Packman Build Service PMBS

File libde265.changes of Package libde265 (Revision 8cbadb16919fb35976400639eacb095d)

Currently displaying revision 8cbadb16919fb35976400639eacb095d , Show latest

-------------------------------------------------------------------
Tue Sep 15 10:26:14 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>

- Update to version 1.1.3:
  + This release completes high bit depth decoding (up to 16 bit)
    and repairs cross-component prediction, which had corrupted
    4:4:4 Range Extensions streams since v1.0.17. It is ABI- and
    API-compatible with v1.1.2 and a drop-in replacement; no
    functions or enum values were added.
  + High bit depth decoding:
    - Inter prediction above 12 bit was wrong from the first P/B
      picture on. The fractional sample interpolation used shift1 =
      BitDepth-8 instead of the Range Extensions' Min(4,
      BitDepth-8), and the intermediate prediction samples were
      kept in int16_t although they need max(14, BitDepth+2) bits.
      The 16-bit kernels are now templated on the intermediate
      sample type and use int32_t above 12 bit; 8- to 12-bit
      streams are unaffected and keep their SSE paths. Explicit
      weighted bi-prediction was broken in a second way: the
      shortcut for identical motion vectors checked
      weighted_pred_flag, which governs P slices, instead of
      weighted_bipred_flag.
    - Together with the fixes in v1.1.1 and v1.1.2 this completes
      high bit depth support. Output is bit-exact against the HM 18
      reference decoder at 10, 12, 13, 14 and 16 bit, for mixed
      luma/chroma bit depths and for 4:2:2, 4:4:4 and 4:0:0. Above
      12 bit motion compensation runs the scalar kernels; 8-bit
      performance is unchanged.
  + Range Extensions:
    - Cross-component prediction corrupted every chroma block it
      was applied to, a regression since v1.0.17. A cast added to
      silence undefined behaviour on a left shift turned the
      following arithmetic shift into a logical one, so every
      negative luma residual became a large positive value. This
      affects 4:4:4 streams only, but at every bit depth including
      8 bit.
    - cabac_bypass_alignment_enabled_flag was parsed and then
      ignored, so a stream using it desynchronized CABAC and
      decoded to garbage without any diagnostic. It is now
      implemented as specified in 9.3.4.3.6, and was the last Range
      Extensions tool still missing. Both fixes are bit-exact
      against HM 18.

-------------------------------------------------------------------
Thu Sep  3 06:04:55 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.1.2:
  + This is a security and bugfix release. It is ABI- and
    API-compatible with v1.1.1 and is a drop-in replacement. Two
    enum values were added: DE265_ERROR_INVALID_ARGUMENT and
    DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING.
  + Security fixes: (CVE numbers will be added when assigned.)
    - CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and
      double free in multi-threaded (WPP) decoding. A crafted
      stream whose slice segments repeat or rewind their
      slice_segment_address within a picture re-ran CTB rows that
      were already marked finished, so the CABAC context handoff
      between rows was no longer ordered and the shared context
      table was released twice. Slice segments that do not follow
      the previous one in tile-scan order are now rejected with the
      new warning
      DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the
      WPP row progress is reset for each slice segment. (medium)
    - CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free
      after de265_reset(): the pointer to the previous slice header
      was left dangling when the DPB was cleared, and a dependent
      slice pushed after the reset copied from freed memory.
      (medium)
  + Hardening:
    - de265_push_NAL() rejects NAL units shorter than the two-byte
      NAL unit header (including negative lengths) with the new
      DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with
      a NULL destination and then aborting the decode
    - SEI parsing: the overflow guard on the accumulated
      payload_size compared the wrong variable and could never
      trigger, so a crafted size could wrap around silently
    - The per-CTB progress counters and the image integrity flag
      are atomic with acquire/release ordering; ThreadSanitizer
      reported data races on them with several worker threads
  + Bug fixes:
    - Regression since v1.0.17: a cu_qp_delta of -26 was rejected
      as out of range although the allowed range is asymmetric and
      -26 is valid. Real-world encoders emit this value; the
      rejection aborted the slice and corrupted every picture of
      the affected IDR period
    - Regression since v1.0.17: an out-of-range value in the
      advisory VUI fields (bitstream_restriction(),
      chroma_sample_loc_type_*) rejected the whole SPS, so HEIF
      images from some consumer encoders could not be decoded at
      all. These fields are never used in the decoding process;
      they are now clamped with a warning as in v1.0.16. Malformed
      exp-Golomb codes are still a hard error
    - 16-bit decoding: the residual of 4x4 intra luma blocks (DST)
      was clipped to 16 bits although it needs 17 bits at bit depth
      16, corrupting those blocks and everything intra-predicted
      from them. Output is now identical to the HM reference
      decoder; bit depths up to 15 were not affected
    - MSVC: the visibility attribute is only used with GCC and
      Clang, fixing the static build with MSVC
    - CMake: building sherlock265 together with the library
      silently disabled the hidden symbol visibility introduced in
      v1.1.1. sherlock265 only uses exported symbols, so it no
      longer forces full visibility, and the configure output now
      states why symbols are hidden or exported.
      FORCE_FULL_VISIBILITY is documented in the README

