Dear Release Team,

I would like to request a transition slot for libcec, which I just
dput.

Upstream 8.1.6 bumps SONAME from libcec.so.7 to libcec.so.8, so shared
library package is renamed libcec7 -> libcec8. No API changes that
affect the reverse dependencies. (The ABI change is just the addition
of three fields at the end of libcec_configuration.)

  unstable now:   libcec 7.1.1-2   (libcec7)
  to be uploaded: libcec 8.1.6+dfsg-1   (libcec8)

Reverse dependencies of libcec7, and what they need:

  kodi                       (kodi-bin)
  vdr-plugin-xineliboutput   (xineliboutput-fbfe, xineliboutput-sxfe,
                              xineliboutput-wlfe)

Both need only a binNMU. The development package is libcec-dev,
unversioned.

Notes:

* This has to clear NEW before the transition can start. It introduces
libcec8, and also new binary packages for rust and nodejs bindings.

* Upstream fixed a handful of buffer overflows in 8.0.0, and 7.1.1-2
in the archive still has them. No CVEs have been assigned, there is no
entry for src:libcec in the security tracker, and I am not requesting
that this be handled as a security upload. But still...

The four (4) security issues are:

 1. CCECCommandHandler::HandleSetOSDName copies the whole CEC
    datapacket into a 17-byte stack buffer with no bound. A datapacket
    is up to 64 bytes, so any device on the HDMI bus can overflow it
    by about 47 attacker-chosen bytes by sending a long SET_OSD_NAME.
    This is reachable in kodi-bin. Fixed in upstream commit f65762b9.

The rest need either a hostile/broken display or a hostile USB adapter:

 2. CUSBCECAdapterCommands::RequestSetting memcpy()s a reply length
    taken from the adapter into a fixed cec_datapacket. Fixed in
    upstream commit 16c1e13d.

 3. The EDID readers (nvidia, drm) read an unbounded fgetc loop into a
    4096-byte buffer, and the shared parser underflows (size - 4) for
    sizes 1..4 and reads out of bounds. EDID comes from the connected
    display via sysfs/procfs. Fixed in upstream commit 94e37582.

 4. String copy sizes in the cecc-client example, upstream issue #708.
    Fixed in upstream commit 01769988.

Ben file:

title = "libcec";
is_affected = .depends ~ "libcec7" | .depends ~ "libcec8";
is_good = .depends ~ "libcec8";
is_bad = .depends ~ "libcec7";

Cheers,

Control: tags -1 moreinfo

This is very small, but it will probably clash with other multimedia
transitions. So please upload to experimental first, and let us know once the
package has been accepted.

Cheers,
Emilio