Packman Build Service PMBS

File libde265.changes of Package libde265 (Revision d79d3122a3959a32ab20ba9b77e3e679)

Currently displaying revision d79d3122a3959a32ab20ba9b77e3e679 , Show latest

-------------------------------------------------------------------
Tue Jun 16 07:40:59 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.1.1:
  + The decoding speed has been improved by about 8% on x86 CPUs
    thanks to more SIMD acceleration and optimized CABAC code. Also
    the startup time has been improved, which gives a 3% speed
    improvement when decoding HEIC files with similar-sized tiles.
  + Security:
    - CVE-2026-54240 (GHSA-ccfw-29x7-rrx3) - Pixel accessor signed
      integer overflow causes heap OOB read/write
    - CVE-2026-54241 (GHSA-j2qq-x2xq-g9wr) - SAO sequential filter
      heap buffer overflow via signed integer overflow
- Changes from version 1.1.0:
  + Added de265_security_limits parameters to limit the maximum
    image size and memory that libde265 will use during decoding.
  + Security fixes:
    - CVE-2026-49295 (GHSA-g2rg-wj66-w594) - Out-of-bounds write in
      process_reference_picture_set via predicted short-term RPS
    - CVE-2026-49337 (GHSA-g5hj-rf9f-7vxm) - Unbounded memory
      accumulation via orphaned slice headers in read_slice_NAL
    - CVE-2026-49346 (GHSA-vv8h-932h-7r86) - Heap buffer overflow
      in de265_image_get_buffer via SPS dimension integer overflow
    - (GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL
      parser (remove_stuffing_bytes, resize)
- Changes from version 1.0.19:
  + This release contains a number of security fixes, correctness
    fixes for edge cases, and build/packaging improvements.
    The public API is binary-compatible with v1.0.18.
  + Security fixes:
    - CVE-2026-45382 (GHSA-hwhx-x2mq-ccr9) : Heap-buffer-overflow
      READ in decode_slice_unit_tiles via unvalidated PPS tile
      geometry.
    - CVE-2026-45383 (GHSA-wg9q-ppqw-6q38) : Heap buffer overflow
      (OOB read) in decode_slice_unit_WPP() via out-of-bounds
      CtbAddrRStoTS access
- Changes from version 1.0.18:
  + libde265ConfigVersion.cmake renamed to
    libde265-config-version.cmake
  + fix pkg-config when installing to absolute paths
  + fix compilation with MSVC in Debug mode
  + removed the (defunct) encoder code and the internal development
    tools from the tarball.

-------------------------------------------------------------------
Wed Mar 18 13:35:29 UTC 2026 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.17:
  + This release removes the autotools build scripts. Furthermore,
    many input validations have been added and security relevant
    issues have been fixed.
  + Fixes CVE-2026-33165 and CVE-2026-33164
- Add cmake BuildRequires and macros following upstream changes.
- Drop patches no longer needed:
  + libde265-disable_tools.patch
  + 03219835991f44c7ecf4dcc6fa8066967561be7e.patch
  + 67831118e3d6961fab4c29fc4364fa0eccfb8473.patch

-------------------------------------------------------------------
Wed May 21 07:03:56 UTC 2025 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.16:
  * This release fixes some rare decoding errors and some build
    issues.
- Rebase libde265-disable_tools.patch.
- Add 03219835991f44c7ecf4dcc6fa8066967561be7e.patch and
  67831118e3d6961fab4c29fc4364fa0eccfb8473.patch: Fix potential
  data race in image.cc

-------------------------------------------------------------------
Mon Jul 22 17:25:31 UTC 2024 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.15:
  * A couple of bug fixes, including the following CVEs:
    - CVE-2023-49465
    - CVE-2023-49467
    - CVE-2023-49468
- Changes from version 1.0.14:
  * This fixes build-time SSE detection when using the CMake build
    system. No other changes than that. You don't need to update if
    you are using the autotools build system.
- Changes from version 1.0.13:
  * This release fixes among other smaller issues the following
    crashes:
    - SEGV:occured in function main at dec265.cc
    - Memory allocation failed in function main at dec265.cc
    - Buffer over-read causes segmentation fault in
      pic_parameter_set::dump
    - Potential segmentation fault due to incorrect realloc in CABA
      C_encoder_bitstream::check_size_and_resize (unused function)
    - SEGV in libde265 in slice_segment_header::dump_slice_segment_
      header
    - Libde265 v1.0.12 was discovered that requested allocation
      size exceeds maximum supported size of 0x10000000000
    - heap-buffer-overflow in derive_spatial_luma_vector_prediction
      (...)

