Bug#1144469: transition: libcec

Package: release.debian.org
User: [email protected]
Usertags: transition

Dear Release Team,

I would like to request a transition slot for libcec, which I just
dput.

Upstream 8.1.6 bumps SONAME from libcec.so.7 to libcec.so.8, so shared
library package is renamed libcec7 -> libcec8. No API changes that
affect the reverse dependencies. (The ABI change is just the addition
of three fields at the end of libcec_configuration.)

  unstable now:   libcec 7.1.1-2   (libcec7)
  to be uploaded: libcec 8.1.6+dfsg-1   (libcec8)

Reverse dependencies of libcec7, and what they need:

  kodi                       (kodi-bin)
  vdr-plugin-xineliboutput   (xineliboutput-fbfe, xineliboutput-sxfe,
                              xineliboutput-wlfe)

Both need only a binNMU. The development package is libcec-dev,
unversioned.

Notes:

* This has to clear NEW before the transition can start. It introduces
libcec8, and also new binary packages for rust and nodejs bindings.

* Upstream fixed a handful of buffer overflows in 8.0.0, and 7.1.1-2
in the archive still has them. No CVEs have been assigned, there is no
entry for src:libcec in the security tracker, and I am not requesting
that this be handled as a security upload. But still...

The four (4) security issues are:

 1. CCECCommandHandler::HandleSetOSDName copies the whole CEC
    datapacket into a 17-byte stack buffer with no bound. A datapacket
    is up to 64 bytes, so any device on the HDMI bus can overflow it
    by about 47 attacker-chosen bytes by sending a long SET_OSD_NAME.
    This is reachable in kodi-bin. Fixed in upstream commit f65762b9.

The rest need either a hostile/broken display or a hostile USB adapter:

 2. CUSBCECAdapterCommands::RequestSetting memcpy()s a reply length
    taken from the adapter into a fixed cec_datapacket. Fixed in
    upstream commit 16c1e13d.

 3. The EDID readers (nvidia, drm) read an unbounded fgetc loop into a
    4096-byte buffer, and the shared parser underflows (size - 4) for
    sizes 1..4 and reads out of bounds. EDID comes from the connected
    display via sysfs/procfs. Fixed in upstream commit 94e37582.

 4. String copy sizes in the cecc-client example, upstream issue #708.
    Fixed in upstream commit 01769988.

Ben file:

title = "libcec";
is_affected = .depends ~ "libcec7" | .depends ~ "libcec8";
is_good = .depends ~ "libcec8";
is_bad = .depends ~ "libcec7";

Cheers,

--Barak