Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package inih for openSUSE:Factory checked in at 2026-11-05 18:27:57 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/inih (Old) and /work/SRC/openSUSE:Factory/.inih.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "inih" Thu Nov 5 18:27:57 2026 rev:12 rq:1394761 version:63 Changes: -------- --- /work/SRC/openSUSE:Factory/inih/inih.changes 2025-09-14 18:50:09.862068627 +0200 +++ /work/SRC/openSUSE:Factory/.inih.new.3759290/inih.changes 2026-11-05 18:27:58.925876923 +0100 @@ -1,0 +2,11 @@ +Tue Nov 3 12:00:47 UTC 2026 - Anthony Iliopoulos <[email protected]> + +- Update to version 63 (CVE-2025-71450 bsc#1289163) + * Report file read errors + * Normalize CR LF line endings to just LF in test file + * Fix multiline continuation names after no-value keys + * Expose INI_MAX_SECTION and INI_MAX_NAME in ini.h + * Assert on NULL arguments + * Bug Fix: OOB Read in ini_parse_stream() + +------------------------------------------------------------------- Old: ---- inih-r62.tar.gz New: ---- inih-r63.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ inih.spec ++++++ --- /var/tmp/diff_new_pack.omzUku/_old 2026-11-05 18:27:59.660907487 +0100 +++ /var/tmp/diff_new_pack.omzUku/_new 2026-11-05 18:27:59.663907612 +0100 @@ -1,7 +1,7 @@ # # spec file for package inih # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # Copyright (c) 2020 Matthias Bach <[email protected]> # # All modifications and additions to the file contributed by third parties @@ -18,7 +18,7 @@ Name: inih -Version: 62 +Version: 63 Release: 0 Summary: Simple .INI file parser in C, good for embedded systems License: BSD-3-Clause ++++++ inih-r62.tar.gz -> inih-r63.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/README.md new/inih-r63/README.md --- old/inih-r62/README.md 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/README.md 2026-11-01 21:35:31.000000000 +0100 @@ -33,6 +33,7 @@ * **Stack vs heap:** By default, inih creates a fixed-sized line buffer on the stack. To allocate on the heap using `malloc` instead, specify `-DINI_USE_STACK=0`. * **Maximum line length:** The default maximum line length (for stack or heap) is 200 bytes. To override this, add something like `-DINI_MAX_LINE=1000`. Note that `INI_MAX_LINE` must be 3 more than the longest line (due to `\r`, `\n`, and the NUL). + * **Maximum section and name length:** Section names and property names are stored in fixed-size buffers of `INI_MAX_SECTION` and `INI_MAX_NAME` bytes respectively (both default to 50, including the NUL). Longer names are silently truncated. To override, add something like `-DINI_MAX_SECTION=256` or `-DINI_MAX_NAME=256`. Both values are exposed in `ini.h`. * **Initial malloc size:** `INI_INITIAL_ALLOC` specifies the initial malloc size when using the heap. It defaults to 200 bytes. * **Allow realloc:** By default when using the heap (`-DINI_USE_STACK=0`), inih allocates a fixed-sized buffer of `INI_INITIAL_ALLOC` bytes. To allow this to grow to `INI_MAX_LINE` bytes, doubling if needed, set `-DINI_ALLOW_REALLOC=1`. * **Custom allocator:** By default when using the heap, the standard library's `malloc`, `free`, and `realloc` functions are used; to use a custom allocator, specify `-DINI_CUSTOM_ALLOCATOR=1` (and `-DINI_USE_STACK=0`). You must define and link functions named `ini_malloc`, `ini_free`, and (if `INI_ALLOW_REALLOC` is set) `ini_realloc`, which must have the same signatures as the `stdlib.h` memory allocation functions. