Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package jxrlib for openSUSE:Factory checked in at 2026-10-12 22:07:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/jxrlib (Old) and /work/SRC/openSUSE:Factory/.jxrlib.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "jxrlib" Mon Oct 12 22:07:21 2026 rev:8 rq:1384177 version:1.4.4 Changes: -------- --- /work/SRC/openSUSE:Factory/jxrlib/jxrlib.changes 2026-10-08 12:00:42.237264429 +0200 +++ /work/SRC/openSUSE:Factory/.jxrlib.new.3698736/jxrlib.changes 2026-10-12 22:07:26.215852982 +0200 @@ -1,0 +2,8 @@ +Sun Oct 11 11:42:49 UTC 2026 - Андрей Алыпов <[email protected]> + +- Update to 1.4.4: + * Fix potential size_t overflow in the memory allocation limit check of + calloc_lim + * Added new file jxrgluelib/JXRVersion.h + +------------------------------------------------------------------- Old: ---- jxrlib-1.4.3.tar.gz New: ---- jxrlib-1.4.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ jxrlib.spec ++++++ --- /var/tmp/diff_new_pack.numm1J/_old 2026-10-12 22:07:27.265896326 +0200 +++ /var/tmp/diff_new_pack.numm1J/_new 2026-10-12 22:07:27.267896409 +0200 @@ -1,6 +1,7 @@ # # spec file for package jxrlib # +# Copyright (c) 2026 SUSE LLC # Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties @@ -18,7 +19,7 @@ %define sover 0 Name: jxrlib -Version: 1.4.3 +Version: 1.4.4 Release: 0 Summary: Open source implementation of jpegxr # See JPEGXR_DPK_Spec_1.0.doc. Upstream request for plain text license file at ++++++ CMakeLists.txt ++++++ --- /var/tmp/diff_new_pack.numm1J/_old 2026-10-12 22:07:27.300897771 +0200 +++ /var/tmp/diff_new_pack.numm1J/_new 2026-10-12 22:07:27.303897895 +0200 @@ -60,7 +60,7 @@ install(TARGETS JxrDecApp RUNTIME DESTINATION bin) # Headers -install(FILES jxrgluelib/JXRGlue.h jxrgluelib/JXRMeta.h jxrtestlib/JXRTest.h image/sys/windowsmediaphoto.h +install(FILES jxrgluelib/JXRGlue.h jxrgluelib/JXRMeta.h jxrtestlib/JXRTest.h jxrgluelib/JXRVersion.h image/sys/windowsmediaphoto.h DESTINATION include/jxrlib ) install(DIRECTORY common/include/ DESTINATION include/jxrlib ++++++ jxrlib-1.4.3.tar.gz -> jxrlib-1.4.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jxrlib-1.4.3/README.md new/jxrlib-1.4.4/README.md --- old/jxrlib-1.4.3/README.md 2026-09-02 12:04:37.000000000 +0200 +++ new/jxrlib-1.4.4/README.md 2026-10-09 08:28:10.000000000 +0200 @@ -15,6 +15,8 @@ all the most common formats. ### Changelog +- V1.4.4; 2026/10/09 + - Fix potential `size_t` overflow in the memory allocation limit check of `calloc_lim` - V1.4.3; 2026/09/02 - `tmpnam` security mitigations: - Use a local buffer instead of its internal one diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jxrlib-1.4.3/image/sys/memory_lim.c new/jxrlib-1.4.4/image/sys/memory_lim.c --- old/jxrlib-1.4.3/image/sys/memory_lim.c 2026-09-02 12:04:37.000000000 +0200 +++ new/jxrlib-1.4.4/image/sys/memory_lim.c 2026-10-09 08:28:10.000000000 +0200 @@ -36,7 +36,8 @@ void *calloc_lim(size_t count, size_t size) { size_t cbMax = alloc_get_lim(); - if(cbMax && (count * size) > cbMax) { + // Use division instead of multiplication to avoid a size_t overflow in the limit check. + if(cbMax && count > 0 && size > cbMax / count) { return NULL; } return calloc(count, size); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/jxrlib-1.4.3/jxrgluelib/JXRVersion.h new/jxrlib-1.4.4/jxrgluelib/JXRVersion.h --- old/jxrlib-1.4.3/jxrgluelib/JXRVersion.h 2026-09-02 12:04:37.000000000 +0200 +++ new/jxrlib-1.4.4/jxrgluelib/JXRVersion.h 2026-10-09 08:28:10.000000000 +0200 @@ -8,7 +8,7 @@ #define JXR_VERSION_MAJOR 1 #define JXR_VERSION_MINOR 4 -#define JXR_VERSION_PATCH 3 +#define JXR_VERSION_PATCH 4 #define JXR_MAKEVERSION(major, minor, patch) (((major) << 16) | ((minor) << 8) | (patch))
