diff --git a/CVE-2024-40724-Fix-out-of-bound-access-5651.patch b/CVE-2024-40724-Fix-out-of-bound-access-5651.patch deleted file mode 100644 index ef009b98f53eba74fc73c25d94d4b713f24fd756..0000000000000000000000000000000000000000 --- a/CVE-2024-40724-Fix-out-of-bound-access-5651.patch +++ /dev/null @@ -1,27 +0,0 @@ -From ddb74c2bbdee1565dda667e85f0c82a0588c8053 Mon Sep 17 00:00:00 2001 -From: Kim Kulling -Date: Wed, 3 Jul 2024 21:37:24 +0200 -Subject: [PATCH] Fix out of bound access (#5651) - ---- - code/AssetLib/Ply/PlyLoader.cpp | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/code/AssetLib/Ply/PlyLoader.cpp b/code/AssetLib/Ply/PlyLoader.cpp -index 783c7f1..e109541 100644 ---- a/code/AssetLib/Ply/PlyLoader.cpp -+++ b/code/AssetLib/Ply/PlyLoader.cpp -@@ -567,6 +567,10 @@ void PLYImporter::LoadFace(const PLY::Element *pcElement, const PLY::ElementInst - if (mGeneratedMesh->mFaces == nullptr) { - mGeneratedMesh->mNumFaces = pcElement->NumOccur; - mGeneratedMesh->mFaces = new aiFace[mGeneratedMesh->mNumFaces]; -+ } else { -+ if (mGeneratedMesh->mNumFaces < pcElement->NumOccur) { -+ throw DeadlyImportError("Invalid .ply file: Too many faces"); -+ } - } - - if (!bIsTriStrip) { --- -2.41.0 - diff --git a/assimp-5.3.1-free.tar.xz b/assimp-5.4.2-free.tar.xz similarity index 59% rename from assimp-5.3.1-free.tar.xz rename to assimp-5.4.2-free.tar.xz index 81687a33f48f96dc2f183f051f2273c62e4dc221..4564f6ebcb96be23122ead7c3f28ece55e725d4c 100644 Binary files a/assimp-5.3.1-free.tar.xz and b/assimp-5.4.2-free.tar.xz differ diff --git a/assimp.spec b/assimp.spec index 1a8dfea6ab0cd233a949bfbe918f677f53c1f4d7..cc09a0e78eca51a6c05ef7e8c3b7bfbefbe7cbc7 100644 --- a/assimp.spec +++ b/assimp.spec @@ -1,6 +1,6 @@ Name: assimp -Version: 5.3.1 -Release: 3 +Version: 5.4.2 +Release: 1 Summary: Library to load and process various 3D model formats into applications. License: BSD and MIT and LGPL-2.1 and LGPL-2.0 and GPL-2.0 and LGPL-3.0 and GPL-3.0 URL: http://www.assimp.org/ @@ -12,8 +12,6 @@ URL: http://www.assimp.org/ #tar czf assimp-%{version}-free.tar.xz assimp-%{version} Source0: assimp-%{version}-free.tar.xz -Patch01: CVE-2024-40724-Fix-out-of-bound-access-5651.patch - BuildRequires: gcc-c++ boost-devel cmake dos2unix irrlicht-devel irrXML-devel BuildRequires: doxygen poly2tri-devel gtest-devel pkgconfig(zziplib) BuildRequires: pkgconfig(zlib) pkgconfig(minizip) gmock-devel make @@ -92,6 +90,9 @@ install -m 0644 port/PyAssimp/pyassimp/*.py %{buildroot}%{python3_sitelib}/pyass %{python3_sitelib}/pyassimp %changelog +* Wed Jul 24 2024 xuguangmin - 5.4.2-1 +- Update to 5.4.2 version + * Mon Jul 22 2024 yinyongkang - 5.3.1-3 - fix CVE-2024-40724