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/cpp/INIReader.cpp new/inih-r63/cpp/INIReader.cpp --- old/inih-r62/cpp/INIReader.cpp 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/cpp/INIReader.cpp 2026-11-01 21:35:31.000000000 +0100 @@ -44,6 +44,9 @@ // If _error is negative it is a system type error, and 0 means success. switch (_error) { + case -3: + return "unable to read file"; + case -2: return "unable to allocate memory"; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/cpp/INIReader.h new/inih-r63/cpp/INIReader.h --- old/inih-r62/cpp/INIReader.h 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/cpp/INIReader.h 2026-11-01 21:35:31.000000000 +0100 @@ -53,8 +53,8 @@ INI_API explicit INIReader(const char *buffer, size_t buffer_size); // Return the result of ini_parse(), i.e., 0 on success, line number of - // first error on parse error, -1 on file open error, or -2 if there was a - // memory allocation error. + // first error on parse error, -1 on file open error, -2 if there was a + // memory allocation error, or -3 on file read error. INI_API int ParseError() const; // Return a message that describes the type of error that occurred. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/ini.c new/inih-r63/ini.c --- old/inih-r62/ini.c 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/ini.c 2026-11-01 21:35:31.000000000 +0100 @@ -18,6 +18,7 @@ #include <stdio.h> #include <ctype.h> #include <string.h> +#include <assert.h> #include "ini.h" @@ -35,9 +36,6 @@ #endif #endif -#define MAX_SECTION 50 -#define MAX_NAME 50 - /* Used by ini_parse_string() to keep track of string parsing state. */ typedef struct { const char* ptr; @@ -108,9 +106,9 @@ #if INI_ALLOW_REALLOC && !INI_USE_STACK char* new_line; #endif - char section[MAX_SECTION] = ""; + char section[INI_MAX_SECTION] = ""; #if INI_ALLOW_MULTILINE - char prev_name[MAX_NAME] = ""; + char prev_name[INI_MAX_NAME] = ""; #endif size_t offset; @@ -121,6 +119,11 @@ int lineno = 0; int error = 0; char abyss[16]; /* Used to consume input when a line is too long. */ + size_t abyss_len; + + assert(reader != NULL); + assert(stream != NULL); + assert(handler != NULL); #if !INI_USE_STACK line = (char*)ini_malloc(INI_INITIAL_ALLOC); @@ -164,7 +167,8 @@ while (reader(abyss, sizeof(abyss), stream) != NULL) { if (!error) error = lineno; - if (abyss[strlen(abyss) - 1] == '\n') + abyss_len = strlen(abyss); + if (abyss_len > 0 && abyss[abyss_len - 1] == '\n') break; } } @@ -240,6 +244,9 @@ #if INI_ALLOW_NO_VALUE *end = '\0'; name = ini_rstrip(start, end); +#if INI_ALLOW_MULTILINE + ini_strncpy0(prev_name, name, sizeof(prev_name)); +#endif if (!HANDLER(user, section, name, NULL) && !error) error = lineno; #else @@ -265,7 +272,8 @@ /* See documentation in header file. */ int ini_parse_file(FILE* file, ini_handler handler, void* user) { - return ini_parse_stream((ini_reader)fgets, file, handler, user); + int error = ini_parse_stream((ini_reader)fgets, file, handler, user); + return ferror(file) ? -3 : error; } /* See documentation in header file. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/ini.h new/inih-r63/ini.h --- old/inih-r62/ini.h 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/ini.h 2026-11-01 21:35:31.000000000 +0100 @@ -76,8 +76,8 @@ of handler call). Handler should return nonzero on success, zero on error. Returns 0 on success, line number of first error on parse error (doesn't - stop on first error), -1 on file open error, or -2 on memory allocation - error (only when INI_USE_STACK is zero). + stop on first error), -1 on file open error, -2 on memory allocation error + (only when INI_USE_STACK is zero), or -3 on file read error. */ INI_API int ini_parse(const char* filename, ini_handler handler, void* user); @@ -141,6 +141,20 @@ #define INI_MAX_LINE 200 #endif +/* Maximum size in bytes, including the NUL terminator, of a "[section]" name. + A longer name is silently truncated to fit, so a caller that cannot tolerate + truncation must size this above its longest valid name and reject a name + whose length reaches INI_MAX_SECTION - 1. */ +#ifndef INI_MAX_SECTION +#define INI_MAX_SECTION 50 +#endif + +/* Maximum size in bytes, including the NUL terminator, of a "name" in a + name=value pair. Longer names are truncated as above. */ +#ifndef INI_MAX_NAME +#define INI_MAX_NAME 50 +#endif + /* Nonzero to allow heap line buffer to grow via realloc(), zero for a fixed-size buffer of INI_MAX_LINE bytes. Only applies if INI_USE_STACK is zero. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/meson.build new/inih-r63/meson.build --- old/inih-r62/meson.build 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/meson.build 2026-11-01 21:35:31.000000000 +0100 @@ -1,7 +1,7 @@ project('inih', ['c'], license : 'BSD-3-Clause', - version : '62', + version : '63', default_options : ['cpp_std=c++11'], meson_version: '>=0.56.0' ) @@ -50,6 +50,14 @@ if max_line_length != 200 arg_static += ['-DINI_MAX_LINE=' + max_line_length.to_string()] endif + max_section_length = get_option('max_section_length') + if max_section_length != 50 + arg_static += ['-DINI_MAX_SECTION=' + max_section_length.to_string()] + endif + max_name_length = get_option('max_name_length') + if max_name_length != 50 + arg_static += ['-DINI_MAX_NAME=' + max_name_length.to_string()] + endif initial_malloc_size = get_option('initial_malloc_size') if initial_malloc_size != 200 arg_static += ['-DINI_INITIAL_ALLOC=' + initial_malloc_size.to_string()] @@ -74,12 +82,20 @@ src_inih = files('ini.c') +# Android packages shared libraries without the versioned filenames Meson +# normally creates for soversion. Keep the ABI version on other platforms. +if host_machine.system() == 'android' + library_kwargs = {} +else + library_kwargs = {'soversion': '0'} +endif + lib_inih = library('inih', [src_inih], include_directories : inc_inih, c_args : [arg_static, extra_args], install : distro_install, - soversion : '0', + kwargs : library_kwargs, gnu_symbol_visibility: 'hidden' ) @@ -119,7 +135,7 @@ include_directories : inc_INIReader, dependencies : inih_dep, install : distro_install, - soversion : '0', + kwargs : library_kwargs, gnu_symbol_visibility: 'hidden' ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/meson_options.txt new/inih-r63/meson_options.txt --- old/inih-r62/meson_options.txt 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/meson_options.txt 2026-11-01 21:35:31.000000000 +0100 @@ -63,6 +63,16 @@ value : 200, description : 'maximum line length in bytes' ) +option('max_section_length', + type : 'integer', + value : 50, + description : 'size in bytes of the section name buffer, including the NUL terminator' +) +option('max_name_length', + type : 'integer', + value : 50, + description : 'size in bytes of the property name buffer, including the NUL terminator' +) option('initial_malloc_size', type : 'integer', value : 200, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/baseline_allow_no_value.txt new/inih-r63/tests/baseline_allow_no_value.txt --- old/inih-r62/tests/baseline_allow_no_value.txt 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/baseline_allow_no_value.txt 2026-11-01 21:35:31.000000000 +0100 @@ -64,6 +64,7 @@ ... [section_list] ... section0; ... section1; +... section1=continued; ... [section0] ... key0=val0; ... [section1] diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/baseline_file_error.txt new/inih-r63/tests/baseline_file_error.txt --- old/inih-r62/tests/baseline_file_error.txt 1970-01-01 01:00:00.000000000 +0100 +++ new/inih-r63/tests/baseline_file_error.txt 2026-11-01 21:35:31.000000000 +0100 @@ -0,0 +1 @@ +read_error: e=-3 ferror=1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/baseline_handler_lineno.txt new/inih-r63/tests/baseline_handler_lineno.txt --- old/inih-r62/tests/baseline_handler_lineno.txt 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/baseline_handler_lineno.txt 2026-11-01 21:35:31.000000000 +0100 @@ -60,9 +60,9 @@ ... single2=qrs; line 6 duplicate_sections.ini: e=0 user=108 ... [section0] -... key0=val0; line 6 +... key0=val0; line 7 ... [section1] -... key1=val1; line 9 +... key1=val1; line 10 no_value.ini: e=2 user=109 ... [_123456789_123456789_123456789_123456789_12345678] ... name=value; line 3 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/meson.build new/inih-r63/tests/meson.build --- old/inih-r62/tests/meson.build 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/meson.build 2026-11-01 21:35:31.000000000 +0100 @@ -18,7 +18,8 @@ 'heap_string': { 'src': 'unittest_string.c', 'args': ['-DINI_USE_STACK=0', '-DINI_MAX_LINE=20', '-DINI_INITIAL_ALLOC=20'] }, 'call_handler_on_new_section': { 'args': ['-DINI_CALL_HANDLER_ON_NEW_SECTION=1'] }, 'allow_no_value': { 'args': ['-DINI_ALLOW_NO_VALUE=1'] }, - 'alloc': { 'src': 'unittest_alloc.c', 'args': ['-DINI_CUSTOM_ALLOCATOR=1', '-DINI_USE_STACK=0', '-DINI_ALLOW_REALLOC=1', '-DINI_INITIAL_ALLOC=12'] } + 'alloc': { 'src': 'unittest_alloc.c', 'args': ['-DINI_CUSTOM_ALLOCATOR=1', '-DINI_USE_STACK=0', '-DINI_ALLOW_REALLOC=1', '-DINI_INITIAL_ALLOC=12'] }, + 'file_error': { 'src': 'unittest_file_error.c', 'args': [] } } foreach name, properties : tests diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/no_value.ini new/inih-r63/tests/no_value.ini --- old/inih-r62/tests/no_value.ini 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/no_value.ini 2026-11-01 21:35:31.000000000 +0100 @@ -1,9 +1,10 @@ -[section_list] -section0 -section1 - -[section0] -key0=val0 - -[section1] -key1=val1 +[section_list] +section0 +section1 + continued + +[section0] +key0=val0 + +[section1] +key1=val1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/unittest.bat new/inih-r63/tests/unittest.bat --- old/inih-r62/tests/unittest.bat 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/unittest.bat 2026-11-01 21:35:31.000000000 +0100 @@ -12,3 +12,4 @@ @call tcc ..\ini.c -I..\ -DINI_CALL_HANDLER_ON_NEW_SECTION=1 -run unittest.c > baseline_call_handler_on_new_section.txt @call tcc ..\ini.c -I..\ -DINI_ALLOW_NO_VALUE=1 -run unittest.c > baseline_allow_no_value.txt @call tcc ..\ini.c -I..\ -DINI_CUSTOM_ALLOCATOR=1 -DINI_USE_STACK=0 -DINI_ALLOW_REALLOC=1 -DINI_INITIAL_ALLOC=12 -run unittest_alloc.c > baseline_alloc.txt +@call tcc ..\ini.c -I..\ -run unittest_file_error.c > baseline_file_error.txt diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/unittest.sh new/inih-r63/tests/unittest.sh --- old/inih-r62/tests/unittest.sh 2025-09-11 22:47:04.000000000 +0200 +++ new/inih-r63/tests/unittest.sh 2026-11-01 21:35:31.000000000 +0100 @@ -61,3 +61,7 @@ $CC -DINI_CUSTOM_ALLOCATOR=1 -DINI_USE_STACK=0 -DINI_ALLOW_REALLOC=1 -DINI_INITIAL_ALLOC=12 ../ini.c unittest_alloc.c -o unittest_alloc ./unittest_alloc > baseline_alloc.txt rm -f unittest_alloc + +$CC ../ini.c unittest_file_error.c -o unittest_file_error +./unittest_file_error > baseline_file_error.txt +rm -f unittest_file_error diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/inih-r62/tests/unittest_file_error.c new/inih-r63/tests/unittest_file_error.c --- old/inih-r62/tests/unittest_file_error.c 1970-01-01 01:00:00.000000000 +0100 +++ new/inih-r63/tests/unittest_file_error.c 2026-11-01 21:35:31.000000000 +0100 @@ -0,0 +1,41 @@ +/* inih -- tests for file read errors */ + +#include <stdio.h> +#ifdef _WIN32 +#include <io.h> +#include <fcntl.h> +#endif +#include "../ini.h" + +int handler(void* user, const char* section, const char* name, + const char* value) +{ + (void)user; + (void)section; + (void)name; + (void)value; + return 1; +} + +int main(void) +{ + const char* filename = "unittest_file_error.tmp"; + FILE* file; + int e; + +#ifdef _WIN32 + _setmode(_fileno(stdout), _O_BINARY); +#endif + + /* Reading from a write-only stream sets the stream's error indicator. */ + file = fopen(filename, "w"); + if (!file) { + printf("unable to open %s\n", filename); + return 1; + } + e = ini_parse_file(file, handler, NULL); + printf("read_error: e=%d ferror=%d\n", e, ferror(file) != 0); + fclose(file); + remove(filename); + return 0; +}
