From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hks1Z6MFdz2xXQ for ; Tue, 15 Sep 2026 19:06:10 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hks1W1xhdz2xJ1 for ; Tue, 15 Sep 2026 19:06:07 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4hks1V118DzBn; Tue, 15 Sep 2026 19:06:06 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1789499166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=WJQPjsF0BolA4lDHphw/7vpemMciUdEsJbAmiXgHU5M=; b=S1Fqqt5njPrd0571LojeGSbZ02WuYvg8uBZBOSdBamhqLgm2+c6FWeJNk+/Sz1Zq+OOfnd X7VzFELk5iMDZbCw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1789499166; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=WJQPjsF0BolA4lDHphw/7vpemMciUdEsJbAmiXgHU5M=; b=iGhIZdoxDEreyxUelWfzvnX8y+NkLUBA9xUvrXpiR7UMhLWsrWjCmOcU/xZzBX1y181PMG AwPtnv6RkV1aXwlK5SUEWNAfZ9BRrMoGRSEs0qDpezDeGgAlsuLG/LJnIvDROcqj4OYQ78 6ChdSJxEUKh7G0yKCSzVIYd6UVKx1VGroqgfYuB4CcXDSv01rQqpHL3jv/9Lxb2zzI7fxG WmnsTWyeGnLVmdBGX6DAOFXmAqkzI4nctcAz/d5PGts0ud4ouvUNzVR919b+WtpI9AzQt1 UN5LtjctzId8IMGbK7TVUWX74PdkJLayLVc9swTy05LeHzLFE1AebKakTCgf3Q== From: Adolf Belka To: development@lists.ipfire.org Cc: Adolf Belka Subject: [PATCH 1/2] faad2: Update to version 2.11.3 Date: Tue, 15 Sep 2026 21:06:00 +0200 Message-ID: <20260915190601.3108579-1-adolf.belka@ipfire.org> Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit - Update from version 2_10_0 (2020) to 2.11.3 (2026) - Update of rootfile - In version 2.11.0 (2023) unmaintained code was removed from faad2. This included all the plugins, and therefore removed the mpegip4 plugin. - The autotools build was removed in 2.11.0 and cmake and bazel build systems added. - build changed from autotools to cmake - faad2-2.11.3 required cmake-4.4.3 for the build - 2 CVE fixes in 2.11.0 - 2.11.0 had a range of bug fixes which faad2 devlopers categorised as "Safe" bugs, "Almost Safe" bugs & "Unsafe" bugs. The 2 CVE's are in the "Unsafe" bugs but there are 15 additional bug fixes in that category that have not had CVE numbers assigned - Changelog 2.11.3 Fix ISO C warning in libfaad/fixed.h Check for mp4config.frame.nsclices == 0 in frontend/mp4read.c to fix Heap Buffer Overflow SBR: prevent heap overflow in channel-pair reconstruction Fix off-by-one frame index check in mp4read_seek Fix integer overflow in stszin/stscin allocation size checks Bound sscanf field width in option parsing Fix out-of-bounds iq_table read in iquant for -32768 Prevent length_of_rvlc_sf underflow in rvlc_scale_factor_data Fix out-of-bounds Xsbr write in hf_assembly sinusoid addition Fix out-of-bounds X underflow in SBR low-power QMF assembly Fix ssr_gc_function signature mismatch in ssr_gain_control Fix signed overflow in estimate_current_envelope energy sum Cap escape length in huffman_spectral_data_2 Prevent num_bits_left underflow in ps_data extension parsing Fix signed overflow in fixed-point sample rounding before saturation Add sanity checks on the width in libfaad/specrec.c Check the last swb_offset value is valid in libfaad/specrec.c Return early from NeAACDecInit when the object type can't be supported Fix null pointer dereferences in intra channel and long term prediction Increase the ASC buffer from 10 to 64 bytes in frontend/mp4read.h 2.11.2 Add option BUILD_FAAD_CLI Add conditional build with DRC Use adts_frame for adts header detection Fix gapless calculation in frontend Fix write_audio_* function heap buffer overflow 2.11.1 Build shared libraries and hide symbols by default. Install man page by default. Check for lrintf() availability, link with -lm and define HAVE_LRINTF accordingly. Set a default build type if none was specified. Build DLL name with SOVERSION by default on Windows. Fix inlined lrintf() function signatures. 2.11.0 Fix incorrect variable initialization CI/CD, build, etc setup GitHub workflows; test build under MSVC, OSX, MSYS2, Linux add CMake build system additionally add Bazel build remove automake and MSVC project files add fuzzers that cover almost all decoder code setup fuzzing for various builds: (no-)FIXED_POINT / (no-)DRM remove dead code address differes compilers warnings move version to distingished place that different build systems can read "Safe" bugs "Safe" means that it is unlikely to be exploited; those affect the decoded result for (most likely) extreme inputs. Some fixes are useful only for "FIXED_POINT" build, since it has more restrictions on intermediate values. "negative range" in estimate_current_envelope integer overflow