Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package brotli for openSUSE:Factory checked in at 2026-10-23 20:21:25 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/brotli (Old) and /work/SRC/openSUSE:Factory/.brotli.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "brotli" Fri Oct 23 20:21:25 2026 rev:16 rq:1386990 version:1.2.1 Changes: -------- --- /work/SRC/openSUSE:Factory/brotli/brotli.changes 2026-03-22 14:11:40.084114829 +0100 +++ /work/SRC/openSUSE:Factory/.brotli.new.2252680/brotli.changes 2026-10-23 20:21:45.738163328 +0200 @@ -1,0 +2,7 @@ +Wed Oct 21 20:47:44 UTC 2026 - Jan Engelhardt <[email protected]> + +- Update to release 1.2.1 + * Fixed an out-of-bounds write write permitting remote code + execution [CVE-2026-111497] + +------------------------------------------------------------------- Old: ---- v1.2.0.tar.gz New: ---- v1.2.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ brotli.spec ++++++ --- /var/tmp/diff_new_pack.fqdiW9/_old 2026-10-23 20:21:46.582198649 +0200 +++ /var/tmp/diff_new_pack.fqdiW9/_new 2026-10-23 20:21:46.584198733 +0200 @@ -1,7 +1,7 @@ # # spec file for package brotli # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2017 Buschmann <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -19,7 +19,7 @@ %define sover 1 Name: brotli -Version: 1.2.0 +Version: 1.2.1 Release: 0 Summary: Lossless Compression Algorithm License: MIT ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.fqdiW9/_old 2026-10-23 20:21:46.629200616 +0200 +++ /var/tmp/diff_new_pack.fqdiW9/_new 2026-10-23 20:21:46.632200742 +0200 @@ -1,5 +1,5 @@ -mtime: 1773933465 -commit: 30a16e4e622e3c0d8c750b992f70ee4544e7dbf86c47e149867ee699902b16c6 +mtime: 1792615959 +commit: 8c910cc5e40797a61c50b528a08b8166cb8e2082a9b5559ea90df82d50273687 url: https://src.opensuse.org/jengelh/brotli revision: master ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-21 22:52:39.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ v1.2.0.tar.gz -> v1.2.1.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/brotli-1.2.0/CHANGELOG.md new/brotli-1.2.1/CHANGELOG.md --- old/brotli-1.2.0/CHANGELOG.md 2025-10-27 14:07:48.000000000 +0100 +++ new/brotli-1.2.1/CHANGELOG.md 2026-10-21 15:10:51.000000000 +0200 @@ -7,6 +7,11 @@ ## Unreleased +## [1.2.1] - 2026-10-21 + +### SECURITY + - CVE-2026-111497: out-of-bounds write permits remote code execution + ## [1.2.0] - 2025-10-27 ### SECURITY diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/brotli-1.2.0/c/common/version.h new/brotli-1.2.1/c/common/version.h --- old/brotli-1.2.0/c/common/version.h 2025-10-27 14:07:48.000000000 +0100 +++ new/brotli-1.2.1/c/common/version.h 2026-10-21 15:10:51.000000000 +0200 @@ -19,7 +19,7 @@ #define BROTLI_VERSION_MAJOR 1 #define BROTLI_VERSION_MINOR 2 -#define BROTLI_VERSION_PATCH 0 +#define BROTLI_VERSION_PATCH 1 #define BROTLI_VERSION BROTLI_MAKE_HEX_VERSION( \ BROTLI_VERSION_MAJOR, BROTLI_VERSION_MINOR, BROTLI_VERSION_PATCH) @@ -33,7 +33,7 @@ */ #define BROTLI_ABI_CURRENT 3 -#define BROTLI_ABI_REVISION 0 +#define BROTLI_ABI_REVISION 1 #define BROTLI_ABI_AGE 2 #if BROTLI_VERSION_MAJOR != (BROTLI_ABI_CURRENT - BROTLI_ABI_AGE) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/brotli-1.2.0/c/dec/decode.c new/brotli-1.2.1/c/dec/decode.c --- old/brotli-1.2.0/c/dec/decode.c 2025-10-27 14:07:48.000000000 +0100 +++ new/brotli-1.2.1/c/dec/decode.c 2026-10-21 15:10:51.000000000 +0200 @@ -1176,7 +1176,7 @@ /* Decodes a command or literal and updates block type ring-buffer. Reads 3..54 bits. */ -static BROTLI_INLINE BROTLI_BOOL DecodeBlockTypeAndLength( +static BROTLI_INLINE