Packman Build Service PMBS

Changes of Revision 2

ffmpeg-9.changes Added

@@ -0,0 +1,278 @@
+-------------------------------------------------------------------
+Mon Oct 12 10:56:46 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Enable RealAudio Lossless, RealVideo 3.0 and 4.0 decoders.
+
+-------------------------------------------------------------------
+Fri Oct  9 12:18:06 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Correctly enable apv encoder, encoder is named liboapv.
+
+-------------------------------------------------------------------
+Wed Oct  7 07:59:26 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Enable apv encoder support, add pkgconfig(oapv) BuildRequires and
+  pass enable-liboapv to configure.
+- Add 0001-avcodec-liboapvenc-fix-build-with-openapv-1.1.patch
+
+-------------------------------------------------------------------
+Sat Oct  3 08:30:10 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Add aptx/aptx_hd to enable_decoders/encoders.
+
+-------------------------------------------------------------------
+Fri Oct  2 15:02:41 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Adjust work-around-abi-break.patch to support a few programs
+  (e.g. OpenJFX) built against unmodified ffmpegs. boo#1282855
+
+-------------------------------------------------------------------
+Tue Sep 29 21:26:57 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Correct version in "mini" part of spec.
+
+-------------------------------------------------------------------
+Sun Sep 20 00:54:16 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 9.0.2
+  * H.264 Refinements
+  * Crash & Leak Fixes
+  * Added stricter input constraints to prevent overflows, infinite
+    loops, or undefined behavior.
+
+-------------------------------------------------------------------
+Sat Sep  5 11:07:34 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Enable decoders in ffmpeg-9-mini that need no extra build
+  dependencies. This makes it possible for some packages to run
+  testsuites with e.g. WAV files.
+
+-------------------------------------------------------------------
+Tue Sep  1 15:38:56 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Add pkgconfig(SPIRV-Headers) BuildRequires: Support swscale
+  SPIR-V backend.
+
+-------------------------------------------------------------------
+Mon Aug 31 22:20:15 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Complete work-around-abi-break.patch for BUILD_ORIG=1 builds
+
+-------------------------------------------------------------------
+Wed Aug 12 13:52:05 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 9.0.1
+  * Added boundary checks for various input formats, added nullptr
+    checks, cure some integer overflows and underflows.
+  * avcodec/dvbsub_parser: avoid signed overflow in the capacity check.
+    (CVE-2026-70628, bsc#1274268)
+  * avcodec/rscc: do not leave uninitilized data when the input is too short.
+    (CVE-2026-70629, bsc#1274270)
+  * avcodec/screenpresso: reject deflate output shorter than the frame.
+    (CVE-2026-70630, bsc#1274282)
+  * avcodec/tiff: reject inflate output shorter than the strip.
+    (CVE-2026-70631, bsc#1274287)
+  * avcodec/cfhd: reject transform-2 output wider than the plane.
+    (CVE-2026-70632, bsc#1274289)
+  * avformat/hevc: reject hvcC NAL arrays that overflow the 16-bit count.
+    (CVE-2026-75141, bsc#1276407)
+  * avformat/mpegenc: reject stream counts that overflow the system header.
+    (CVE-2026-75142, bsc#1276408)
+  * avformat/librist: honor the caller buffer size in librist_read.
+    (CVE-2026-75143, bsc#1276409)
+  * avformat/rtpenc_vc2hq: reject data units larger than the RTP payload buffer.
+    (CVE-2026-75144, bsc#1276410)
+  * avformat/rtpenc_av1: do not narrow the OBU size to (long).
+    (CVE-2026-75145, bsc#1276411)
+  * avformat/dashdec: reject a negative fragment index.
+    (CVE-2026-75146, bsc#1276412)
+  * avformat/rtpenc_av1: bound OBU size in the keyframe search loop.
+    (CVE-2026-75147, bsc#1276413)
+  * avcodec/tdsc: remove double stride adjustment
+    (CVE-2026-18393, bsc#1277377)
+- CVE-2026-96611: avformat/mov: reject out of range ispe dimensions, avoid
+  overflow summing HEIF tile dimensions
+  (bsc#1282608)
+- CVE-2026-52295: avformat: Fix various extradata padding issues
+  (bsc#1278274)
+- CVE-2026-52297: avformat: Fix various extradata padding issues