in channel downmixing integer overflow in estimate_envelope integer overflows caused by "practical infinite" gain integer overflows in HF adjustment code several "left shift of negative value" priming RNG to avoid using values that does not look random at all do not drop the first frame of output; other decoders don't do this touching uninitialized values in lt_update_state touching uninitialized values in bit-reader buffers "Almost Safe" bugs "Almost safe" means that those are unlinkly to be exploited; if those surface depends on build options / environment. division by zero in HF (noise?) generator and scale factor adjustment division by zero gen_rand_vector "Unsafe" bugs "Unsafe" means that those can cause crash, or could somehow else be exploited. CLI: accessing unallocated memory in mp4info (corrupted / zero-samples input) (CVE-2023-38857) CLI: out-of-bounds when parsing mp4 header CLI: crash because of wrong mp4 frame offset calculation (CVE-2023-38857) error handling rvlc_decode_scale_factors (CPU bomb?) null pointer dereference (in DRM + PS build) index-out-of-bounds / stack-buffer-overflow in decode_sce_lfe (for streams with PCE) stack-buffer-overflow in pns_decode null pointer derefernce (when channels change their type in the middle of the stream) infinite loop on currupted stream add practial limits for scale factors; otherwise calculated NaN/Inf values could confuse further logic, resulting in access-out-of-bounds check sf_index in window_grouping_info to avoid access-out-of-bounds clamp bs_pointer values to avoid access-out-of-bounds infinite loop in fill_element sanitize input values in ps_mix_phase to avoid access-out-of-bounds fix internal decoder buffer size calculation to avoid heap-out-of-bounds calculate channel length multiplier even if main channel is already allocated to avoid heap-out-of-bounds reserve enough slots for channels in decode_sce_lfe to avoid heap-out-of-bounds Fuzzing integration with oss-fuzz Add define option to disable SBR/PS support Fix coefficient table selection in tns_decode_coef 2.10.1 Reject buffers of zero size. Fix 7.1 with PCE mapping. Have proper version string in faad.h. Add conditional build with DRC. Signed-off-by: Adolf Belka --- config/rootfiles/packages/faad2 | 6 ++---- lfs/faad2 | 26 +++++++++++--------------- 2 files changed, 13 insertions(+), 19 deletions(-) diff --git a/config/rootfiles/packages/faad2 b/config/rootfiles/packages/faad2 index aa1d8a347..0264b6398 100644 --- a/config/rootfiles/packages/faad2 +++ b/config/rootfiles/packages/faad2 @@ -1,13 +1,11 @@ usr/bin/faad #usr/include/faad.h #usr/include/neaacdec.h -#usr/lib/libfaad.la usr/lib/libfaad.so usr/lib/libfaad.so.2 -usr/lib/libfaad.so.2.0.0 -#usr/lib/libfaad_drm.la +usr/lib/libfaad.so.2.11.3 usr/lib/libfaad_drm.so usr/lib/libfaad_drm.so.2 -usr/lib/libfaad_drm.so.2.0.0 +usr/lib/libfaad_drm.so.2.11.3 #usr/lib/pkgconfig/faad2.pc #usr/share/man/man1/faad.1 diff --git a/lfs/faad2 b/lfs/faad2 index 5a5218a7c..ec8a344d3 100644 --- a/lfs/faad2 +++ b/lfs/faad2 @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2020 IPFire Team # +# Copyright (C) 2007-2026 IPFire Team # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -26,7 +26,7 @@ include Config SUMMARY = C library and frontend for decoding MPEG2/4 AAC -VER = 2_10_0 +VER = 2.11.3 THISAPP = faad2-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = faad2 -PAK_VER = 3 +PAK_VER = 4 DEPS = @@ -48,7 +48,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 73ecbcbb3fce93e8ceb88f6f7669bb681d2329935018cc2a23929cf6672959a0678b47c830cfdcf8e716709ce5252a02178737a7af09de373f7c8b54f38f3d9d +$(DL_FILE)_BLAKE2 = da9f96c30653e5bfa41eb0c01b04128cb1a070d8fd46ac0a297cbfddef9d0f895f8f26e525521d7093949dc4f96b66b401d39b318192cfc3127c48e1f307e202 install : $(TARGET) @@ -82,16 +82,12 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @$(PREBUILD) @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) $(UPDATE_AUTOMAKE) - - cd $(DIR_APP) && autoupdate - cd $(DIR_APP) && autoreconf -fvi - cd $(DIR_APP) && ./configure \ - --prefix=/usr \ - --enable-shared \ - --disable-static \ - --with-mpeg4ip - - cd $(DIR_APP) && make $(MAKETUNING) - cd $(DIR_APP) && make install + cd $(DIR_APP) && mkdir build + cd $(DIR_APP)/build && cmake .. \ + -D CMAKE_INSTALL_PREFIX=/usr \ + -D CMAKE_BUILD_TYPE=Release \ + -D BUILD_SHARED_LIBS=on + cd $(DIR_APP)/build && make $(MAKETUNING) + cd $(DIR_APP)/build && make install @rm -rf $(DIR_APP) @$(POSTBUILD) -- 2.55.0