BrotliDecoderErrorCode DecodeBlockTypeAndLength( int safe, BrotliDecoderState* s, int tree_type) { brotli_reg_t max_block_type = s->num_block_types[tree_type]; const HuffmanCode* type_tree = &s->block_type_trees[ @@ -1187,7 +1187,7 @@ brotli_reg_t* ringbuffer = &s->block_type_rb[tree_type * 2]; brotli_reg_t block_type; if (max_block_type <= 1) { - return BROTLI_FALSE; + return BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH; } /* Read 0..15 + 3..39 bits. */ @@ -1197,11 +1197,13 @@ } else { BrotliBitReaderState memento; BrotliBitReaderSaveState(br, &memento); - if (!SafeReadSymbol(type_tree, br, &block_type)) return BROTLI_FALSE; + if (!SafeReadSymbol(type_tree, br, &block_type)) { + return BROTLI_DECODER_NEEDS_MORE_INPUT; + } if (!SafeReadBlockLength(s, &s->block_length[tree_type], len_tree, br)) { s->substate_read_block_length = BROTLI_STATE_READ_BLOCK_LENGTH_NONE; BrotliBitReaderRestoreState(br, &memento); - return BROTLI_FALSE; + return BROTLI_DECODER_NEEDS_MORE_INPUT; } } @@ -1217,7 +1219,7 @@ } ringbuffer[0] = ringbuffer[1]; ringbuffer[1] = block_type; - return BROTLI_TRUE; + return BROTLI_DECODER_SUCCESS; } static BROTLI_INLINE void DetectTrivialLiteralBlockTypes( @@ -1254,62 +1256,68 @@ /* Decodes the block type and updates the state for literal context. Reads 3..54 bits. */ -static BROTLI_INLINE BROTLI_BOOL DecodeLiteralBlockSwitchInternal( +static BROTLI_INLINE BrotliDecoderErrorCode DecodeLiteralBlockSwitchInternal( int safe, BrotliDecoderState* s) { - if (!DecodeBlockTypeAndLength(safe, s, 0)) { - return BROTLI_FALSE; + BrotliDecoderErrorCode result = DecodeBlockTypeAndLength(safe, s, 0); + if (result != BROTLI_DECODER_SUCCESS) { + return result; } PrepareLiteralDecoding(s); - return BROTLI_TRUE; + return BROTLI_DECODER_SUCCESS; } -static void BROTLI_NOINLINE DecodeLiteralBlockSwitch(BrotliDecoderState* s) { - DecodeLiteralBlockSwitchInternal(0, s); +static BROTLI_NOINLINE BrotliDecoderErrorCode +DecodeLiteralBlockSwitch(BrotliDecoderState* s) { + return DecodeLiteralBlockSwitchInternal(0, s); } -static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeLiteralBlockSwitch( +static BROTLI_NOINLINE BrotliDecoderErrorCode SafeDecodeLiteralBlockSwitch( BrotliDecoderState* s) { return DecodeLiteralBlockSwitchInternal(1, s); } /* Block switch for insert/copy length. Reads 3..54 bits. */ -static BROTLI_INLINE BROTLI_BOOL DecodeCommandBlockSwitchInternal( +static BROTLI_INLINE BrotliDecoderErrorCode DecodeCommandBlockSwitchInternal( int safe, BrotliDecoderState* s) { - if (!DecodeBlockTypeAndLength(safe, s, 1)) { - return BROTLI_FALSE; + BrotliDecoderErrorCode result = DecodeBlockTypeAndLength(safe, s, 1); + if (result != BROTLI_DECODER_SUCCESS) { + return result; } s->htree_command = s->insert_copy_hgroup.htrees[s->block_type_rb[3]]; - return BROTLI_TRUE; + return BROTLI_DECODER_SUCCESS; } -static void BROTLI_NOINLINE DecodeCommandBlockSwitch(BrotliDecoderState* s) { - DecodeCommandBlockSwitchInternal(0, s); +static BROTLI_NOINLINE BrotliDecoderErrorCode +DecodeCommandBlockSwitch(BrotliDecoderState* s) { + return DecodeCommandBlockSwitchInternal(0, s); } -static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeCommandBlockSwitch( - BrotliDecoderState* s) { +static BROTLI_NOINLINE BrotliDecoderErrorCode +SafeDecodeCommandBlockSwitch(BrotliDecoderState* s) { return DecodeCommandBlockSwitchInternal(1, s); } /* Block switch for distance codes. Reads 3..54 bits. */ -static BROTLI_INLINE BROTLI_BOOL DecodeDistanceBlockSwitchInternal( +static BROTLI_INLINE BrotliDecoderErrorCode DecodeDistanceBlockSwitchInternal( int safe, BrotliDecoderState* s) { - if (!DecodeBlockTypeAndLength(safe, s, 2)) { - return BROTLI_FALSE; + BrotliDecoderErrorCode result = DecodeBlockTypeAndLength(safe, s, 2); + if (result != BROTLI_DECODER_SUCCESS) { + return result; } s->dist_context_map_slice = s->dist_context_map + (s->block_type_rb[5] << BROTLI_DISTANCE_CONTEXT_BITS); s->dist_htree_index = s->dist_context_map_slice[s->distance_context]; - return BROTLI_TRUE; + return BROTLI_DECODER_SUCCESS; } -static void BROTLI_NOINLINE DecodeDistanceBlockSwitch(BrotliDecoderState* s) { - DecodeDistanceBlockSwitchInternal(0, s); +static BROTLI_NOINLINE BrotliDecoderErrorCode +DecodeDistanceBlockSwitch(BrotliDecoderState* s) { + return DecodeDistanceBlockSwitchInternal(0, s); } -static BROTLI_BOOL BROTLI_NOINLINE SafeDecodeDistanceBlockSwitch( +static BROTLI_NOINLINE BrotliDecoderErrorCode SafeDecodeDistanceBlockSwitch( BrotliDecoderState* s) { return DecodeDistanceBlockSwitchInternal(1, s); } @@ -1940,6 +1948,9 @@ return BrotliCheckInputAmount(br); } +/* NB: METHOD should return BROTLI_FALSE only in case there is not enough input; + in case of "unsafe" execution, when input is guaranteed to be sufficient, + result is ignored. */ #define BROTLI_SAFE(METHOD) \ { \ if (safe) { \ @@ -1952,6 +1963,22 @@ } \ } +/* NB: METHOD should return BROTLI_DECODER_SUCCESS, BROTLI_DECODER_ERROR_*, or + BROTLI_DECODER_NEEDS_MORE_INPUT; the later two break the processing. */ +#define BROTLI_SAFE_WITH_STATUS(METHOD) \ + { \ + BrotliDecoderErrorCode status; \ + if (safe) { \ + status = Safe##METHOD; \ + } else { \ + status = METHOD; \ + } \ + if (status != BROTLI_DECODER_SUCCESS) { \ + result = status; \ + goto saveStateAndReturn; \ + } \ + } + static BROTLI_INLINE BrotliDecoderErrorCode ProcessCommandsInternal( int safe, BrotliDecoderState* s) { int pos = s->pos; @@ -1991,7 +2018,7 @@ goto saveStateAndReturn; } if (BROTLI_PREDICT_FALSE(s->block_length[1] == 0)) { - BROTLI_SAFE(DecodeCommandBlockSwitch(s)); + BROTLI_SAFE_WITH_STATUS(DecodeCommandBlockSwitch(s)); goto CommandBegin; } /* Read the insert/copy length in the command. */ @@ -2136,7 +2163,7 @@ } else { /* Read distance code in the command, unless it was implicitly zero. */ if (BROTLI_PREDICT_FALSE(s->block_length[2] == 0)) { - BROTLI_SAFE(DecodeDistanceBlockSwitch(s)); + BROTLI_SAFE_WITH_STATUS(DecodeDistanceBlockSwitch(s)); } BROTLI_SAFE(ReadDistance(s, br)); } @@ -2330,7 +2357,7 @@ } NextLiteralBlock: - BROTLI_SAFE(DecodeLiteralBlockSwitch(s)); + BROTLI_SAFE_WITH_STATUS(DecodeLiteralBlockSwitch(s)); goto CommandInner; saveStateAndReturn: @@ -2552,6 +2579,8 @@ if (result != BROTLI_DECODER_SUCCESS) { break; } + BROTLI_DCHECK(s->meta_block_remaining_len <= + (int)BROTLI_BLOCK_SIZE_CAP); BROTLI_LOG_UINT(s->is_last_metablock); BROTLI_LOG_UINT(s->meta_block_remaining_len); BROTLI_LOG_UINT(s->is_metadata); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/brotli-1.2.0/c/include/brotli/decode.h new/brotli-1.2.1/c/include/brotli/decode.h --- old/brotli-1.2.0/c/include/brotli/decode.h 2025-10-27 14:07:48.000000000 +0100 +++ new/brotli-1.2.1/c/include/brotli/decode.h 2026-10-21 15:10:51.000000000 +0200 @@ -85,9 +85,7 @@ BROTLI_ERROR_CODE(_ERROR_FORMAT_, PADDING_1, -14) SEPARATOR \ BROTLI_ERROR_CODE(_ERROR_FORMAT_, PADDING_2, -15) SEPARATOR \ BROTLI_ERROR_CODE(_ERROR_FORMAT_, DISTANCE, -16) SEPARATOR \ - \ - /* -17 code is reserved */ \ - \ + BROTLI_ERROR_CODE(_ERROR_FORMAT_, BLOCK_SWITCH, -17) SEPARATOR \ BROTLI_ERROR_CODE(_ERROR_, COMPOUND_DICTIONARY, -18) SEPARATOR \ BROTLI_ERROR_CODE(_ERROR_, DICTIONARY_NOT_SET, -19) SEPARATOR \ BROTLI_ERROR_CODE(_ERROR_, INVALID_ARGUMENTS, -20) SEPARATOR \
