Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libansilove for openSUSE:Factory checked in at 2026-11-04 19:44:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libansilove (Old) and /work/SRC/openSUSE:Factory/.libansilove.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libansilove" Wed Nov 4 19:44:37 2026 rev:19 rq:1394777 version:1.4.4 Changes: -------- --- /work/SRC/openSUSE:Factory/libansilove/libansilove.changes 2026-10-26 10:01:35.604717273 +0100 +++ /work/SRC/openSUSE:Factory/.libansilove.new.3759290/libansilove.changes 2026-11-04 19:44:57.274142189 +0100 @@ -1,0 +2,11 @@ +Mon Nov 2 15:38:52 UTC 2026 - Martin Hauke <[email protected]> + +- Update to version 1.4.4 + * Check if high_font_data_xbin is set rather than trusting the + xbin_flags data (CVE-2026-111144). + * Fix source files used by format fuzzers. + * Refactor the XBIN loader to use a common error label and fix + canvas memory leaks. + * Fix out-of-bounds reads in RLE decoder (CVE-2026-111143). + +------------------------------------------------------------------- @@ -6,3 +17,3 @@ - - Provide a compatibility fallback implementation for strndup. - - Document support for PabloDraw 24-bit ANSI sequences. - - Fix line wrapping when the cursor exceeds the column limit in + * Provide a compatibility fallback implementation for strndup. + * Document support for PabloDraw 24-bit ANSI sequences. + * Fix line wrapping when the cursor exceeds the column limit in @@ -10,2 +21,2 @@ - - Advance TAB to the next tab stop in ANSI and PCBoard loaders. - - Fix black background with the blink bit in BinaryText files + * Advance TAB to the next tab stop in ANSI and PCBoard loaders. + * Fix black background with the blink bit in BinaryText files @@ -18 +29 @@ - - Bump cmake_minimum_required to 3.5, to allow building with + * Bump cmake_minimum_required to 3.5, to allow building with @@ -20 +31 @@ - - Bump cmake_minimum_required to 3.10 to be more future proof. + * Bump cmake_minimum_required to 3.10 to be more future proof. Old: ---- libansilove-1.4.3.tar.gz New: ---- libansilove-1.4.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libansilove.spec ++++++ --- /var/tmp/diff_new_pack.y1WwmG/_old 2026-11-04 19:44:58.251183087 +0100 +++ /var/tmp/diff_new_pack.y1WwmG/_new 2026-11-04 19:44:58.254183212 +0100 @@ -20,7 +20,7 @@ %global sover 1 %global libname %{name}%{sover} Name: libansilove -Version: 1.4.3 +Version: 1.4.4 Release: 0 Summary: Library for converting ANSI, ASCII, and other formats to PNG License: BSD-2-Clause ++++++ libansilove-1.4.3.tar.gz -> libansilove-1.4.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/CMakeLists.txt new/libansilove-1.4.4/CMakeLists.txt --- old/libansilove-1.4.3/CMakeLists.txt 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/CMakeLists.txt 2026-11-02 01:05:22.000000000 +0100 @@ -2,7 +2,7 @@ set(LIB_VERSION_MAJOR 1) set(LIB_VERSION_MINOR 4) -set(LIB_VERSION_PATCH 3) +set(LIB_VERSION_PATCH 4) set(LIB_VERSION_STRING ${LIB_VERSION_MAJOR}.${LIB_VERSION_MINOR}.${LIB_VERSION_PATCH}) set(CMAKE_C_STANDARD 99) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/ChangeLog new/libansilove-1.4.4/ChangeLog --- old/libansilove-1.4.3/ChangeLog 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/ChangeLog 2026-11-02 01:05:22.000000000 +0100 @@ -1,3 +1,14 @@ +libansilove 1.4.4 (2026-11-02) + +- Check if high_font_data_xbin is set rather than trusting the xbin_flags + data (CVE-2026-111144, found by HaiND and reported by Alexander Shvedov) +- Fix source files used by format fuzzers +- Refactor the XBIN loader to use a common error label and fix canvas + memory leaks +- Fix out-of-bounds reads in RLE decoder (CVE-2026-111143, found by HaiND) + + + libansilove 1.4.3 (2026-10-21) - Update README to add a link to the Nix package diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/fuzz/CMakeLists.txt new/libansilove-1.4.4/fuzz/CMakeLists.txt --- old/libansilove-1.4.3/fuzz/CMakeLists.txt 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/fuzz/CMakeLists.txt 2026-11-02 01:05:22.000000000 +0100 @@ -23,12 +23,12 @@ add_definitions(-Wall -Wextra -pedantic -fsanitize=fuzzer) add_executable(ansi ${SRC_ANSI}) -add_executable(artworx ${SRC_ANSI}) +add_executable(artworx ${SRC_ARTWORX}) add_executable(binary ${SRC_BINARY}) -add_executable(icedraw ${SRC_BINARY}) -add_executable(pcboard ${SRC_BINARY}) -add_executable(tundra ${SRC_BINARY}) -add_executable(xbin ${SRC_BINARY}) +add_executable(icedraw ${SRC_ICEDRAW}) +add_executable(pcboard ${SRC_PCBOARD}) +add_executable(tundra ${SRC_TUNDRA}) +add_executable(xbin ${SRC_XBIN}) target_link_libraries(ansi ${ANSILOVE_LIBRARIES} -fsanitize=fuzzer) target_link_libraries(artworx ${ANSILOVE_LIBRARIES} -fsanitize=fuzzer) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/include/ansilove.h new/libansilove-1.4.4/include/ansilove.h --- old/libansilove-1.4.3/include/ansilove.h 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/include/ansilove.h 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * ansilove.h - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus @@ -28,11 +28,11 @@ #endif /* Version number */ -#define ANSILOVE_VERSION "1.4.3" +#define ANSILOVE_VERSION "1.4.4" #define ANSILOVE_VERSION_MAJOR 1 #define ANSILOVE_VERSION_MINOR 4 -#define ANSILOVE_VERSION_PATCH 3 +#define ANSILOVE_VERSION_PATCH 4 /* Error codes */ #define ANSILOVE_INVALID_PARAM 1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/libansilove.spec new/libansilove-1.4.4/libansilove.spec --- old/libansilove-1.4.3/libansilove.spec 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/libansilove.spec 2026-11-02 01:05:22.000000000 +0100 @@ -1,5 +1,5 @@ Name: libansilove -Version: 1.4.3 +Version: 1.4.4 Release: 1%{?dist} Summary: Library for converting ANSI, ASCII, and other formats to PNG diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/clean.c new/libansilove-1.4.4/src/clean.c --- old/libansilove-1.4.3/src/clean.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/clean.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * clean.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/config.h new/libansilove-1.4.4/src/config.h --- old/libansilove-1.4.3/src/config.h 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/config.h 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * config.h - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/drawchar.c new/libansilove-1.4.4/src/drawchar.c --- old/libansilove-1.4.3/src/drawchar.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/drawchar.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * drawchar.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/drawchar.h new/libansilove-1.4.4/src/drawchar.h --- old/libansilove-1.4.3/src/drawchar.h 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/drawchar.h 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * drawchar.h - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/error.c new/libansilove-1.4.4/src/error.c --- old/libansilove-1.4.3/src/error.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/error.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * error.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/fonts.c new/libansilove-1.4.4/src/fonts.c --- old/libansilove-1.4.3/src/fonts.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/fonts.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * fonts.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/fonts.h new/libansilove-1.4.4/src/fonts.h --- old/libansilove-1.4.3/src/fonts.h 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/fonts.h 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * fonts.h - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/init.c new/libansilove-1.4.4/src/init.c --- old/libansilove-1.4.3/src/init.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/init.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * init.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/ansi.c new/libansilove-1.4.4/src/loaders/ansi.c --- old/libansilove-1.4.3/src/loaders/ansi.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/ansi.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * ansi.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/artworx.c new/libansilove-1.4.4/src/loaders/artworx.c --- old/libansilove-1.4.3/src/loaders/artworx.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/artworx.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * artworx.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/binary.c new/libansilove-1.4.4/src/loaders/binary.c --- old/libansilove-1.4.3/src/loaders/binary.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/binary.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * binary.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/icedraw.c new/libansilove-1.4.4/src/loaders/icedraw.c --- old/libansilove-1.4.3/src/loaders/icedraw.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/icedraw.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * icedraw.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/pcboard.c new/libansilove-1.4.4/src/loaders/pcboard.c --- old/libansilove-1.4.3/src/loaders/pcboard.