Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libosip2 for openSUSE:Factory checked in at 2026-10-28 17:47:53 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libosip2 (Old) and /work/SRC/openSUSE:Factory/.libosip2.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libosip2" Wed Oct 28 17:47:53 2026 rev:32 rq:1393217 version:5.3.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libosip2/libosip2.changes 2022-12-21 16:07:25.162806495 +0100 +++ /work/SRC/openSUSE:Factory/.libosip2.new.2252680/libosip2.changes 2026-10-28 17:48:07.345017243 +0100 @@ -1,0 +2,7 @@ +Sat Jul 25 12:25:16 UTC 2026 - Andreas Stieger <[email protected]> + +- update to 5.3.2: + * Fix a potential out-of-bounds read when parsing malformed SDP + data + +------------------------------------------------------------------- Old: ---- libosip2-5.3.1.tar.gz libosip2-5.3.1.tar.gz.sig New: ---- libosip2-5.3.2.tar.gz libosip2-5.3.2.tar.gz.sig ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libosip2.spec ++++++ --- /var/tmp/diff_new_pack.SxRfJx/_old 2026-10-28 17:48:08.316057866 +0100 +++ /var/tmp/diff_new_pack.SxRfJx/_new 2026-10-28 17:48:08.317057908 +0100 @@ -2,6 +2,7 @@ # spec file for package libosip2 # # Copyright (c) 2022 SUSE LLC +# Copyright (c) 2026 Andreas Stieger <[email protected]> # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -18,7 +19,7 @@ %define sover 15 Name: libosip2 -Version: 5.3.1 +Version: 5.3.2 Release: 0 Summary: Implementation of SIP (RFC 3261) License: LGPL-2.1-or-later @@ -61,7 +62,7 @@ http://www.ietf.org/rfc/rfc3261.txt. %prep -%setup -q +%autosetup -p1 %build %configure \ @@ -78,8 +79,7 @@ %check %make_build check -%post -n %{name}-%{sover} -p /sbin/ldconfig -%postun -n %{name}-%{sover} -p /sbin/ldconfig +%ldconfig_scriptlets -n %{name}-%{sover} %files -n %{name}-%{sover} %license COPYING @@ -92,5 +92,5 @@ %{_includedir}/osip2 %{_libdir}/lib*.so %{_libdir}/pkgconfig/libosip2.pc -%{_mandir}/man1/* +%{_mandir}/man1/osip.1%{?ext_man} ++++++ libosip2-5.3.1.tar.gz -> libosip2-5.3.2.tar.gz ++++++ ++++ 11523 lines of diff (skipped) ++++ retrying with extended exclude list diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/COPYING new/libosip2-5.3.2/COPYING --- old/libosip2-5.3.1/COPYING 2016-01-21 13:06:21.000000000 +0100 +++ new/libosip2-5.3.2/COPYING 2026-07-14 15:02:32.000000000 +0200 @@ -1,4 +1,118 @@ - GNU LESSER GENERAL PUBLIC LICENSE + GNU LESSER GENERAL PUBLIC LICENSE + Version 2.1, February 1999 + + Copyright (C) 1991, 1999 Free Software Foundation, Inc. + <https://fsf.org/> + Everyone is permitted to copy and distribute verbatim copies + of this license document, but changing it is not allowed. + +[This is the first released version of the Lesser GPL. It also counts + as the successor of the GNU Library Public License, version 2, hence + the version number 2.1.] + + Preamble + + The licenses for most software are designed to take away your +freedom to share and change it. By contrast, the GNU General Public +Licenses are intended to guarantee your freedom to share and change +free software--to make sure the software is free for all its users. + + This license, the Lesser General Public License, applies to some +specially designated software packages--typically libraries--of the +Free Software Foundation and other authors who decide to use it. You +can use it too, but we suggest you first think carefully about whether +this license or the ordinary General Public License is the better +strategy to use in any particular case, based on the explanations below. + + When we speak of free software, we are referring to freedom of use, +not price. Our General Public Licenses are designed to make sure that +you have the freedom to distribute copies of free software (and charge +for this service if you wish); that you receive source code or can get +it if you want it; that you can change the software and use pieces of +it in new free programs; and that you are informed that you can do +these things. + + To protect your rights, we need to make restrictions that forbid +distributors to deny you these rights