[Buildroot] [PATCH] package/libaec: security bump to version 1.1.8

[Buildroot] [PATCH] package/libaec: security bump to version 1.1.8

[Yegor Yefremov]

Fixes several memory safety issues in the decoder and the SZIP
compatibility layer, among them heap buffer overflows in
SZ_BufftoBuffCompress with negative parameters and when decoding is
resumed after AEC_DATA_ERROR, and an out-of-bounds read for very long
fundamental sequences. No CVE has been assigned.

For more details, see the changelog:
https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.8/CHANGELOG.md

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
---
 package/libaec/libaec.hash | 2 +-
 package/libaec/libaec.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/libaec/libaec.hash b/package/libaec/libaec.hash
index cf4984447f..70e02d2a35 100644
--- a/package/libaec/libaec.hash
+++ b/package/libaec/libaec.hash
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  cc7b93be9002e25a88b45d6b8d5f6120756cb5e1000613f91d803ce0beba24d9  libaec-1.1.7.tar.gz
+sha256  660dc7cef65e1749a773439e39b25a7a6cee8f4c6d9739409dea037fac8ff4c7  libaec-1.1.8.tar.gz
 sha256  9fdabba96fbc46af0ca018f86329f1e06e873b25801732001128d5afca265e36  LICENSE.txt
diff --git a/package/libaec/libaec.mk b/package/libaec/libaec.mk
index d631230be6..e27ec72b18 100644
--- a/package/libaec/libaec.mk
+++ b/package/libaec/libaec.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBAEC_VERSION = 1.1.7
+LIBAEC_VERSION = 1.1.8
 LIBAEC_SITE = https://github.com/Deutsches-Klimarechenzentrum/libaec/releases/download/v$(LIBAEC_VERSION)
 LIBAEC_LICENSE = BSD-2-Clause
 LIBAEC_LICENSE_FILES = LICENSE.txt
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libaec: security bump to version 1.1.8

[Peter Korsgaard]

>>>>> "Yegor" == Yegor Yefremov <yegorslists@googlemail.com> writes:

 > Fixes several memory safety issues in the decoder and the SZIP
 > compatibility layer, among them heap buffer overflows in
 > SZ_BufftoBuffCompress with negative parameters and when decoding is
 > resumed after AEC_DATA_ERROR, and an out-of-bounds read for very long
 > fundamental sequences. No CVE has been assigned.

 > For more details, see the changelog:
 > https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.8/CHANGELOG.md

 > Assisted-by: Claude:claude-opus-5-5
 > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>

Committed, thanks.

Notice: My tar complains about some unknown extension headers:

tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libaec: security bump to version 1.1.8

[Yegor Yefremov]

Hi Peter,

On Tue, Nov 10, 2026 at 6:19 PM Peter Korsgaard <peter@korsgaard.com> wrote:
>
> >>>>> "Yegor" == Yegor Yefremov <yegorslists@googlemail.com> writes:
>
>  > Fixes several memory safety issues in the decoder and the SZIP
>  > compatibility layer, among them heap buffer overflows in
>  > SZ_BufftoBuffCompress with negative parameters and when decoding is
>  > resumed after AEC_DATA_ERROR, and an out-of-bounds read for very long
>  > fundamental sequences. No CVE has been assigned.
>
>  > For more details, see the changelog:
>  > https://github.com/Deutsches-Klimarechenzentrum/libaec/blob/v1.1.8/CHANGELOG.md
>
>  > Assisted-by: Claude:claude-opus-5-5
>  > Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
>
> Committed, thanks.
>
> Notice: My tar complains about some unknown extension headers:
>
> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'

Good catch. I opened a related issue:
https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/69

Yegor
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/libaec: security bump to version 1.1.8

[Peter Korsgaard]

>>>>> "Yegor" == Yegor Yefremov <yegorslists@googlemail.com> writes:

Hi,

 >> Notice: My tar complains about some unknown extension headers:
 >> 
 >> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
 >> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'
 >> tar: Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'

 > Good catch. I opened a related issue:
 > https://github.com/Deutsches-Klimarechenzentrum/libaec/issues/69

Thanks!

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot