Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package libsidplayfp for openSUSE:Factory checked in at 2026-10-26 10:01:52 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libsidplayfp (Old) and /work/SRC/openSUSE:Factory/.libsidplayfp.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libsidplayfp" Mon Oct 26 10:01:52 2026 rev:33 rq:1392492 version:3.1.2 Changes: -------- --- /work/SRC/openSUSE:Factory/libsidplayfp/libsidplayfp.changes 2026-08-30 19:08:52.662420239 +0200 +++ /work/SRC/openSUSE:Factory/.libsidplayfp.new.2252680/libsidplayfp.changes 2026-10-26 10:03:09.402651231 +0100 @@ -1,0 +2,6 @@ +Sun Oct 25 17:02:53 UTC 2026 - Илья Индиго <[email protected]> + +- Updated to 3.1.2 + * https://github.com/libsidplayfp/libsidplayfp/releases/tag/v3.1.2 + +------------------------------------------------------------------- Old: ---- libsidplayfp-3.1.1.tar.gz New: ---- libsidplayfp-3.1.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libsidplayfp.spec ++++++ --- /var/tmp/diff_new_pack.cr2GKN/_old 2026-10-26 10:03:10.294688640 +0100 +++ /var/tmp/diff_new_pack.cr2GKN/_new 2026-10-26 10:03:10.296688724 +0100 @@ -19,7 +19,7 @@ %define soname 7 %define stilview_soname 0 Name: libsidplayfp -Version: 3.1.1 +Version: 3.1.2 Release: 0 Summary: A library to play Commodore 64 music License: GPL-2.0-or-later ++++++ libsidplayfp-3.1.1.tar.gz -> libsidplayfp-3.1.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libsidplayfp-3.1.1/NEWS.md new/libsidplayfp-3.1.2/NEWS.md --- old/libsidplayfp-3.1.1/NEWS.md 2026-08-30 16:56:45.000000000 +0200 +++ new/libsidplayfp-3.1.2/NEWS.md 2026-10-25 14:11:09.000000000 +0100 @@ -1,3 +1,7 @@ +3.1.2 2026-10-25 +* Fixed possible out-of-bounds read (#280) - CVE-2026-111148 + + 3.1.1 2026-08-30 * USBSID-Pico: Fix issue in reset and delay routine * Fixed serial port for test sdr-icr-test2-0_7f diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libsidplayfp-3.1.1/configure new/libsidplayfp-3.1.2/configure --- old/libsidplayfp-3.1.1/configure 2026-08-30 16:56:52.000000000 +0200 +++ new/libsidplayfp-3.1.2/configure 2026-10-25 14:11:14.000000000 +0100 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for libsidplayfp 3.1.1. +# Generated by GNU Autoconf 2.71 for libsidplayfp 3.1.2. # # # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, @@ -618,8 +618,8 @@ # Identity of this package. PACKAGE_NAME='libsidplayfp' PACKAGE_TARNAME='libsidplayfp' -PACKAGE_VERSION='3.1.1' -PACKAGE_STRING='libsidplayfp 3.1.1' +PACKAGE_VERSION='3.1.2' +PACKAGE_STRING='libsidplayfp 3.1.2' PACKAGE_BUGREPORT='' PACKAGE_URL='https://github.com/libsidplayfp/libsidplayfp/' @@ -1430,7 +1430,7 @@ # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures libsidplayfp 3.1.1 to adapt to many kinds of systems. +\`configure' configures libsidplayfp 3.1.2 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1501,7 +1501,7 @@ if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of libsidplayfp 3.1.1:";; + short | recursive ) echo "Configuration of libsidplayfp 3.1.2:";; esac cat <<\_ACEOF @@ -1641,7 +1641,7 @@ test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -libsidplayfp configure 3.1.1 +libsidplayfp configure 3.1.2 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2457,7 +2457,7 @@ This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by