Projects
Essentials
libde265
libde265.changes
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File libde265.changes of Package libde265 (Revision 13)
Currently displaying revision
13
,
Show latest
------------------------------------------------------------------- Thu Sep 3 06:04:55 UTC 2026 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.1.2: + This is a security and bugfix release. It is ABI- and API-compatible with v1.1.1 and is a drop-in replacement. Two enum values were added: DE265_ERROR_INVALID_ARGUMENT and DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING. + Security fixes: (CVE numbers will be added when assigned.) - CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free in multi-threaded (WPP) decoding. A crafted stream whose slice segments repeat or rewind their slice_segment_address within a picture re-ran CTB rows that were already marked finished, so the CABAC context handoff between rows was no longer ordered and the shared context table was released twice. Slice segments that do not follow the previous one in tile-scan order are now rejected with the new warning DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row progress is reset for each slice segment. (medium) - CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after de265_reset(): the pointer to the previous slice header was left dangling when the DPB was cleared, and a dependent slice pushed after the reset copied from freed memory. (medium) + Hardening: - de265_push_NAL() rejects NAL units shorter than the two-byte NAL unit header (including negative lengths) with the new DE265_ERROR_INVALID_ARGUMENT instead of calling memcpy() with a NULL destination and then aborting the decode - SEI parsing: the overflow guard on the accumulated payload_size compared the wrong variable and could never trigger, so a crafted size could wrap around silently - The per-CTB progress counters and the image integrity flag are atomic with acquire/release ordering; ThreadSanitizer reported data races on them with several worker threads + Bug fixes: - Regression since v1.0.17: a cu_qp_delta of -26 was rejected as out of range although the allowed range is asymmetric and -26 is valid. Real-world encoders emit this value; the rejection aborted the slice and corrupted every picture of the affected IDR period - Regression since v1.0.17: an out-of-range value in the advisory VUI fields (bitstream_restriction(), chroma_sample_loc_type_*) rejected the whole SPS, so HEIF images from some consumer encoders could not be decoded at all. These fields are never used in the decoding process; they are now clamped with a warning as in v1.0.16. Malformed exp-Golomb codes are still a hard error - 16-bit decoding: the residual of 4x4 intra luma blocks (DST) was clipped to 16 bits although it needs 17 bits at bit depth 16, corrupting those blocks and everything intra-predicted from them. Output is now identical to the HM reference decoder; bit depths up to 15 were not affected - MSVC: the visibility attribute is only used with GCC and Clang, fixing the static build with MSVC - CMake: building sherlock265 together with the library silently disabled the hidden symbol visibility introduced in v1.1.1. sherlock265 only uses exported symbols, so it no longer forces full visibility, and the configure output now states why symbols are hidden or exported. FORCE_FULL_VISIBILITY is documented in the README ------------------------------------------------------------------- Tue Jun 16 07:40:59 UTC 2026 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.1.1: + The decoding speed has been improved by about 8% on x86 CPUs thanks to more SIMD acceleration and optimized CABAC code. Also the startup time has been improved, which gives a 3% speed improvement when decoding HEIC files with similar-sized tiles. + Security: - CVE-2026-54240 (GHSA-ccfw-29x7-rrx3) - Pixel accessor signed integer overflow causes heap OOB read/write - CVE-2026-54241 (GHSA-j2qq-x2xq-g9wr) - SAO sequential filter heap buffer overflow via signed integer overflow - Changes from version 1.1.0: + Added de265_security_limits parameters to limit the maximum image size and memory that libde265 will use during decoding. + Security fixes: - CVE-2026-49295 (GHSA-g2rg-wj66-w594) - Out-of-bounds write in process_reference_picture_set via predicted short-term RPS - CVE-2026-49337 (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via orphaned slice headers in read_slice_NAL - CVE-2026-49346 (GHSA-vv8h-932h-7r86) - Heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow - (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser (remove_stuffing_bytes, resize) - Changes from version 1.0.19: + This release contains a number of security fixes, correctness fixes for edge cases, and build/packaging improvements. The public API is binary-compatible with v1.0.18. + Security fixes: - CVE-2026-45382 (GHSA-hwhx-x2mq-ccr9) : Heap-buffer-overflow READ in decode_slice_unit_tiles via unvalidated PPS tile geometry. - CVE-2026-45383 (GHSA-wg9q-ppqw-6q38) : Heap buffer overflow (OOB read) in decode_slice_unit_WPP() via out-of-bounds CtbAddrRStoTS access - Changes from version 1.0.18: + libde265ConfigVersion.cmake renamed to libde265-config-version.cmake + fix pkg-config when installing to absolute paths + fix compilation with MSVC in Debug mode + removed the (defunct) encoder code and the internal development tools from the tarball. ------------------------------------------------------------------- Wed Mar 18 13:35:29 UTC 2026 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.0.17: + This release removes the autotools build scripts. Furthermore, many input validations have been added and security relevant issues have been fixed. + Fixes CVE-2026-33165 and CVE-2026-33164 - Add cmake BuildRequires and macros following upstream changes. - Drop patches no longer needed: + libde265-disable_tools.patch + 03219835991f44c7ecf4dcc6fa8066967561be7e.patch + 67831118e3d6961fab4c29fc4364fa0eccfb8473.patch ------------------------------------------------------------------- Wed May 21 07:03:56 UTC 2025 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.0.16: * This release fixes some rare decoding errors and some build issues. - Rebase libde265-disable_tools.patch. - Add 03219835991f44c7ecf4dcc6fa8066967561be7e.patch and 67831118e3d6961fab4c29fc4364fa0eccfb8473.patch: Fix potential data race in image.cc ------------------------------------------------------------------- Mon Jul 22 17:25:31 UTC 2024 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.0.15: * A couple of bug fixes, including the following CVEs: - CVE-2023-49465 - CVE-2023-49467 - CVE-2023-49468 - Changes from version 1.0.14: * This fixes build-time SSE detection when using the CMake build system. No other changes than that. You don't need to update if you are using the autotools build system. - Changes from version 1.0.13: * This release fixes among other smaller issues the following crashes: - SEGV:occured in function main at dec265.cc - Memory allocation failed in function main at dec265.cc - Buffer over-read causes segmentation fault in pic_parameter_set::dump - Potential segmentation fault due to incorrect realloc in CABA C_encoder_bitstream::check_size_and_resize (unused function) - SEGV in libde265 in slice_segment_header::dump_slice_segment_ header - Libde265 v1.0.12 was discovered that requested allocation size exceeds maximum supported size of 0x10000000000 - heap-buffer-overflow in derive_spatial_luma_vector_prediction (...) ------------------------------------------------------------------- Wed Oct 18 15:28:34 UTC 2023 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.0.12: * Fix CVE-2023-27102 * Fix CVE-2023-27103 ------------------------------------------------------------------- Sun Jun 4 15:47:50 UTC 2023 - Luigi Baldoni <aloisio@gmx.com> - Update to version 1.0.11 * fixed generation of pkgconfig file with autotools * fixed crashes recently detected by fuzzing version 1.0.10: * This release fixes the known CVEs below, many of them are actually caused by the same underlying issues that manifest in different ways. CVE-2020-21594 CVE-2020-21595 CVE-2020-21596 CVE-2020-21597 CVE-2020-21598 CVE-2020-21599 CVE-2020-21600 CVE-2020-21601 CVE-2020-21602 CVE-2020-21603 CVE-2020-21604 CVE-2020-21605 CVE-2020-21606 CVE-2022-1253 CVE-2022-43236 CVE-2022-43237 CVE-2022-43238 CVE-2022-43239 CVE-2022-43240 CVE-2022-43241 CVE-2022-43242 CVE-2022-43243 CVE-2022-43244 CVE-2022-43245 CVE-2022-43248 CVE-2022-43249 CVE-2022-43250 CVE-2022-43252 CVE-2022-43253 CVE-2022-47655 ------------------------------------------------------------------- Thu Jan 19 14:41:21 UTC 2023 - Bjørn Lie <zaitor@opensuse.org> - Update to version 1.0.9 * Security fixes. ------------------------------------------------------------------- Sun Nov 29 09:51:59 UTC 2020 - Luigi Baldoni <aloisio@gmx.com> - Update to version 1.0.8 * read HDR parameters from VUI header * fix reading matrix_coeffs from VUI header version 1.0.7: * add API to read VUI color information from bitstream version 1.0.6: * fix race in static mutex initialization * fix missing headers to install in CMakeLists.txt ------------------------------------------------------------------- Mon Apr 20 21:17:43 UTC 2020 - zaitor@opensuse.org - Update to version 1.0.5: + Fixes in the CMake build system (NOMINMAX). + Support stdin/stdout as input/output in dec265. + More input stream error checking (vps_num_hrd_parameters). - Changes from version 1.0.4: + Fix decoding of monochrome streams (needed for depth images in heif images). + Improved cmake build script. - Drop libde265-use_new_FFMPEG_enum_names.patch and libde265-only_export_decoder_api.patch: Fixed upstream. - Rebase libde265-disable_tools.patch. - Pass --disable-encoder to configure, do not build binary encoder. ------------------------------------------------------------------- Tue May 8 20:49:06 UTC 2018 - zaitor@opensuse.org - Update to version 1.0.3: + Fixes for compiler build problems. + Security fixes, mainly checking for corrupted input streams. - Add debian and upstream patches: + libde265-only_export_decoder_api.patch + libde265-disable_tools.patch + libde265-use_new_FFMPEG_enum_names.patch ------------------------------------------------------------------- Thu Nov 30 21:31:13 UTC 2017 - zaitor@opensuse.org - Add baselibs.conf, build 32bit support for x86_64. ------------------------------------------------------------------- Sun Nov 26 20:25:04 UTC 2017 - zaitor@opensuse.org - Initial packaging for openSUSE.
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.