libde265.git
2 years ago[PATCH] Try to mitigate asan failures.
Tobias Frost [Mon, 12 Dec 2022 13:03:12 +0000 (14:03 +0100)]
[PATCH] Try to mitigate asan failures.

See #345 for my analysis and details…

(This PR is just for discussion.)

(The CVE references are obtained from the Debian security tracker,
which links the issues.)

This makes the following POCs stop failing:

- poc3 (#337)
- poc7-1 (#341) CVE-2022-43239 (note: does NOT fix poc7-2)
- poc8-2, poc8-3, poc8-4 (#342) CVE-2022-43244   (note: does NOT fix poc8-1)
- poc11-1, poc11-2 (#345) CVE-2022-43249
- poc12 (#346)
- poc13 (#347) CVE-2022-43252
- poc16 (#350)

Gbp-Pq: Name reject_reference_pics_from_different_sps.patch

2 years agoDisable building of some internal tools that no longer link
Joachim Bauch [Thu, 2 Feb 2023 15:06:20 +0000 (15:06 +0000)]
Disable building of some internal tools that no longer link

because internal symbols are no longer exported.

Gbp-Pq: Name disable_tools.patch

2 years agoOnly export symbols defined in the decoder API.
Joachim Bauch [Thu, 2 Feb 2023 15:06:20 +0000 (15:06 +0000)]
Only export symbols defined in the decoder API.

The encoder API is not final yet, so upstream exports all symbols to make
development easier. For packaging we only want to expose the public API.

Gbp-Pq: Name only_export_decoder_api.patch

2 years agolibde265 (1.0.11-1) unstable; urgency=medium
Joachim Bauch [Thu, 2 Feb 2023 15:06:20 +0000 (15:06 +0000)]
libde265 (1.0.11-1) unstable; urgency=medium

  [ Tobias Frost ]
  * Make my patch less noisy.

  [ Joachim Bauch ]
  * New upstream version 1.0.11
  * Unpackaged upstream version 1.0.10 fixes the following CVEs, most caused
    by the same underlying issue:
    CVE-2020-21594, CVE-2020-21595, CVE-2020-21596, CVE-2020-21597,
    CVE-2020-21598, CVE-2020-21599, CVE-2020-21600, CVE-2020-21601,
    CVE-2020-21602, CVE-2020-21603, CVE-2020-21604, CVE-2020-21605,
    CVE-2020-21606, CVE-2022-1253, CVE-2022-43236, CVE-2022-43237,
    CVE-2022-43238, CVE-2022-43239, CVE-2022-43240, CVE-2022-43241,
    CVE-2022-43242, CVE-2022-43243, CVE-2022-43244, CVE-2022-43245,
    CVE-2022-43248, CVE-2022-43249, CVE-2022-43250, CVE-2022-43252,
    CVE-2022-43253, CVE-2022-47655
  * Remove patch applied upstream.
  * Update patches for new upstream version.
  * Remove copyright entry for file no longer present in upstream.
  * Update symbols for new upstream version.
  * Bump "Standards-Version" to 4.6.2

[dgit import unpatched libde265 1.0.11-1]

2 years agoImport libde265_1.0.11.orig.tar.gz
Joachim Bauch [Thu, 2 Feb 2023 15:06:20 +0000 (15:06 +0000)]
Import libde265_1.0.11.orig.tar.gz

[dgit import orig libde265_1.0.11.orig.tar.gz]

2 years agoImport libde265_1.0.11-1.debian.tar.xz
Joachim Bauch [Thu, 2 Feb 2023 15:06:20 +0000 (15:06 +0000)]
Import libde265_1.0.11-1.debian.tar.xz

[dgit import tarball libde265 1.0.11-1 libde265_1.0.11-1.debian.tar.xz]