Hello community, here is the log from the commit of package opus for openSUSE:Factory checked in at 2017-03-01 23:41:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/opus (Old) and /work/SRC/openSUSE:Factory/.opus.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "opus" Wed Mar 1 23:41:28 2017 rev:15 rq:460731 version:1.1.4 Changes: -------- --- /work/SRC/openSUSE:Factory/opus/opus.changes 2017-01-24 10:27:37.399561795 +0100 +++ /work/SRC/openSUSE:Factory/.opus.new/opus.changes 2017-03-01 23:41:29.743395452 +0100 @@ -1,0 +2,9 @@ +Sun Feb 26 23:08:38 UTC 2017 - [email protected] + +- Update to version 1.1.4 (CVE-2017-0381): + + A specially-crafted Opus packet could cause an integer + wrap-around in the SILK LSF stabilization code. This would + cause an out-of-bounds read 256 bytes before a constant table. +- Drop opus-NLSF-not-negative.patch: Fixed upstream. + +------------------------------------------------------------------- Old: ---- opus-1.1.3.tar.gz opus-NLSF-not-negative.patch New: ---- opus-1.1.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ opus.spec ++++++ --- /var/tmp/diff_new_pack.WAQ2u1/_old 2017-03-01 23:41:30.435297876 +0100 +++ /var/tmp/diff_new_pack.WAQ2u1/_new 2017-03-01 23:41:30.443296748 +0100 @@ -19,7 +19,7 @@ %define soname 0 Name: opus -Version: 1.1.3 +Version: 1.1.4 Release: 0 Summary: Opus Audio Codec Library License: BSD-3-Clause @@ -27,8 +27,6 @@ Url: http://opus-codec.org/ Source: http://downloads.xiph.org/releases/opus/%{name}-%{version}.tar.gz Source99: baselibs.conf -# PATCH-FIX-UPSTREAM opus-NLSF-not-negative.patch CVE-2017-0381 boo#1020102 [email protected] -- Ensure that NLSF cannot be negative when computing a min distance between them. -Patch0: opus-NLSF-not-negative.patch BuildRequires: pkg-config BuildRoot: %{_tmppath}/%{name}-%{version}-build @@ -68,7 +66,6 @@ %prep %setup -q -%patch0 -p1 %build %configure \ ++++++ opus-1.1.3.tar.gz -> opus-1.1.4.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/configure new/opus-1.1.4/configure --- old/opus-1.1.3/configure 2016-07-15 17:28:08.000000000 +0200 +++ new/opus-1.1.4/configure 2017-01-20 22:08:46.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for opus 1.1.3. +# Generated by GNU Autoconf 2.69 for opus 1.1.4. # # Report bugs to <[email protected]>. # @@ -590,8 +590,8 @@ # Identity of this package. PACKAGE_NAME='opus' PACKAGE_TARNAME='opus' -PACKAGE_VERSION='1.1.3' -PACKAGE_STRING='opus 1.1.3' +PACKAGE_VERSION='1.1.4' +PACKAGE_STRING='opus 1.1.4' PACKAGE_BUGREPORT='[email protected]' PACKAGE_URL='' @@ -1398,7 +1398,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures opus 1.1.3 to adapt to many kinds of systems. +\`configure' configures opus 1.1.4 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1468,7 +1468,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of opus 1.1.3:";; + short | recursive ) echo "Configuration of opus 1.1.4:";; esac cat <<\_ACEOF @@ -1619,7 +1619,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -opus configure 1.1.3 +opus configure 1.1.4 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -1988,7 +1988,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by opus $as_me 1.1.3, which was +It was created by opus $as_me 1.1.4, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2382,7 +2382,7 @@ # For libtool. OPUS_LT_CURRENT=5 -OPUS_LT_REVISION=3 +OPUS_LT_REVISION=4 OPUS_LT_AGE=5 @@ -2865,7 +2865,7 @@ # Define the identity of the package. PACKAGE='opus' - VERSION='1.1.3' + VERSION='1.1.4' # Some tools Automake needs. @@ -15265,7 +15265,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by opus $as_me 1.1.3, which was +This file was extended by opus $as_me 1.1.4, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -15331,7 +15331,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -opus config.status 1.1.3 +opus config.status 1.1.4 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/configure.ac new/opus-1.1.4/configure.ac --- old/opus-1.1.3/configure.ac 2016-07-15 17:28:06.000000000 +0200 +++ new/opus-1.1.4/configure.ac 2017-01-20 22:08:44.000000000 +0100 @@ -23,7 +23,7 @@ # For libtool. dnl Please update these for releases. OPUS_LT_CURRENT=5 -OPUS_LT_REVISION=3 +OPUS_LT_REVISION=4 OPUS_LT_AGE=5 AC_SUBST(OPUS_LT_CURRENT) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/doc/Makefile.in new/opus-1.1.4/doc/Makefile.in --- old/opus-1.1.3/doc/Makefile.in 2016-07-15 17:28:08.000000000 +0200 +++ new/opus-1.1.4/doc/Makefile.in 2017-01-20 22:08:45.000000000 +0100 @@ -391,8 +391,8 @@ maintainer-clean-generic: @echo "This command is intended for maintainers to use" @echo "it deletes files that may require special tools to rebuild." -@HAVE_DOXYGEN_FALSE@install-data-local: @HAVE_DOXYGEN_FALSE@clean-local: +@HAVE_DOXYGEN_FALSE@install-data-local: @HAVE_DOXYGEN_FALSE@uninstall-local: clean: clean-am diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/package_version new/opus-1.1.4/package_version --- old/opus-1.1.3/package_version 2016-07-15 21:05:13.000000000 +0200 +++ new/opus-1.1.4/package_version 2017-01-20 22:08:49.000000000 +0100 @@ -1 +1 @@ -PACKAGE_VERSION="1.1.3" +PACKAGE_VERSION="1.1.4" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/silk/NLSF_stabilize.c new/opus-1.1.4/silk/NLSF_stabilize.c --- old/opus-1.1.3/silk/NLSF_stabilize.c 2016-07-06 15:42:05.000000000 +0200 +++ new/opus-1.1.4/silk/NLSF_stabilize.c 2017-01-20 21:44:14.000000000 +0100 @@ -130,7 +130,7 @@ /* Keep delta_min distance between the NLSFs */ for( i = 1; i < L; i++ ) - NLSF_Q15[i] = silk_max_int( NLSF_Q15[i], NLSF_Q15[i-1] + NDeltaMin_Q15[i] ); + NLSF_Q15[i] = silk_max_int( NLSF_Q15[i], silk_ADD_SAT16( NLSF_Q15[i-1], NDeltaMin_Q15[i] ) ); /* Last NLSF should be no higher than 1 - NDeltaMin[L] */ NLSF_Q15[L-1] = silk_min_int( NLSF_Q15[L-1], (1<<15) - NDeltaMin_Q15[L] ); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/opus-1.1.3/version.mk new/opus-1.1.4/version.mk --- old/opus-1.1.3/version.mk 2016-07-08 20:21:01.000000000 +0200 +++ new/opus-1.1.4/version.mk 2017-01-20 21:46:21.000000000 +0100 @@ -1,2 +1,2 @@ # static version string; update manually every release. -PACKAGE_VERSION = "1.1.3" +PACKAGE_VERSION = "1.1.4"