+  (bsc#1280753)
+- CVE-2026-52296: avcodec/wmaenc: Fix missing padding in extradata
+  (bsc#1280752)
+
+-------------------------------------------------------------------
+Wed Aug  5 17:37:10 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Derive from ffmpeg-8.spec
+- Update to release 9.0
+  * More Vulkan API acceleration work like Vulkan APV video
+    decoding and Apple ProRes RAW Vulkan acceleration, the Vulkan
+    v360 video filter, HE-AAC 960 decoding, a transpose NVIDIA CUDA
+    filter, animated WebP decoding and demuxing, continued AMD AMF
+    enhancements, more AVX-512 optimizations, and more.
+  * Remove CELT decoding support (doesn't affect Opus CELT)
+  * Remove CELT-in-Ogg parsing
+  * avcodec/rasc: Check that 32-bit DLTA accesses stay within the row.
+    (CVE-2026-58049, bsc#1269550)
+  * avformat/spdifenc: bound DTS core_size against the packet size in the HD path.
+    (CVE-2026-64833, bsc#1272755)
+  * avformat/rtpdec_asf: reject ASF objects smaller than their header.
+    (CVE-2026-64834, bsc#1272757)
+  * avcodec/tdsc: unref the reference frame before reallocating on size change.
+    (CVE-2026-65703, bsc#Bug 1272759)
+  * avformat/ty: don't let the Series2 AC3 trim underflow the packet size.
+    (CVE-2026-65704, bsc# 1272760)
+  * avfilter/vf_floodfill: remove unneeded variables.
+    (CVE-2026-65705,  bsc#1272761)
+  * avfilter/vf_swaprect: size the temp row buffer for the widest plane.
+    (CVE-2026-65706, bsc#1272762)
+  * avfilter/vf_hqdn3d: reject unsupported frame parameter changes.
+    (CVE-2026-66036, bsc#1272763)
+  * avfilter/vf_hqdn3d: support dynamic frame sizes.
+    (CVE-2026-66036, bsc#1272763)
+  * avformat/iamf_parse: check count_label against the available bytes.
+    (CVE-2026-66037, bsc#1272764)
+
+-------------------------------------------------------------------
+Tue Jul 21 13:58:03 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Rename the ffmpeg-8 BRPM to ffmpeg. boo#1271606
+
+-------------------------------------------------------------------
+Wed Jun 17 18:20:21 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 8.1.2
+  * Fix some buffer overflows, integer overflows, negative
+    indices, off-by-one erros and double frees in various codecs,
+    muxers and filters.
+  * avcodec/magicyuv: Fix 1 line MEDIAN slices
+    avcodec/magicyuv: Expand the s->interlaced slice-height sanity check
+    avcodec/magicyuv: reject slice_height misaligned with chroma vshift
+    (CVE-2026-8461, bsc#1269490)
+
+-------------------------------------------------------------------
+Fri May 15 00:10:11 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Enable glslang filters
+
+-------------------------------------------------------------------
+Sat May  9 09:36:25 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Update to version 8.1.1:
+  * Various codec, filter and other changes, stable bugfix update.
+  * avcodec/av1dec: check that primary_ref_frame is within range.
+    (CVE-2026-30997, bsc#1262047)
+  * avcodec/rasc: fix heap use-after-free in decode_move().
+    (CVE-2026-12706, bsc#1268595)
+
+-------------------------------------------------------------------
+Thu Apr 30 19:22:32 UTC 2026 - Mia Herkt <mia@0x0.st>
+
+- Switch back to OpenSSL
+  I do not remember why exactly this was changed, but I believe
+  one of the reasons was that back when EC certificates were new,
+  FFmpeg was only using the SSL 3.0/TLS 1.0 functions of the
+  library, which meant a security downgrade and prevented it from
+  connecting to hosts that restricted clients to newer protocol
+  versions.
+
+  Both libraries are kind of terrible, but at least OpenSSL does
+  not have a start function that unconditionally incurs significant
+  startup delays (200-300ms on an older laptop) for everything that
+  links to it.
+
+-------------------------------------------------------------------
+Thu Apr 16 15:54:50 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Add explicit symbol lists to work-around-abi-break.patch
+  boo#1261836
+
+-------------------------------------------------------------------
+Thu Apr  2 08:54:44 UTC 2026 - Bjørn Lie <bjorn.lie@gmail.com>
+
+- Disable VVC decoders/encoders by default.
+
+-------------------------------------------------------------------
+Mon Mar 16 22:36:37 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 8.1