-------------------------------------------------------------------
Wed Oct 18 15:28:34 UTC 2023 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.12:
  * Fix CVE-2023-27102
  * Fix CVE-2023-27103

-------------------------------------------------------------------
Sun Jun  4 15:47:50 UTC 2023 - Luigi Baldoni <aloisio@gmx.com>

- Update to version 1.0.11
  * fixed generation of pkgconfig file with autotools
  * fixed crashes recently detected by fuzzing
  version 1.0.10:
  * This release fixes the known CVEs below, many of them are
    actually caused by the same underlying issues that manifest
    in different ways.
    CVE-2020-21594 CVE-2020-21595 CVE-2020-21596 CVE-2020-21597
    CVE-2020-21598 CVE-2020-21599 CVE-2020-21600 CVE-2020-21601
    CVE-2020-21602 CVE-2020-21603 CVE-2020-21604 CVE-2020-21605
    CVE-2020-21606 CVE-2022-1253 CVE-2022-43236 CVE-2022-43237
    CVE-2022-43238 CVE-2022-43239 CVE-2022-43240 CVE-2022-43241
    CVE-2022-43242 CVE-2022-43243 CVE-2022-43244 CVE-2022-43245
    CVE-2022-43248 CVE-2022-43249 CVE-2022-43250 CVE-2022-43252
    CVE-2022-43253 CVE-2022-47655

-------------------------------------------------------------------
Thu Jan 19 14:41:21 UTC 2023 - Bjørn Lie <zaitor@opensuse.org>

- Update to version 1.0.9
  * Security fixes.

-------------------------------------------------------------------
Sun Nov 29 09:51:59 UTC 2020 - Luigi Baldoni <aloisio@gmx.com>

- Update to version 1.0.8
  * read HDR parameters from VUI header
  * fix reading matrix_coeffs from VUI header
  version 1.0.7:
  * add API to read VUI color information from bitstream
  version 1.0.6:
  * fix race in static mutex initialization
  * fix missing headers to install in CMakeLists.txt

-------------------------------------------------------------------
Mon Apr 20 21:17:43 UTC 2020 - zaitor@opensuse.org

- Update to version 1.0.5:
  + Fixes in the CMake build system (NOMINMAX).
  + Support stdin/stdout as input/output in dec265.
  + More input stream error checking (vps_num_hrd_parameters).
- Changes from version 1.0.4:
  + Fix decoding of monochrome streams (needed for depth images in
    heif images).
  + Improved cmake build script.
- Drop libde265-use_new_FFMPEG_enum_names.patch and
  libde265-only_export_decoder_api.patch: Fixed upstream.
- Rebase libde265-disable_tools.patch.
- Pass --disable-encoder to configure, do not build binary encoder.

-------------------------------------------------------------------
Tue May  8 20:49:06 UTC 2018 - zaitor@opensuse.org

- Update to version 1.0.3:
  + Fixes for compiler build problems.
  + Security fixes, mainly checking for corrupted input streams.
- Add debian and upstream patches:
  + libde265-only_export_decoder_api.patch
  + libde265-disable_tools.patch
  + libde265-use_new_FFMPEG_enum_names.patch

-------------------------------------------------------------------
Thu Nov 30 21:31:13 UTC 2017 - zaitor@opensuse.org

- Add baselibs.conf, build 32bit support for x86_64.

-------------------------------------------------------------------
Sun Nov 26 20:25:04 UTC 2017 - zaitor@opensuse.org

- Initial packaging for openSUSE.