> + +bool is_odd(int v) { return v & 1; } + +int main() +{ + using __gnu_pbds::priority_queue; + using __gnu_pbds::binary_heap_tag; + priority_queue<int, std::less<int>, binary_heap_tag> q; + q.push(1); + q.push(2); + q.push(3); + q.erase_if(&is_odd); + q.clear(); +} -- 2.51.0