+  * EXIF metadata parsing support
+- CVE-2026-38349: swscale/output: Fix integer overflow in alpha in
+  yuv2rgba64_1_c_template().
+  (bsc#1277369)
+- CVE-2026-38348: swscale/utils: Check *Inc.
+  (bsc#1277368)
+- CVE-2026-38346: swscale/output: Fixes integer overflow in yuv2planeX_8_c.
+  (bsc#1277375)
+- CVE-2026-38344: swscale/utils: initialize chroma when luma switched to
+  cascade.
+  (bsc#1277309)
+- CVE-2026-90815: avfilter/vf_convolution: Handle corner cases with small
+  frames.
+  (bsc#1280754)
+- CVE-2026-90815: avfilter/vf_convolution: Use avpriv_mirror.
+  (bsc#1280754)
+- CVE-2026-38345: libswscale/utils: prevent division by zero for chroma
+  width 8.
+  (bsc#1277376)
+- CVE-2026-90816: avformat: remove HLS protocol.
+  (bsc#1280755)
+
+-------------------------------------------------------------------
+Tue Jan 27 00:01:04 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Enable harfbuzz-based plugins boo#1256873
+
+-------------------------------------------------------------------
+Tue Jan 20 12:51:56 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Enable some more codecs based on package availability and
+  based on comparison with Fedora's ffmpeg package.
+
+-------------------------------------------------------------------
+Sat Jan 10 19:47:20 UTC 2026 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 8.0.1
+  * avcodec/videotoolboxenc: fix the loss of precision when
+    calculating quality
+  * avcodec/videotoolboxenc: support global_quality without qscale
+  * avformat/http: Handle IPv6 Zone ID in hostname
+  * avfilter/af_whisper: fix broken output for multibyte character
+  * avfilter/f_ebur128: Fix incorrect ebur128 peak calculation
+  * swscale/graph: fix double-free when legacy pass fails
+    initializing
+  * avformat/dhav: Fix off by length of read element error
+  * avcodec/ffv1enc: Consider variation in slice sizes
+
+-------------------------------------------------------------------
+Sun Aug 24 07:09:43 UTC 2025 - Jan Engelhardt <jengelh@inai.de>
+
+- Derive from ffmpeg-7.spec
+- Update to release 8.0
+  * New features:
+  * Native decoders (Packman builds): APV, ProRes RAW, RealVideo
+    6.0, Sanyo LD-ADPCM, G.728
+  * VVC decoder improvements: IBC, ACT, Palette Mode
+  * Vulkan compute-based codecs: FFv1 (encode and decode), ProRes
+    RAW (decode only)
+  * Hardware accelerated decoding: Vulkan VP9, VAAPI VVC,
+    OpenHarmony H264/5
+  * Hardware accelerated encoding: Vulkan AV1, OpenHarmony H264/5
+  * Filters: colordetect, pad_cuda, scale_d3d11, Whisper, and
+    others
+  * libavfilter/af_firequalizer: Add check for av_malloc_array()
+    (CVE-2025-10256, bsc#1249431)
+  * avcodec/jpeg2000dec: implement cdef remapping during pixel
+    format matching.
+    (CVE-2025-9951, bsc#1249393)
+  * aacenc_tns: clamp filter direction energy measurement
+    (CVE-2025-1594, bsc#1237561)
+- CVE-2026-38350: swscale/output: Fix all bilinear integer overflows.
+  (bsc#1277370)
+- CVE-2026-38347: swscale/alphablend: don't overread alpha plane on subsampled
+  odd size.
+  (bsc#1277373)
+- CVE-2023-6602: avformat/hls: Be more picky on extensions.
+  (bsc#1220546)
+- CVE-2023-6604: avformat/hls: Be more picky on extensions.
+  (bsc#1220549)

ffmpeg-9.spec Changed

@@ -270,13 +270,13 @@
 Summary:        Command-line utilities for working with various multimedia formats
 Provides:       ffmpeg-tools = %version
 Conflicts:      ffmpeg-tools
-Requires:       (libavcodec63 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libavdevice63 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libavfilter12 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libavformat63 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libavutil61 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libswresample7 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
-Requires:       (libswscale10 = %version-%release or ffmpeg-9-mini-libs = %version-%release)
+Requires:       libavcodec63 = %version-%release 
+Requires:       libavdevice63 = %version-%release
+Requires:       libavfilter12 = %version-%release
+Requires:       libavformat63 = %version-%release
+Requires:       libavutil61 = %version-%release
+Requires:       libswresample7 = %version-%release
+Requires:       libswscale10 = %version-%release
 
 %description -n ffmpeg
 FFmpeg is a multimedia framework, able to decode, encode,