Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsndfile for openSUSE:Factory checked in at 2026-11-11 16:23:44 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsndfile (Old) and /work/SRC/openSUSE:Factory/.libsndfile.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsndfile" Wed Nov 11 16:23:44 2026 rev:73 rq:1396516 version:1.2.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libsndfile/libsndfile-progs.changes 2026-11-08 19:21:27.185558828 +0100 +++ /work/SRC/openSUSE:Factory/.libsndfile.new.3759290/libsndfile-progs.changes 2026-11-11 16:23:47.914018916 +0100 @@ -1,0 +2,6 @@ +Tue Nov 10 13:40:45 UTC 2026 - Takashi Iwai <[email protected]> + +- Replace the fix for CVE-2026-88372 with the upstream version: + libsndfile-CVE-2026-88372.patch + +------------------------------------------------------------------- libsndfile.changes: same change ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ libsndfile.spec: same change ++++++ libsndfile-CVE-2026-88372.patch ++++++ --- /var/tmp/diff_new_pack.892YcM/_old 2026-11-11 16:23:50.076109600 +0100 +++ /var/tmp/diff_new_pack.892YcM/_new 2026-11-11 16:23:50.080109768 +0100 @@ -1,35 +1,89 @@ -From b2fc0c9deec009849386ca6c0619ffca78ec3e81 Mon Sep 17 00:00:00 2001 -From: iliasabk <[email protected]> -Date: Fri, 18 Sep 2026 02:43:38 +0200 -Subject: [PATCH] mat4: reject negative matrix dimensions in mat4_read_header. - -Rows and cols from the file header were only checked for rows == 0 -and rows > SF_MAX_CHANNELS. Negative values passed through and were -stored as sf.channels / sf.frames, so the product -channels * frames * bytewidth could overflow sf_count_t -(e.g. -2071690108 * -2071690108 * 8), and signed overflow made the -truncation/dataend/datalength math undefined. +From c3faa5bbebd39d58966620e67814af89f6698f31 Mon Sep 17 00:00:00 2001 +From: iceray-Li <[email protected]> +Date: Tue, 22 Sep 2026 06:02:13 +0000 +Subject: [PATCH] mat4: reject negative channel counts and size the payload + safely -Reject rows < 0 and cols < 0 with SFE_CHANNEL_COUNT_BAD. +mat4_read_header() takes the channel count and the frame count straight from +the file and uses them to compare the header against the file length: -Fixes #1151. + if ((psf->filelength - psf->dataoffset) < psf->sf.channels * psf->sf.frames * psf->bytewidth) + +The channel count is only checked with + + if (rows == 0) ... else if (rows > SF_MAX_CHANNELS) ... + +so a negative value read from the file passes both checks. With channels and +frames both coming from 32 bit header fields the product can then exceed the +range of sf_count_t: + + src/mat4.c:318:78: runtime error: signed integer overflow: + -3458764462280933376 * 8 cannot be represented in type 'long' + +Reject a negative channel count the same way the other format handlers do, and +compute the expected payload size once into an sf_count_t so that the +comparison and the dataend calculation cannot disagree with each other. With +the channel count limited to [1, SF_MAX_CHANNELS] the multiplication is +bounded by 1024 * 2^31 * 8 and cannot overflow. + +Tested with ossfuzz/sndfile_alt_fuzzer and ossfuzz/sndfile_fuzzer built with +-fsanitize=address,undefined: the crafted MAT4 inputs abort at src/mat4.c:318 +before the change and open cleanly after it. --- - src/mat4.c | 4 ++++ - 1 file changed, 4 insertions(+) + src/mat4.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/src/mat4.c b/src/mat4.c -index 9f046f0c6..7a459df79 100644 +index 9f046f0c6a2b..0a34704f294f 100644 --- a/src/mat4.c +++ b/src/mat4.c -@@ -276,6 +276,10 @@ mat4_read_header (SF_PRIVATE *psf) +@@ -206,6 +206,7 @@ mat4_read_header (SF_PRIVATE *psf) + { char buffer [256] ; + uint32_t marker, namesize ; + int rows, cols, imag ; ++ sf_count_t datasize ; + double value ; + const char *marker_str ; + char name [64] ; +@@ -276,6 +277,10 @@ mat4_read_header (SF_PRIVATE *psf) { psf_log_printf (psf, "*** Error : zero channel count.\n") ; return SFE_CHANNEL_COUNT_ZERO ; } -+ else if (rows < 0 || cols < 0) -+ { psf_log_printf (psf, "*** Error : bad matrix dimensions %d x %d.\n", rows, cols) ; ++ else if (rows < 0) ++ { psf_log_printf (psf, "*** Error : negative channel count %d.\n", rows) ; + return SFE_CHANNEL_COUNT_BAD ; + } else if (rows > SF_MAX_CHANNELS) { psf_log_printf (psf, "*** Error : channel count %d > SF_MAX_CHANNELS.\n", rows) ; return SFE_CHANNEL_COUNT ; +@@ -315,12 +320,17 @@ mat4_read_header (SF_PRIVATE *psf) + return SFE_UNIMPLEMENTED ; + } ; + +- if ((psf->filelength - psf->dataoffset) < psf->sf.channels * psf->sf.frames * psf->bytewidth) ++ /* rows and cols are 32 bit values taken from the file. Now that rows has ++ ** been checked to be in the range [1, SF_MAX_CHANNELS] the product cannot ++ ** overflow sf_count_t. */ ++ datasize = (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ; ++ ++ if ((psf->filelength - psf->dataoffset) < datasize) + { psf_log_printf (psf, "*** File seems to be truncated. %D <--> %D\n", +- psf->filelength - psf->dataoffset, psf->sf.channels * psf->sf.frames * psf->bytewidth) ; ++ psf->filelength - psf->dataoffset, datasize) ; + } +- else if ((psf->filelength - psf->dataoffset) > psf->sf.channels * psf->sf.frames * psf->bytewidth) +- psf->dataend = psf->dataoffset + (sf_count_t) rows * (sf_count_t) cols * psf->bytewidth ; ++ else if ((psf->filelength - psf->dataoffset) > datasize) ++ psf->dataend = psf->dataoffset + datasize ; + + psf->datalength = psf->filelength - psf->dataoffset - psf->dataend ; + +@@ -388,4 +398,3 @@ mat4_marker_to_str (int marker) + snprintf (str, sizeof (str) - 1, "%08X", marker) ; + return str ; + } /* mat4_marker_to_str */ +- +-- +2.53.0 +
