Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package laszip for openSUSE:Factory checked in at 2026-11-07 23:34:31 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/laszip (Old) and /work/SRC/openSUSE:Factory/.laszip.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "laszip" Sat Nov 7 23:34:31 2026 rev:9 rq:1396079 version:3.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/laszip/laszip.changes 2026-07-29 19:02:40.816743377 +0200 +++ /work/SRC/openSUSE:Factory/.laszip.new.3759290/laszip.changes 2026-11-07 23:36:02.799063052 +0100 @@ -1,0 +2,8 @@ +Sat Nov 7 18:41:33 UTC 2026 - Martin Pluskal <[email protected]> + +- Add laszip-truncated-vlr-count.patch (boo#1285759, + CVE-2026-110603): clamp an inflated VLR count to what fits + before the point block and zero the array so truncated reads + cannot leave uninitialized entries that crash the destroy path. + +------------------------------------------------------------------- New: ---- laszip-truncated-vlr-count.patch ----------(New B)---------- New: - Add laszip-truncated-vlr-count.patch (boo#1285759, CVE-2026-110603): clamp an inflated VLR count to what fits ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ laszip.spec ++++++ --- /var/tmp/diff_new_pack.HcoKuo/_old 2026-11-07 23:36:03.431089247 +0100 +++ /var/tmp/diff_new_pack.HcoKuo/_new 2026-11-07 23:36:03.433089330 +0100 @@ -27,6 +27,9 @@ # Upstream stopped attaching a release tarball (and its .sha256sum) at 3.5.0; # the git auto-archive is the only published artifact. Source0: https://github.com/LASzip/LASzip/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz +# Clamp inflated VLR count and zero the array (boo#1285759). +# PATCH-FIX-UPSTREAM laszip-truncated-vlr-count.patch -- boo#1285759 (CVE-2026-110603) +Patch0: laszip-truncated-vlr-count.patch BuildRequires: cmake BuildRequires: gcc-c++ ++++++ laszip-truncated-vlr-count.patch ++++++ A crafted LAS/LAZ file with an inflated number_of_variable_length_records allocates a VLR array the truncated header cannot fill; the read then fails but the partially-initialized entries (uninitialized .data pointers) crash laszip_destroy() through the C API (boo#1285759, CVE-2026-110603). Clamp the count to what fits before the point block (each VLR needs its 54-byte header) and zero the array so unread entries are destroy-safe. PATCH-FIX-UPSTREAM laszip-truncated-vlr-count.patch -- boo#1285759 (CVE-2026-110603) --- LASzip-3.5.0/src/laszip_dll.cpp 2025-12-08 17:36:04.000000000 +0100 +++ LASzip-3.5.0/src/laszip_dll.cpp 2026-11-07 19:41:16.629135783 +0100 @@ -3968,6 +3968,20 @@ { U32 i; + /* An inflated count on truncated VLR data would allocate an array the + reads below cannot fill, leaving uninitialized .data pointers that + crash the destroy path. Each VLR needs at least its 54-byte header + before the point block starts. */ + { + I32 bytes_until_point_block = (I32)laszip_dll->header.offset_to_point_data - (I32)laszip_dll->header.header_size; + U32 max_vlrs = (bytes_until_point_block >= 54 ? (U32)(bytes_until_point_block / 54) : 0); + if (laszip_dll->header.number_of_variable_length_records > max_vlrs) + { + snprintf(laszip_dll->warning, sizeof(laszip_dll->warning), "header.number_of_variable_length_records is %u but only %u vlrs fit before the point block. reading %u vlrs ...", laszip_dll->header.number_of_variable_length_records, max_vlrs, max_vlrs); + laszip_dll->header.number_of_variable_length_records = max_vlrs; + } + } + laszip_dll->header.vlrs = (laszip_vlr*)malloc_las(sizeof(laszip_vlr) * laszip_dll->header.number_of_variable_length_records); if (laszip_dll->header.vlrs == 0) @@ -3976,6 +3990,10 @@ return 1; } + /* Zero the array so entries the truncated reads below never reach stay + destroy-safe (NULL .data, zero length). */ + memset(laszip_dll->header.vlrs, 0, sizeof(laszip_vlr) * laszip_dll->header.number_of_variable_length_records); + for (i = 0; i < laszip_dll->header.number_of_variable_length_records; i++) { // make sure there are enough bytes left to read a variable length record before the point block starts
