Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsndfile for openSUSE:Factory checked in at 2026-10-23 20:21:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsndfile (Old) and /work/SRC/openSUSE:Factory/.libsndfile.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsndfile" Fri Oct 23 20:21:21 2026 rev:71 rq:1386943 version:1.2.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libsndfile/libsndfile-progs.changes 2026-10-15 18:20:37.649654048 +0200 +++ /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile-progs.changes 2026-10-23 20:21:37.554820876 +0200 @@ -1,0 +2,7 @@ +Tue Oct 20 16:18:38 UTC 2026 - Takashi Iwai <[email protected]> + +- Fix integer overflow vulnerability in mat4_read_header() + (bsc#1282671, CVE-2026-88372): + libsndfile-CVE-2026-88372.patch + +------------------------------------------------------------------- libsndfile.changes: same change New: ---- libsndfile-CVE-2026-88372.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile-progs.changes- (bsc#1282671, CVE-2026-88372): /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile-progs.changes: libsndfile-CVE-2026-88372.patch /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile-progs.changes- -- /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile.changes- (bsc#1282671, CVE-2026-88372): /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile.changes: libsndfile-CVE-2026-88372.patch /work/SRC/openSUSE:Factory/.libsndfile.new.2252680/libsndfile.changes- ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsndfile-progs.spec ++++++ --- /var/tmp/diff_new_pack.6lmzIY/_old 2026-10-23 20:21:38.386855695 +0200 +++ /var/tmp/diff_new_pack.6lmzIY/_new 2026-10-23 20:21:38.388855778 +0200 @@ -35,6 +35,7 @@ # not merged yet to the upstream Patch5: libsndfile-CVE-2025-52194.patch Patch6: libsndfile-CVE-2026-37555.patch +Patch12: libsndfile-CVE-2026-88372.patch # PATCH-FIX-OPENSUSE Patch100: sndfile-ocloexec.patch BuildRequires: alsa-devel ++++++ libsndfile.spec ++++++ --- /var/tmp/diff_new_pack.6lmzIY/_old 2026-10-23 20:21:38.426857369 +0200 +++ /var/tmp/diff_new_pack.6lmzIY/_new 2026-10-23 20:21:38.428857452 +0200 @@ -37,6 +37,7 @@ # not merged yet to the upstream Patch5: libsndfile-CVE-2025-52194.patch Patch6: libsndfile-CVE-2026-37555.patch +Patch12: libsndfile-CVE-2026-88372.patch # PATCH-FIX-OPENSUSE Patch100: sndfile-ocloexec.patch BuildRequires: cmake ++++++ libsndfile-CVE-2026-88372.patch ++++++ >From b2fc0c9deec009849386ca6c0619ffca78ec3e81 Mon Sep 17 00:00:00 2001 From: iliasabk <[email protected]> Date: Fri, 18 Sep 2026 02:43:38 +0200 Subject: [PATCH] mat4: reject negative matrix dimensions in mat4_read_header. Rows and cols from the file header were only checked for rows == 0 and rows > SF_MAX_CHANNELS. Negative values passed through and were stored as sf.channels / sf.frames, so the product channels * frames * bytewidth could overflow sf_count_t (e.g. -2071690108 * -2071690108 * 8), and signed overflow made the truncation/dataend/datalength math undefined. Reject rows < 0 and cols < 0 with SFE_CHANNEL_COUNT_BAD. Fixes #1151. --- src/mat4.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/mat4.c b/src/mat4.c index 9f046f0c6..7a459df79 100644 --- a/src/mat4.c +++ b/src/mat4.c @@ -276,6 +276,10 @@ mat4_read_header (SF_PRIVATE *psf) { psf_log_printf (psf, "*** Error : zero channel count.\n") ; return SFE_CHANNEL_COUNT_ZERO ; } + else if (rows < 0 || cols < 0) + { psf_log_printf (psf, "*** Error : bad matrix dimensions %d x %d.\n", rows, cols) ; + return SFE_CHANNEL_COUNT_BAD ; + } else if (rows > SF_MAX_CHANNELS) { psf_log_printf (psf, "*** Error : channel count %d > SF_MAX_CHANNELS.\n", rows) ; return SFE_CHANNEL_COUNT ;
