Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsixel for openSUSE:Factory checked in at 2026-11-04 19:44:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsixel (Old) and /work/SRC/openSUSE:Factory/.libsixel.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsixel" Wed Nov 4 19:44:13 2026 rev:4 rq:1394752 version:1.10.5 Changes: -------- --- /work/SRC/openSUSE:Factory/libsixel/libsixel.changes 2025-09-05 21:45:02.709021775 +0200 +++ /work/SRC/openSUSE:Factory/.libsixel.new.3759290/libsixel.changes 2026-11-04 19:44:17.489476856 +0100 @@ -1,0 +2,8 @@ +Tue Oct 27 15:10:27 UTC 2026 - Dirk Müller <[email protected]> + +- add CVE-2026-33023.patch (bsc#1262127, CVE-2026-33023) +- add CVE-2026-44638.patch (bsc#1265315, CVE-2026-44638) +- add CVE-2026-44637.patch (bsc#1265314, CVE-2026-44637) +- add CVE-2026-44636.patch (bsc#1265313, CVE-2026-44636) + +------------------------------------------------------------------- New: ---- CVE-2026-33023.patch CVE-2026-44636.patch CVE-2026-44637.patch CVE-2026-44638.patch ----------(New B)---------- New: - add CVE-2026-33023.patch (bsc#1262127, CVE-2026-33023) - add CVE-2026-44638.patch (bsc#1265315, CVE-2026-44638) New:- add CVE-2026-44637.patch (bsc#1265314, CVE-2026-44637) - add CVE-2026-44636.patch (bsc#1265313, CVE-2026-44636) New:- add CVE-2026-44638.patch (bsc#1265315, CVE-2026-44638) - add CVE-2026-44637.patch (bsc#1265314, CVE-2026-44637) - add CVE-2026-44636.patch (bsc#1265313, CVE-2026-44636) New:- add CVE-2026-33023.patch (bsc#1262127, CVE-2026-33023) - add CVE-2026-44638.patch (bsc#1265315, CVE-2026-44638) - add CVE-2026-44637.patch (bsc#1265314, CVE-2026-44637) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsixel.spec ++++++ --- /var/tmp/diff_new_pack.Z9cSHI/_old 2026-11-04 19:44:19.405557061 +0100 +++ /var/tmp/diff_new_pack.Z9cSHI/_new 2026-11-04 19:44:19.407557145 +0100 @@ -1,7 +1,7 @@ # # spec file for package libsixel # -# Copyright (c) 2025 SUSE LLC and contributors +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -28,6 +28,10 @@ Patch0: meson.patch # CVE-2025-9300 Patch1: 0001-Fix-a-heap-buffer-overflow-problem-reported-by-err2z.patch +Patch2: CVE-2026-33023.patch +Patch3: CVE-2026-44638.patch +Patch4: CVE-2026-44637.patch +Patch5: CVE-2026-44636.patch BuildRequires: bash BuildRequires: meson BuildRequires: pkgconfig ++++++ CVE-2026-33023.patch ++++++ >From 577a3b46b7d191efeda04069a9356b5a49a53e59 Mon Sep 17 00:00:00 2001 From: Hayaki Saito <[email protected]> Date: Tue, 10 Mar 2026 23:06:26 +0900 Subject: [PATCH] loader: respect frame refcount in gdk-pixbuf cleanup --- src/loader.c | 110 +++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 107 insertions(+), 3 deletions(-) Index: libsixel-1.10.5/src/loader.c =================================================================== --- libsixel-1.10.5.orig/src/loader.c +++ libsixel-1.10.5/src/loader.c @@ -1096,9 +1096,7 @@ end: if (frame) { gdk_pixbuf_loader_close(loader, NULL); g_object_unref(loader); - sixel_allocator_free(pchunk->allocator, frame->pixels); - sixel_allocator_free(pchunk->allocator, frame->palette); - sixel_allocator_free(pchunk->allocator, frame); + sixel_frame_unref(frame); } return status; ++++++ CVE-2026-44636.patch ++++++ Fix signed integer overflow in sixel_encode_highcolor allocation sixel_encode_highcolor computes allocation sizes in plain int. With width and height each up to INT_MAX (only "< 1" is checked at the public sixel_encode entry point), width * height overflows for any product larger than INT_MAX (about 2.15 billion). The cast (size_t)whole_size then either produces a huge unsigned value (allocation fails) or a small wrapped value (allocation succeeds with a buffer much smaller than expected, leading to heap overflow on subsequent writes). The pointer arithmetic "paletted_pixels + width * height" suffers the same overflow. sixel_encode_dither already does this correctly with (size_t) casts. Mirror that here. Also add an upper bound check on width and height in sixel_encode itself, matching the SIXEL_WIDTH_LIMIT / SIXEL_HEIGHT_LIMIT used by the decoder. --- src/tosixel.c | 32 ++++++++++++++++++++++++++------ 1 file changed, 26 insertions(+), 6 deletions(-) diff --git a/src/tosixel.c b/src/tosixel.c --- a/src/tosixel.c +++ b/src/tosixel.c @@ -1313,10 +1313,10 @@ sixel_encode_highcolor( unsigned char palstate[SIXEL_PALETTE_MAX]; int output_count; int const maxcolors = 1 << 15; - int whole_size = width * height /* for paletted_pixels */ - + maxcolors /* for rgbhit */ - + maxcolors /* for rgb2pal */ - + width * 6; /* for marks */ + size_t whole_size = (size_t)width * (size_t)height /* for paletted_pixels */ + + (size_t)maxcolors /* for rgbhit */ + + (size_t)maxcolors /* for rgb2pal */ + + (size_t)width * 