or to ask you to surrender these +rights. These restrictions translate to certain responsibilities for +you if you distribute copies of the library or if you modify it. + + For example, if you distribute copies of the library, whether gratis +or for a fee, you must give the recipients all the rights that we gave +you. You must make sure that they, too, receive or can get the source +code. If you link other code with the library, you must provide +complete object files to the recipients, so that they can relink them +with the library after making changes to the library and recompiling +it. And you must show them these terms so they know their rights. + + We protect your rights with a two-step method: (1) we copyright the +library, and (2) we offer you this license, which gives you legal +permission to copy, distribute and/or modify the library. + + To protect each distributor, we want to make it very clear that +there is no warranty for the free library. Also, if the library is +modified by someone else and passed on, the recipients should know +that what they have is not the original version, so that the original +author's reputation will not be affected by problems that might be +introduced by others. + + Finally, software patents pose a constant threat to the existence of +any free program. We wish to make sure that a company cannot +effectively restrict the users of a free program by obtaining a +restrictive license from a patent holder. Therefore, we insist that +any patent license obtained for a version of the library must be +consistent with the full freedom of use specified in this license. + + Most GNU software, including some libraries, is covered by the +ordinary GNU General Public License. This license, the GNU Lesser +General Public License, applies to certain designated libraries, and +is quite different from the ordinary General Public License. We use +this license for certain libraries in order to permit linking those +libraries into non-free programs. + + When a program is linked with a library, whether statically or using +a shared library, the combination of the two is legally speaking a +combined work, a derivative of the original library. The ordinary +General Public License therefore permits such linking only if the +entire combination fits its criteria of freedom. The Lesser General +Public License permits more lax criteria for linking other code with +the library. + + We call this license the "Lesser" General Public License because it +does Less to protect the user's freedom than the ordinary General +Public License. It also provides other free software developers Less +of an advantage over competing non-free programs. These disadvantages +are the reason we use the ordinary General Public License for many +libraries. However, the Lesser license provides advantages in certain +special circumstances. + + For example, on rare occasions, there may be a special need to +encourage the widest possible use of a certain library, so that it becomes +a de-facto standard. To achieve this, non-free programs must be +allowed to use the library. A more frequent case is that a free +library does the same job as widely used non-free libraries. In this +case, there is little to gain by limiting the free library to free +software only, so we use the Lesser General Public License. + + In other cases, permission to use a particular library in non-free +programs enables a greater number of people to use a large body of +free software. For example, permission to use the GNU C Library in +non-free programs enables many more people to use the whole GNU +operating system, as well as its variant, the GNU/Linux operating +system. + + Although the Lesser General Public License is Less protective of the +users' freedom, it does ensure that the user of a program that is +linked with the Library has the freedom and the wherewithal to run +that program using a modified version of the Library. + + The precise terms and conditions for copying, distribution and +modification follow. Pay close attention to the difference between