Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libmaxminddb for openSUSE:Factory checked in at 2026-10-28 17:44:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libmaxminddb (Old) and /work/SRC/openSUSE:Factory/.libmaxminddb.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libmaxminddb" Wed Oct 28 17:44:18 2026 rev:15 rq:1393009 version:1.14.1 Changes: -------- --- /work/SRC/openSUSE:Factory/libmaxminddb/libmaxminddb.changes 2026-03-31 15:22:12.504148244 +0200 +++ /work/SRC/openSUSE:Factory/.libmaxminddb.new.2252680/libmaxminddb.changes 2026-10-28 17:44:41.201401004 +0100 @@ -1,0 +2,42 @@ +Sat Oct 24 16:16:35 UTC 2026 - Torsten Gruner <[email protected]> + +- update to 1.14.1 + * Fixed a -Wsign-compare warning in MMDB_open() that broke builds with + -Werror on platforms where ssize_t is 32 bits, such as i686. + +- version 1.14.0 + * Bounded the resources that MMDB_get_entry_data_list() spends decoding a + single entry. A crafted database could nest data-section pointers to shared + targets so that decoding one entry cost exponential time and memory, or point + many times at one large value so that a caller copying the result materialized + far more data than the file holds. The decoder now follows the Reader Resource + Limits section of the MaxMind DB specification. Each call is limited to 65,536 + values and 2 MiB of string and bytes payload, in addition to the existing + recursive-decoder depth limit of 512. See the MMDB_get_entry_data_list() + documentation for details. + - Exceeding a limit returns the new MMDB_DECODER_LIMIT_ERROR status. A + full-list failure leaves the output set to NULL. + - MMDB_get_value(), MMDB_vget_value(), and MMDB_aget_value() now return + - MMDB_DECODER_LIMIT_ERROR instead of MMDB_INVALID_DATA_ERROR when they + skip a subtree past the depth limit. + - MMDB_open() returns MMDB_INVALID_METADATA_ERROR when metadata processing + exceeds a decoder limit. + - The limits can be raised when building the library with + -DMAXIMUM_DATA_STRUCTURE_DEPTH, -DMAXIMUM_DATA_STRUCTURE_VALUES, and + -DMAXIMUM_DATA_STRUCTURE_BYTES. + * Fixed an out-of-bounds read in MMDB_lookup_sockaddr() when callers passed a + sockaddr with an unsupported address family. The function now rejects any + family other than AF_INET and AF_INET6 with + MMDB_INVALID_NETWORK_ADDRESS_ERROR. + * Fixed metadata parsing for files that end immediately after the + \xAB\xCD\xEFMaxMind.com marker. Such files are now rejected as invalid + metadata instead of allowing a zero-length metadata section to reach the + decoder. + * Fixed search-tree validation for records that point into the 16-byte separator + before the data section. These records are now rejected as corrupt instead of + being exposed as apparent data entries with underflowed offsets. + * MMDB_read_node() now returns MMDB_CORRUPT_SEARCH_TREE_ERROR instead of + MMDB_SUCCESS with MMDB_RECORD_TYPE_INVALID record types when a node's + child record is invalid. + +------------------------------------------------------------------- Old: ---- libmaxminddb-1.13.3.tar.gz New: ---- libmaxminddb-1.14.1.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libmaxminddb.spec ++++++ --- /var/tmp/diff_new_pack.VHhigF/_old 2026-10-28 17:44:42.015435100 +0100 +++ /var/tmp/diff_new_pack.VHhigF/_new 2026-10-28 17:44:42.017435184 +0100 @@ -1,7 +1,7 @@ # # spec file for package libmaxminddb # -# Copyright (c) 2024 SUSE LLC +# Copyright (c) 2026 SUSE LLC # Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -19,7 +19,7 @@ %define lname libmaxminddb0 Name: libmaxminddb -Version: 1.13.3 +Version: 1.14.1 Release: 0 Summary: C library for the MaxMind DB file format License: Apache-2.0 ++++++ libmaxminddb-1.13.3.tar.gz -> libmaxminddb-1.14.1.tar.gz ++++++ ++++ 6405 lines of diff (skipped)
