Hi!

[ Reason ]

This update includes a SIGFPE fix due to a division by zero. This was
found to affect rtpengine when processing SIP packets from external
sources, which can cause crashes and DoS scenarios for example on VoIP
services.

[ Impact ]

Crashes/DoS, loss of VoIP service.

[ Tests ]

Richard Fuchs (CCed) tested this when filing this upstream [U], and now
again with the packages I've built. He prepared the attached test program
and the following test session, which shows the SIGFPE with the unfixed
packages, and how the SIGFPE no longer applies once fixed.

  [U] https://github.com/BelledonneCommunications/bcg729/issues/21

  ,---
  # dpkg -l libbcg729\*
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name                     Version      Architecture Description
  +++-========================-============-============-==========================================================
  ii  libbcg729-0:amd64        1.1.1-3      amd64        ITU G.729 Annex A compatible audio codec
  ii  libbcg729-0-dbgsym:amd64 1.1.1-3      amd64        debug symbols for libbcg729-0
  ii  libbcg729-dev:amd64      1.1.1-3      amd64        Development files for the ITU G.729 compatible audio codec
  # gcc test.c -o test -lbcg729
  # ./test
  Floating point exception (core dumped)
  # 136 # ls -la *deb
  -rw-r--r-- 1 root root 35600 Jul 28 21:10 libbcg729-0_1.1.1-3+deb13u1_amd64.deb
  -rw-r--r-- 1 root root 70472 Jul 28 21:10 libbcg729-0-dbgsym_1.1.1-3+deb13u1_amd64.deb
  -rw-r--r-- 1 root root  8320 Jul 28 21:10 libbcg729-dev_1.1.1-3+deb13u1_amd64.deb
  # dpkg -i *.deb
  (Reading database ... 174488 files and directories currently installed.)
  Preparing to unpack libbcg729-0_1.1.1-3+deb13u1_amd64.deb ...
  Unpacking libbcg729-0:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
  Preparing to unpack libbcg729-0-dbgsym_1.1.1-3+deb13u1_amd64.deb ...
  Unpacking libbcg729-0-dbgsym:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
  Preparing to unpack libbcg729-dev_1.1.1-3+deb13u1_amd64.deb ...
  Unpacking libbcg729-dev:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
  Setting up libbcg729-0:amd64 (1.1.1-3+deb13u1) ...
  Setting up libbcg729-0-dbgsym:amd64 (1.1.1-3+deb13u1) ...
  Setting up libbcg729-dev:amd64 (1.1.1-3+deb13u1) ...
  Processing triggers for libc-bin (2.41-12+deb13u3) ...
  # dpkg -l libbcg729\*
  Desired=Unknown/Install/Remove/Purge/Hold
  | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
  |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
  ||/ Name                     Version         Architecture Description
  +++-========================-===============-============-==========================================================
  ii  libbcg729-0:amd64        1.1.1-3+deb13u1 amd64        ITU G.729 Annex A compatible audio codec
  ii  libbcg729-0-dbgsym:amd64 1.1.1-3+deb13u1 amd64        debug symbols for libbcg729-0
  ii  libbcg729-dev:amd64      1.1.1-3+deb13u1 amd64        Development files for the ITU G.729 compatible audio codec
  # ./test
  `---

[ Risks ]

This has been present in Debian unstable and testing for a while now. It
seems like the targeted fix has low risk.

[ Checklist ]

  [√] *all* changes are documented in the d/changelog
  [√] I reviewed all changes and I approve them
  [√] attach debdiff against the package in (old)stable
  [√] the issue is verified as fixed in unstable

[ Changes ]

The fix checks for one of the values to avoid a division by zero, that
then would otherwise cause a SIGFPE.

Thanks,
Guillem