a +"work based on the library" and a "work that uses the library". The +former contains code derived from the library, whereas the latter must +be combined with the library in order to run. + + GNU LESSER GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License Agreement applies to any software library or other @@ -32,7 +146,7 @@ on the Library (independent of the use of the Library in a tool for writing it). Whether that is true depends on what the Library does and what the program that uses the Library does. - + 1. You may copy and distribute verbatim copies of the Library's complete source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an @@ -318,7 +432,7 @@ of all derivatives of our free software and of promoting the sharing and reuse of software generally. - NO WARRANTY + NO WARRANTY 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. @@ -341,4 +455,47 @@ SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. - END OF TERMS AND CONDITIONS + END OF TERMS AND CONDITIONS + + How to Apply These Terms to Your New Libraries + + If you develop a new library, and you want it to be of the greatest +possible use to the public, we recommend making it free software that +everyone can redistribute and change. You can do so by permitting +redistribution under these terms (or, alternatively, under the terms of the +ordinary General Public License). + + To apply these terms, attach the following notices to the library. It is +safest to attach them to the start of each source file to most effectively +convey the exclusion of warranty; and each file should have at least the +"copyright" line and a pointer to where the full notice is found. + + <one line to give the library's name and a brief idea of what it does.> + Copyright (C) <year> <name of author> + + This library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + This library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with this library; if not, see <https://www.gnu.org/licenses/>. + +Also add information on how to contact you by electronic and paper mail. + +You should also get your employer (if you work as a programmer) or your +school, if any, to sign a "copyright disclaimer" for the library, if +necessary. Here is a sample; alter the names: + + Yoyodyne, Inc., hereby disclaims all copyright interest in the + library `Frob' (a library for tweaking knobs) written by James Random Hacker. + + <signature of Moe Ghoul>, 1 April 1990 + Moe Ghoul, President of Vice + +That's all there is to it! diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/ChangeLog new/libosip2-5.3.2/ChangeLog --- old/libosip2-5.3.1/ChangeLog 2022-10-12 19:28:12.000000000 +0200 +++ new/libosip2-5.3.2/ChangeLog 2026-07-23 00:30:23.000000000 +0200 @@ -1,3 +1,7 @@ +libosip2 (5.3.2) - 2026-07-23 + * fix bug report: Fixed a potential out-of-bounds read when parsing malformed SDP data. + The result is never used so the confidentiality impact is NONE. Low probability of crash. + libosip2 (5.3.1) - 2022-10-12 * fix bug #63103: [CVE-2022-41550] in multipart bodies, LWS can't exist diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/configure.ac new/libosip2-5.3.2/configure.ac --- old/libosip2-5.3.1/configure.ac 2022-10-12 19:32:18.000000000 +0200 +++ new/libosip2-5.3.2/configure.ac 2026-07-23 00:33:58.000000000 +0200 @@ -1,5 +1,5 @@ AC_PREREQ([2.69]) -AC_INIT([libosip2],[5.3.1]) +AC_INIT([libosip2],[5.3.2]) AC_CONFIG_SRCDIR([include/osip2/osip.h]) AC_MSG_NOTICE([libosip2 The GNU Open SIP library.]) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/help/doxygen/DoxyFile new/libosip2-5.3.2/help/doxygen/DoxyFile --- old/libosip2-5.3.1/help/doxygen/DoxyFile 2022-10-12 19:31:43.000000000 +0200 +++ new/libosip2-5.3.2/help/doxygen/DoxyFile 2026-07-23 00:32:49.000000000 +0200 @@ -38,7 +38,7 @@ # could be handy for archiving the generated documentation or if some version # control system is used. -PROJECT_NUMBER = 5.3.1 +PROJECT_NUMBER = 5.3.2 # Using the PROJECT_BRIEF tag one can provide an optional one line description # for a project that appears at the top of each page and should give viewer a diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/include/osipparser2/osip_parser.h new/libosip2-5.3.2/include/osipparser2/osip_parser.h --- old/libosip2-5.3.1/include/osipparser2/osip_parser.h 2020-07-23 20:32:53.000000000 +0200 +++ new/libosip2-5.3.2/include/osipparser2/osip_parser.h 2024-02-26 13:36:48.000000000 +0100 @@ -24,7 +24,7 @@ /** * @file osip_parser.h - * @brief oSIP SIP Parser additionnal Routines + * @brief oSIP SIP Parser additional Routines * */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/osip-config.h.in new/libosip2-5.3.2/osip-config.h.in --- old/libosip2-5.3.1/osip-config.h.in 2022-10-12 19:33:50.000000000 +0200 +++ new/libosip2-5.3.2/osip-config.h.in 2026-07-23 00:34:50.000000000 +0200 @@ -27,9 +27,6 @@ /* Define to 1 if you have the <malloc.h> header file. */ #undef HAVE_MALLOC_H -/* Define to 1 if you have the <memory.h> header file. */ -#undef HAVE_MEMORY_H - /* Define if you have POSIX threads libraries and header files. */ #undef HAVE_PTHREAD @@ -124,7 +121,9 @@ your system. */ #undef PTHREAD_CREATE_JOINABLE -/* Define to 1 if you have the ANSI C header files. */ +/* Define to 1 if all of the C90 standard headers exist (not just the ones + required in a freestanding environment). This macro is provided for + backward compatibility; new code need not use it. */ #undef STDC_HEADERS /* Version number of package */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/src/osipparser2/osip_via.c new/libosip2-5.3.2/src/osipparser2/osip_via.c --- old/libosip2-5.3.1/src/osipparser2/osip_via.c 2022-02-27 11:18:35.000000000 +0100 +++ new/libosip2-5.3.2/src/osipparser2/osip_via.c 2024-02-26 13:36:48.000000000 +0100 @@ -159,7 +159,7 @@ osip_clrncpy(via->version, version + 1, protocol - version - 1); - /* Here: we avoid matching an additionnal space */ + /* Here: we avoid matching an additional space */ host = strchr(protocol + 1, ' '); if (host == NULL) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/src/osipparser2/sdp_message.c new/libosip2-5.3.2/src/osipparser2/sdp_message.c --- old/libosip2-5.3.1/src/osipparser2/sdp_message.c 2021-11-22 16:14:49.000000000 +0100 +++ new/libosip2-5.3.2/src/osipparser2/sdp_message.c 2026-07-20 14:59:09.000000000 +0200 @@ -1531,7 +1531,10 @@ char *str; int more_space_before_crlf; - space = strchr(tmp + 1, ' '); + space = NULL; + if (tmp[0] != '\0') { + space = strchr(tmp + 1, ' '); + } if (space == NULL) more_space_before_crlf = 1; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/src/test/res/sip98 new/libosip2-5.3.2/src/test/res/sip98 --- old/libosip2-5.3.1/src/test/res/sip98 1970-01-01 01:00:00.000000000 +0100 +++ new/libosip2-5.3.2/src/test/res/sip98 2026-07-14 16:56:44.000000000 +0200 @@ -0,0 +1,14 @@ +REGISTER sip:bell-tel.com SIP/2.0 +Via: SIP/2.0/UDP saturn.bell-tel.com +From: <sip:[email protected]>;tag=19 +To: sip:[email protected] +Call-ID: [email protected] +CSeq: 2 REGISTER +Content-Type: application/sdp +Expires: 0 +Contact: * + +v=0 +o=- 12sc33.atla3456 654321 ININ IP4 1�67.1.1 +t=0 0 +m=audio 8000 RTP/A0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/src/test/res/sip98~ new/libosip2-5.3.2/src/test/res/sip98~ --- old/libosip2-5.3.1/src/test/res/sip98~ 1970-01-01 01:00:00.000000000 +0100 +++ new/libosip2-5.3.2/src/test/res/sip98~ 2026-07-14 15:43:45.000000000 +0200 @@ -0,0 +1,15 @@ +REGISTER sip:bell-tel.com SIP/2.0 +Via: SIP/2.0/UDP saturn.bell-tel.com +From: <sip:[email protected]>;tag=19 +To: sip:[email protected] +Call-ID: [email protected] +CSeq: 2 REGISTER +Expires: 0 +Contact: * + +v=0 +o=- 12sc33.atla3456 654321 ININ IP4 1�67.1.1 +t=0 0 +m=audio 8000 RTP/A0 +m=audio 8000 RTP/AVP���� =00 RTP/A0 +m=audio 8a=rtpmap:0 PCMU/800" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/libosip2-5.3.1/src/test/torture.c new/libosip2-5.3.2/src/test/torture.c --- old/libosip2-5.3.1/src/test/torture.c 2022-10-12 19:06:07.000000000 +0200 +++ new/libosip2-5.3.2/src/test/torture.c 2026-07-14 16:57:26.000000000 +0200 @@ -169,7 +169,7 @@ } else { size_t length; -#if 0 +#if 1 sdp_message_t *sdp; osip_body_t *oldbody; int pos;