-------------------------------------------------------------------
Tue Jun 16 07:40:59 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.1.1:
  + The decoding speed has been improved by about 8% on x86 CPUs
    thanks to more SIMD acceleration and optimized CABAC code. Also
    the startup time has been improved, which gives a 3% speed
    improvement when decoding HEIC files with similar-sized tiles.
  + Security:
    - CVE-2026-54240 (GHSA-ccfw-29x7-rrx3) - Pixel accessor signed
      integer overflow causes heap OOB read/write
    - CVE-2026-54241 (GHSA-j2qq-x2xq-g9wr) - SAO sequential filter
      heap buffer overflow via signed integer overflow
- Changes from version 1.1.0:
  + Added de265_security_limits parameters to limit the maximum
    image size and memory that libde265 will use during decoding.
  + Security fixes:
    - CVE-2026-49295 (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
      process_reference_picture_set via predicted short-term RPS
    - CVE-2026-49337 (GHSA-g5hj-rf9f-7vxm) - Unbounded memory
      accumulation via orphaned slice headers in read_slice_NAL
    - CVE-2026-49346 (GHSA-vv8h-932h-7r86) - Heap buffer overflow
      in de265_image_get_buffer via SPS dimension integer overflow
    - (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL
      parser (remove_stuffing_bytes, resize)
- Changes from version 1.0.19:
  + This release contains a number of security fixes, correctness
    fixes for edge cases, and build/packaging improvements.
    The public API is binary-compatible with v1.0.18.
  + Security fixes:
    - CVE-2026-45382 (GHSA-hwhx-x2mq-ccr9) : Heap-buffer-overflow
      READ in decode_slice_unit_tiles via unvalidated PPS tile
      geometry.
    - CVE-2026-45383 (GHSA-wg9q-ppqw-6q38) : Heap buffer overflow
      (OOB read) in decode_slice_unit_WPP() via out-of-bounds
      CtbAddrRStoTS access
- Changes from version 1.0.18:
  + libde265ConfigVersion.cmake renamed to
    libde265-config-version.cmake
  + fix pkg-config when installing to absolute paths
  + fix compilation with MSVC in Debug mode
  + removed the (defunct) encoder code and the internal development
    tools from the tarball.

-------------------------------------------------------------------
Wed Mar 18 13:35:29 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.17:
  + This release removes the autotools build scripts. Furthermore,
    many input validations have been added and security relevant
    issues have been fixed.
  + Fixes CVE-2026-33165 and CVE-2026-33164
- Add cmake BuildRequires and macros following upstream changes.
- Drop patches no longer needed:
  + libde265-disable_tools.patch
  + 03219835991f44c7ecf4dcc6fa8066967561be7e.patch
  + 67831118e3d6961fab4c29fc4364fa0eccfb8473.patch

-------------------------------------------------------------------
Wed May 21 07:03:56 UTC 2025 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.16:
  * This release fixes some rare decoding errors and some build
    issues.
- Rebase libde265-disable_tools.patch.
- Add 03219835991f44c7ecf4dcc6fa8066967561be7e.patch and
  67831118e3d6961fab4c29fc4364fa0eccfb8473.patch: Fix potential
  data race in image.cc