libsidplayfp $as_me 3.1.1, which was +It was created by libsidplayfp $as_me 3.1.2, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -3947,7 +3947,7 @@ # Define the identity of the package. PACKAGE='libsidplayfp' - VERSION='3.1.1' + VERSION='3.1.2' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -4053,7 +4053,7 @@ LIB_MAJOR=3 LIB_MINOR=1 -LIB_LEVEL=1 +LIB_LEVEL=2 @@ -22012,7 +22012,7 @@ # If any interfaces have been removed or changed since the last public release, then set age to 0. LIBSIDPLAYCUR=15 -LIBSIDPLAYREV=1 +LIBSIDPLAYREV=2 LIBSIDPLAYAGE=8 LIBSIDPLAYVERSION=$LIBSIDPLAYCUR:$LIBSIDPLAYREV:$LIBSIDPLAYAGE @@ -24571,7 +24571,7 @@ # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by libsidplayfp $as_me 3.1.1, which was +This file was extended by libsidplayfp $as_me 3.1.2, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -24640,7 +24640,7 @@ cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -libsidplayfp config.status 3.1.1 +libsidplayfp config.status 3.1.2 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libsidplayfp-3.1.1/configure.ac new/libsidplayfp-3.1.2/configure.ac --- old/libsidplayfp-3.1.1/configure.ac 2026-08-30 16:56:45.000000000 +0200 +++ new/libsidplayfp-3.1.2/configure.ac 2026-10-25 14:11:09.000000000 +0100 @@ -1,6 +1,6 @@ m4_define([lib_major], [3]) m4_define([lib_minor], [1]) -m4_define([lib_level], [1]) +m4_define([lib_level], [2]) m4_define([lib_version], [lib_major.lib_minor.lib_level]) AC_PREREQ([2.62]) @@ -106,7 +106,7 @@ # If any interfaces have been removed or changed since the last public release, then set age to 0. LIBSIDPLAYCUR=15 -LIBSIDPLAYREV=1 +LIBSIDPLAYREV=2 LIBSIDPLAYAGE=8 LIBSIDPLAYVERSION=$LIBSIDPLAYCUR:$LIBSIDPLAYREV:$LIBSIDPLAYAGE diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libsidplayfp-3.1.1/src/sidtune/SidTuneBase.cpp new/libsidplayfp-3.1.2/src/sidtune/SidTuneBase.cpp --- old/libsidplayfp-3.1.1/src/sidtune/SidTuneBase.cpp 2026-08-30 16:56:45.000000000 +0200 +++ new/libsidplayfp-3.1.2/src/sidtune/SidTuneBase.cpp 2026-10-25 14:11:09.000000000 +0100 @@ -276,6 +276,10 @@ info->m_infoFileName = std::string(infoFileName + fileNamePos); } + // Check that offset is inside file limits + if (m_fileOffset > buf.size()) + throw loadError(ERR_TRUNCATED); + // Fix bad sidtune set up. if (info->m_songs > MAX_SONGS) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/libsidplayfp-3.1.1/tests/TestPSID.cpp new/libsidplayfp-3.1.2/tests/TestPSID.cpp --- old/libsidplayfp-3.1.1/tests/TestPSID.cpp 2026-08-30 16:56:45.000000000 +0200 +++ new/libsidplayfp-3.1.2/tests/TestPSID.cpp 2026-10-25 14:11:09.000000000 +0100 @@ -51,7 +51,7 @@ using namespace UnitTest; uint8_t const bufferRSID[BUFFERSIZE] = { - 0x52, 0x53, 0x49, 0x44, // magicID + 0x52, 0x53, 0x49, 0x44, // magicID (RSID) 0x00, 0x02, // version 0x00, 0x7C, // dataOffset 0x00, 0x00, // loadAddress @@ -345,4 +345,20 @@ CHECK_EQUAL(0, tune.getInfo()->sidChipBase(2)); } +/* + * Data offset must not exceed file size. + * CVE-2026-111148 + */ +TEST_FIXTURE(TestFixture, TestBadDaatOffset) +{ + data[DATAOFFSET_HI] = 0x7c; + data[DATAOFFSET_LO] = 0x00; + data[SONGS_LO] = 0x00; + + SidTune tune(data, BUFFERSIZE); + CHECK(!tune.getStatus()); + + CHECK_EQUAL("SIDTUNE ERROR: File is most likely truncated", tune.statusString()); +} + }