6; /* for marks */ int x, y; unsigned char *dst; unsigned char *mptr; @@ -1331,7 +1331,7 @@ sixel_encode_highcolor( if (dither->pixelformat != SIXEL_PIXELFORMAT_RGB888) { /* normalize pixelfromat */ normalized_pixels = (unsigned char *)sixel_allocator_malloc(dither->allocator, - (size_t)(width * height * 3)); + (size_t)width * (size_t)height * 3UL); if (normalized_pixels == NULL) { goto error; } @@ -1346,12 +1346,12 @@ sixel_encode_highcolor( pixels = normalized_pixels; } paletted_pixels = (sixel_index_t *)sixel_allocator_malloc(dither->allocator, - (size_t)whole_size); + whole_size); if (paletted_pixels == NULL) { goto error; } - rgbhit = paletted_pixels + width * height; - memset(rgbhit, 0, (size_t)(maxcolors * 2 + width * 6)); + rgbhit = paletted_pixels + (size_t)width * (size_t)height; + memset(rgbhit, 0, (size_t)(maxcolors * 2) + (size_t)width * 6); rgb2pal = rgbhit + maxcolors; marks = rgb2pal + maxcolors; output_count = 0; @@ -1540,6 +1540,22 @@ sixel_encode( goto end; } + if (width > SIXEL_WIDTH_LIMIT) { + sixel_helper_set_additional_message( + "sixel_encode: bad width parameter." + " (width > SIXEL_WIDTH_LIMIT)"); + status = SIXEL_BAD_INPUT; + goto end; + } + + if (height > SIXEL_HEIGHT_LIMIT) { + sixel_helper_set_additional_message( + "sixel_encode: bad height parameter." + " (height > SIXEL_HEIGHT_LIMIT)"); + status = SIXEL_BAD_INPUT; + goto end; + } + if (dither->quality_mode == SIXEL_QUALITY_HIGHCOLOR) { status = sixel_encode_highcolor(pixels, width, height, dither, output); ++++++ CVE-2026-44637.patch ++++++ Fix signed integer overflow in width/height doubling loop The decoder doubles sx and sy (both int) without any check. context->pos_x grows by repeat_count per sixel character with no upper bound. After enough sixel characters pos_x can approach INT_MAX, and the expression "pos_x + repeat_count" then overflows (signed int, undefined behavior). The expected guard is the resize check that follows the loop, and image_buffer_resize rejects values above SIXEL_WIDTH_LIMIT. However, after signed int overflow sx may wrap to a value smaller than image->width, so the resize is skipped. The pos calculation that follows then runs with a large pos_x and writes past the end of image->data with an attacker-influenced offset. Reject pos_x and pos_y that exceed the existing size limits before they enter the arithmetic. With pos_x bounded by SIXEL_WIDTH_LIMIT (1000000) and repeat_count bounded by 0xffff, the addition stays well within int range. --- src/fromsixel.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/fromsixel.c b/src/fromsixel.c --- a/src/fromsixel.c +++ b/src/fromsixel.c @@ -632,6 +632,16 @@ sixel_decode_raw_impl( default: if (*p >= '?' && *p <= '~') { /* sixel characters */ + /* reject pos_x / pos_y that would overflow int when + * combined with repeat_count (<= 0xffff) or 6 below */ + if (context->pos_x < 0 + || context->pos_x >= SIXEL_WIDTH_LIMIT + || context->pos_y < 0 + || context->pos_y >= SIXEL_HEIGHT_LIMIT) { + status = SIXEL_BAD_INPUT; + goto end; + } + sx = image->width; while (sx < context->pos_x + context->repeat_count) { sx *= 2; ++++++ CVE-2026-44638.patch ++++++ Fix wrong NULL check after malloc in sixel_decode_raw and sixel_decode The allocation result is stored into *palette, but the code then checks the wrong pointer. palette is the unsigned char ** parameter and is always non-NULL when the function is called. The check should be on *palette, which is what the malloc returned. If sixel_allocator_malloc returns NULL, the check passes, and the loop that follows dereferences *palette, crashing the process. Also fix typo "sixel_deocde_raw" in the error messages. --- src/fromsixel.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/fromsixel.c b/src/fromsixel.c --- a/src/fromsixel.c +++ b/src/fromsixel.c @@ -992,10 +992,10 @@ sixel_decode_raw( alloc_size = SIXEL_PALETTE_MAX; } *palette = (unsigned char *)sixel_allocator_malloc(allocator, (size_t)(alloc_size * 3)); - if (palette == NULL) { + if (*palette == NULL) { sixel_allocator_free(allocator, image.data); sixel_helper_set_additional_message( - "sixel_deocde_raw: sixel_allocator_malloc() failed."); + "sixel_decode_raw: sixel_allocator_malloc() failed."); status = SIXEL_BAD_ALLOCATION; goto error; } @@ -1064,10 +1064,10 @@ sixel_decode(unsigned char /* in */ *p, /* sixel bytes */ *ncolors = image.ncolors + 1; *palette = (unsigned char *)sixel_allocator_malloc(allocator, (size_t)(*ncolors * 3)); - if (palette == NULL) { + if (*palette == NULL) { sixel_allocator_free(allocator, image.data); sixel_helper_set_additional_message( - "sixel_deocde_raw: sixel_allocator_malloc() failed."); + "sixel_decode: sixel_allocator_malloc() failed."); status = SIXEL_BAD_ALLOCATION; goto end; }