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/pcboard.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * pcboard.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/tundra.c new/libansilove-1.4.4/src/loaders/tundra.c --- old/libansilove-1.4.3/src/loaders/tundra.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/tundra.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * tundra.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loaders/xbin.c new/libansilove-1.4.4/src/loaders/xbin.c --- old/libansilove-1.4.3/src/loaders/xbin.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loaders/xbin.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * xbin.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus @@ -96,7 +96,7 @@ if (offset + XBIN_PALETTE_LENGTH > ctx->length) { ctx->error = ANSILOVE_FORMAT_ERROR; - return -1; + goto error; } for (loop = 0; loop < 16; loop++) { @@ -122,14 +122,14 @@ if (offset + fontsz > ctx->length) { ctx->error = ANSILOVE_FORMAT_ERROR; - return -1; + goto error; } /* allocate memory to contain the XBin font */ font_data_xbin = (uint8_t *)malloc(fontsz); if (font_data_xbin == NULL) { ctx->error = ANSILOVE_MEMORY_ERROR; - return -1; + goto error; } memcpy(font_data_xbin, ctx->buffer+offset, fontsz); @@ -142,16 +142,14 @@ if (xbin_flags & 0x10) { if (offset + fontsz > ctx->length) { ctx->error = ANSILOVE_FORMAT_ERROR; - free(font_data_xbin); - return -1; + goto error; } /* allocate memory to contain the XBin font */ high_font_data_xbin = (uint8_t *)malloc(fontsz); if (high_font_data_xbin == NULL) { ctx->error = ANSILOVE_MEMORY_ERROR; - free(font_data_xbin); - return -1; + goto error; } memcpy(high_font_data_xbin, ctx->buffer+offset, fontsz); @@ -184,13 +182,16 @@ offset += 2; } else { ctx->error = ANSILOVE_FORMAT_ERROR; - free(font_data_xbin); - free(high_font_data_xbin); - return -1; + goto error; } } /* char */ else if (ctype == 0x40) { + if (offset + (character == -1) + 1 > + ctx->length) { + ctx->error = ANSILOVE_FORMAT_ERROR; + goto error; + } if (character == -1) { character = ctx->buffer[offset]; offset++; @@ -200,6 +201,11 @@ } /* attr */ else if (ctype == 0x80) { + if (offset + (attribute == -1) + 1 > + ctx->length) { + ctx->error = ANSILOVE_FORMAT_ERROR; + goto error; + } if (attribute == -1) { attribute = ctx->buffer[offset]; offset++; @@ -209,6 +215,11 @@ } /* both */ else { + if (offset + (character == -1) + + (attribute == -1) > ctx->length) { + ctx->error = ANSILOVE_FORMAT_ERROR; + goto error; + } if (character == -1) { character = ctx->buffer[offset]; offset++; @@ -222,7 +233,7 @@ background = (attribute & 240) >> 4; foreground = attribute & 15; - if (xbin_flags & 0x10 && attribute & 8) { + if (high_font_data_xbin != NULL && attribute & 8) { drawchar(canvas, high_font_data_xbin, 8, xbin_fontsize, column, row, colors[background], colors[foreground], character); @@ -255,7 +266,7 @@ background = (attribute & 240) >> 4; foreground = attribute & 15; - if (xbin_flags & 0x10 && attribute & 8) { + if (high_font_data_xbin != NULL && attribute & 8) { drawchar(canvas, high_font_data_xbin, 8, xbin_fontsize, column, row, colors[background], colors[foreground], character); @@ -283,4 +294,10 @@ free(high_font_data_xbin); return 0; + +error: + gdImageDestroy(canvas); + free(font_data_xbin); + free(high_font_data_xbin); + return -1; } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/loadfile.c new/libansilove-1.4.4/src/loadfile.c --- old/libansilove-1.4.3/src/loadfile.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/loadfile.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * loadfile.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/output.c new/libansilove-1.4.4/src/output.c --- old/libansilove-1.4.3/src/output.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/output.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * output.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/output.h new/libansilove-1.4.4/src/output.h --- old/libansilove-1.4.3/src/output.h 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/output.h 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * output.h - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libansilove-1.4.3/src/savefile.c new/libansilove-1.4.4/src/savefile.c --- old/libansilove-1.4.3/src/savefile.c 2026-10-21 14:48:03.000000000 +0200 +++ new/libansilove-1.4.4/src/savefile.c 2026-11-02 01:05:22.000000000 +0100 @@ -1,6 +1,6 @@ /* * savefile.c - * libansilove 1.4.3 + * libansilove 1.4.4 * https://www.ansilove.org * * Copyright (c) 2011-2026 Stefan Vogt, Brian Cassidy, and Frederic Cambus