-------------------------------------------------------------------
Mon Jul 22 17:25:31 UTC 2024 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.15:
  * A couple of bug fixes, including the following CVEs:
    - CVE-2023-49465
    - CVE-2023-49467
    - CVE-2023-49468
- Changes from version 1.0.14:
  * This fixes build-time SSE detection when using the CMake build
    system. No other changes than that. You don't need to update if
    you are using the autotools build system.
- Changes from version 1.0.13:
  * This release fixes among other smaller issues the following
    crashes:
    - SEGV:occured in function main at dec265.cc
    - Memory allocation failed in function main at dec265.cc
    - Buffer over-read causes segmentation fault in
      pic_parameter_set::dump
    - Potential segmentation fault due to incorrect realloc in CABA
      C_encoder_bitstream::check_size_and_resize (unused function)
    - SEGV in libde265 in slice_segment_header::dump_slice_segment_
      header
    - Libde265 v1.0.12 was discovered that requested allocation
      size exceeds maximum supported size of 0x10000000000
    - heap-buffer-overflow in derive_spatial_luma_vector_prediction
      (...)

-------------------------------------------------------------------
Wed Oct 18 15:28:34 UTC 2023 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.12:
  * Fix CVE-2023-27102
  * Fix CVE-2023-27103

-------------------------------------------------------------------
Sun Jun  4 15:47:50 UTC 2023 - Luigi Baldoni <aloisio@gmx.com>

- Update to version 1.0.11
  * fixed generation of pkgconfig file with autotools
  * fixed crashes recently detected by fuzzing
  version 1.0.10:
  * This release fixes the known CVEs below, many of them are
    actually caused by the same underlying issues that manifest
    in different ways.
    CVE-2020-21594 CVE-2020-21595 CVE-2020-21596 CVE-2020-21597
    CVE-2020-21598 CVE-2020-21599 CVE-2020-21600 CVE-2020-21601
    CVE-2020-21602 CVE-2020-21603 CVE-2020-21604 CVE-2020-21605
    CVE-2020-21606 CVE-2022-1253 CVE-2022-43236 CVE-2022-43237
    CVE-2022-43238 CVE-2022-43239 CVE-2022-43240 CVE-2022-43241
    CVE-2022-43242 CVE-2022-43243 CVE-2022-43244 CVE-2022-43245
    CVE-2022-43248 CVE-2022-43249 CVE-2022-43250 CVE-2022-43252
    CVE-2022-43253 CVE-2022-47655

-------------------------------------------------------------------
Thu Jan 19 14:41:21 UTC 2023 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.9
  * Security fixes.

-------------------------------------------------------------------
Sun Nov 29 09:51:59 UTC 2020 - Luigi Baldoni <aloisio@gmx.com>

- Update to version 1.0.8
  * read HDR parameters from VUI header
  * fix reading matrix_coeffs from VUI header
  version 1.0.7:
  * add API to read VUI color information from bitstream
  version 1.0.6:
  * fix race in static mutex initialization
  * fix missing headers to install in CMakeLists.txt

-------------------------------------------------------------------
Mon Apr 20 21:17:43 UTC 2020 - zaitor@opensuse.org

- Update to version 1.0.5:
  + Fixes in the CMake build system (NOMINMAX).
  + Support stdin/stdout as input/output in dec265.
  + More input stream error checking (vps_num_hrd_parameters).
- Changes from version 1.0.4:
  + Fix decoding of monochrome streams (needed for depth images in
    heif images).
  + Improved cmake build script.
- Drop libde265-use_new_FFMPEG_enum_names.patch and
  libde265-only_export_decoder_api.patch: Fixed upstream.
- Rebase libde265-disable_tools.patch.
- Pass --disable-encoder to configure, do not build binary encoder.

-------------------------------------------------------------------
Tue May  8 20:49:06 UTC 2018 - zaitor@opensuse.org

- Update to version 1.0.3:
  + Fixes for compiler build problems.
  + Security fixes, mainly checking for corrupted input streams.
- Add debian and upstream patches:
  + libde265-only_export_decoder_api.patch
  + libde265-disable_tools.patch
  + libde265-use_new_FFMPEG_enum_names.patch

-------------------------------------------------------------------
Thu Nov 30 21:31:13 UTC 2017 - zaitor@opensuse.org

- Add baselibs.conf, build 32bit support for x86_64.

-------------------------------------------------------------------
Sun Nov 26 20:25:04 UTC 2017 - zaitor@opensuse.org

- Initial packaging for openSUSE.