Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package alsa for openSUSE:Factory checked in at 2026-10-16 20:07:00 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/alsa (Old) and /work/SRC/openSUSE:Factory/.alsa.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "alsa" Fri Oct 16 20:07:00 2026 rev:239 rq:1385030 version:1.2.16.1 Changes: -------- --- /work/SRC/openSUSE:Factory/alsa/alsa.changes 2026-09-15 12:48:01.168930474 +0200 +++ /work/SRC/openSUSE:Factory/.alsa.new.3698736/alsa.changes 2026-10-16 20:07:13.609968900 +0200 @@ -1,0 +2,10 @@ +Thu Oct 15 13:56:53 UTC 2026 - Takashi Iwai <[email protected]> + +- Fix integer overflow in topology control code (CVE-2026-96674, + bsc#1282564): + 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch +- Fix binding index validations in multi plugin (CVE-2026-96675, + bsc#1282563): + 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch + +------------------------------------------------------------------- New: ---- 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch ----------(New B)---------- New: bsc#1282564): 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch - Fix binding index validations in multi plugin (CVE-2026-96675, New: bsc#1282563): 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ alsa.spec ++++++ --- /var/tmp/diff_new_pack.4TSKHz/_old 2026-10-16 20:07:15.164033837 +0200 +++ /var/tmp/diff_new_pack.4TSKHz/_new 2026-10-16 20:07:15.169034046 +0200 @@ -65,6 +65,8 @@ # upstream fixes Patch1: 0001-Fix-theoretical-one-byte-buffer-overrun.patch Patch2: 0002-control-ctlparse-another-fix-for-one-byte-overrrun-i.patch +Patch3: 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch +Patch4: 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch # rest suse fixes Patch101: alsa-lib-ignore-non-accessible-ALSA_CONFIG_PATH.patch BuildRequires: doxygen ++++++ 0003-topology-fix-uint32_t-overflow-in-control-decoder-si.patch ++++++ >From f8253a68baf9a5f57cdff1cd178920d13e5beb2b Mon Sep 17 00:00:00 2001 From: Harsh Raj Singhania <[email protected]> Date: Thu, 1 Oct 2026 00:28:15 +0530 Subject: [PATCH] topology: fix uint32_t overflow in control decoder size checks size2 = x->size + x->priv.size was computed in 32-bit arithmetic and could wrap on a 64-bit host, bypassing the subsequent bounds check. Pre-check for overflow then cast to size_t. Affects tplg_decode_control_mixer, tplg_decode_control_enum, and tplg_decode_control_bytes. Closes: https://github.com/alsa-project/alsa-lib/pull/527 Signed-off-by: Harsh Raj Singhania <[email protected]> Signed-off-by: Takashi Iwai <[email protected]> --- src/topology/ctl.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/src/topology/ctl.c b/src/topology/ctl.c index 322c461cef50..93a09f1ef04d 100644 --- a/src/topology/ctl.c +++ b/src/topology/ctl.c @@ -1315,7 +1315,12 @@ next: } INIT_LIST_HEAD(&heap); mc = bin; - size2 = mc->size + mc->priv.size; + if (mc->priv.size > size || mc->size > size - mc->priv.size) { + snd_error(TOPOLOGY, "mixer: element sizes overflow (%d, priv %d)", + mc->size, mc->priv.size); + return -EINVAL; + } + size2 = (size_t)mc->size + (size_t)mc->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "mixer: wrong element size (%d, priv %d)", mc->size, mc->priv.size); @@ -1419,7 +1424,12 @@ next: } INIT_LIST_HEAD(&heap); ec = bin; - size2 = ec->size + ec->priv.size; + if (ec->priv.size > size || ec->size > size - ec->priv.size) { + snd_error(TOPOLOGY, "enum: element sizes overflow (%d, priv %d)", + ec->size, ec->priv.size); + return -EINVAL; + } + size2 = (size_t)ec->size + (size_t)ec->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "enum: wrong element size (%d, priv %d)", ec->size, ec->priv.size); @@ -1510,7 +1520,12 @@ next: return -EINVAL; } bc = bin; - size2 = bc->size + bc->priv.size; + if (bc->priv.size > size || bc->size > size - bc->priv.size) { + snd_error(TOPOLOGY, "bytes: element sizes overflow (%d, priv %d)", + bc->size, bc->priv.size); + return -EINVAL; + } + size2 = (size_t)bc->size + (size_t)bc->priv.size; if (size2 > size) { snd_error(TOPOLOGY, "bytes: wrong element size (%d, priv %d)", bc->size, bc->priv.size); -- 2.55.0 ++++++ 0004-pcm-replace-multi-plugin-binding-asserts-with-EINVAL.patch ++++++ >From 81c4a89eb445f8e991ca80ab55b5649530c0aacd Mon Sep 17 00:00:00 2001 From: Harsh Raj Singhania <[email protected]> Date: Thu, 1 Oct 2026 00:28:53 +0530 Subject: [PATCH] pcm: replace multi plugin binding asserts with -EINVAL checks Sparse binding maps leave sidxs[i] == -1 for gap indices. The previous assert() calls caused SIGABRT in debug builds and OOB reads under NDEBUG. Return -EINVAL with explicit bounds and sign checks instead. [ fixed coding style -- tiwai ] Closes: https://github.com/alsa-project/alsa-lib/pull/527 Signed-off-by: Harsh Raj Singhania <[email protected]> Signed-off-by: Takashi Iwai <[email protected]> --- src/pcm/pcm_multi.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/pcm/pcm_multi.c b/src/pcm/pcm_multi.c index 121c4c2070a3..c7c67e734946 100644 --- a/src/pcm/pcm_multi.c +++ b/src/pcm/pcm_multi.c @@ -1121,8 +1121,16 @@ int snd_pcm_multi_open(snd_pcm_t **pcmp, const char *name, } for (i = 0; i < channels_count; ++i) { snd_pcm_multi_channel_t *bind = &multi->channels[i]; - assert(sidxs[i] < (int)slaves_count); - assert(schannels[i] < schannels_count[sidxs[i]]); + if (sidxs[i] < 0 || sidxs[i] >= (int)slaves_count) { + SNDERR("multi: ch %d invalid slave idx %d", + i, sidxs[i]); + return -EINVAL; + } + if (schannels[i] >= schannels_count[sidxs[i]]) { + SNDERR("multi: ch %d channel %d out of range", + i, schannels[i]); + return -EINVAL; + } bind->slave_idx = sidxs[i]; bind->slave_channel = schannels[i]; if (sidxs[i] < 0) -- 2.55.0
