CVS commit: pkgsrc/multimedia/libde265

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Thu May 28 06:41:34 UTC 2026

Modified Files:
        pkgsrc/multimedia/libde265: Makefile PLIST distinfo

Log Message:
libde265: updated to 1.1.0

1.1.0

Added de265_security_limits parameters to limit the maximum image size and memory that libde265 will use during decoding.

Security fixes

CVE TBD (GHSA-g2rg-wj66-w594) - Out-of-bounds write in process_reference_picture_set via predicted short-term RPS
CVE TBD (GHSA-vv8h-932h-7r86) - Heap buffer overflow in de265_image_get_buffer via SPS dimension integer overflow
CVE TBD (GHSA-g5hj-rf9f-7vxm) - Unbounded memory accumulation via orphaned slice headers in read_slice_NAL
(GHSA-x27c-jp65-g395) - Quadratic CPU consumption in NAL parser (remove_stuffing_bytes, resize)


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 pkgsrc/multimedia/libde265/Makefile
cvs rdiff -u -r1.5 -r1.6 pkgsrc/multimedia/libde265/PLIST
cvs rdiff -u -r1.16 -r1.17 pkgsrc/multimedia/libde265/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/multimedia/libde265/Makefile
diff -u pkgsrc/multimedia/libde265/Makefile:1.20 pkgsrc/multimedia/libde265/Makefile:1.21
--- pkgsrc/multimedia/libde265/Makefile:1.20    Sun May 24 18:08:08 2026
+++ pkgsrc/multimedia/libde265/Makefile Thu May 28 06:41:34 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.20 2026/05/24 18:08:08 wiz Exp $
+# $NetBSD: Makefile,v 1.21 2026/05/28 06:41:34 adam Exp $
 
-DISTNAME=      libde265-1.0.19
+DISTNAME=      libde265-1.1.0
 CATEGORIES=    multimedia
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=strukturag/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}
@@ -10,8 +10,8 @@ HOMEPAGE=     https://github.com/strukturag/
 COMMENT=       Open h.265 video codec implementation
 LICENSE=       gnu-lgpl-v3
 
-USE_LANGUAGES=         c c++
 USE_CXX_FEATURES=      c++17
+USE_LANGUAGES=         c c++
 PKGCONFIG_OVERRIDE+=   libde265.pc.in
 
 BUILDLINK_TRANSFORM+=  opt:-std=c++17:-std=gnu++17     # alloca

Index: pkgsrc/multimedia/libde265/PLIST
diff -u pkgsrc/multimedia/libde265/PLIST:1.5 pkgsrc/multimedia/libde265/PLIST:1.6
--- pkgsrc/multimedia/libde265/PLIST:1.5        Sun May 24 18:08:08 2026
+++ pkgsrc/multimedia/libde265/PLIST    Thu May 28 06:41:34 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.5 2026/05/24 18:08:08 wiz Exp $
+@comment $NetBSD: PLIST,v 1.6 2026/05/28 06:41:34 adam Exp $
 bin/dec265
 include/libde265/de265-version.h
 include/libde265/de265.h
@@ -7,5 +7,5 @@ lib/cmake/libde265/libde265-config-versi
 lib/cmake/libde265/libde265-config.cmake
 lib/libde265.so
 lib/libde265.so.0
-lib/libde265.so.0.1.12
+lib/libde265.so.0.2.0
 lib/pkgconfig/libde265.pc

Index: pkgsrc/multimedia/libde265/distinfo
diff -u pkgsrc/multimedia/libde265/distinfo:1.16 pkgsrc/multimedia/libde265/distinfo:1.17
--- pkgsrc/multimedia/libde265/distinfo:1.16    Sun May 24 18:08:08 2026
+++ pkgsrc/multimedia/libde265/distinfo Thu May 28 06:41:34 2026
@@ -1,7 +1,7 @@
-$NetBSD: distinfo,v 1.16 2026/05/24 18:08:08 wiz Exp $
+$NetBSD: distinfo,v 1.17 2026/05/28 06:41:34 adam Exp $
 
-BLAKE2s (libde265-1.0.19.tar.gz) = 339abd96eec64d11f9b87a8cf2f1049ca8a0267bc2428c82594c3370b886d175
-SHA512 (libde265-1.0.19.tar.gz) = 8436524d7af3e3efbd5009cdcd1627c747013db49e693f3c3e9484af8db0b22f21d16096a0a908b6a9484463c3aaee14153656bc2d2eb645501cccb3c5950791
-Size (libde265-1.0.19.tar.gz) = 291375 bytes
+BLAKE2s (libde265-1.1.0.tar.gz) = fe0afdd616d89aee0081eb0533fd7d8b6fc6d877df9f216e8a96de8461447a34
+SHA512 (libde265-1.1.0.tar.gz) = 46298017e2852c744cc0fa20225fc3f1d1cfb9730e54b1569b8fbfc68f7219c5e7dd8517ac6f80d1f338a439fc7f873126a9f61ecefe87418259cb453d3311d2
+Size (libde265-1.1.0.tar.gz) = 294030 bytes
 SHA1 (patch-CMakeLists.txt) = 8634ecedecea2da040ade750938cfb83c7171a70
 SHA1 (patch-cmake_config.h.in) = 5d37e8331db11c93cb31c2aaf9074f7b3f1a8877