diff --git a/0978918f7148fbcd3d05cc6573dae7859975a895.patch b/0978918f7148fbcd3d05cc6573dae7859975a895.patch new file mode 100644 index 0000000..b5c1569 --- /dev/null +++ b/0978918f7148fbcd3d05cc6573dae7859975a895.patch @@ -0,0 +1,24 @@ +diff -rupN --no-dereference assimp-6.0.2/code/AssetLib/Q3D/Q3DLoader.cpp assimp-6.0.2-new/code/AssetLib/Q3D/Q3DLoader.cpp +--- assimp-6.0.2/code/AssetLib/Q3D/Q3DLoader.cpp 2025-06-08 21:50:39.000000000 +0200 ++++ assimp-6.0.2-new/code/AssetLib/Q3D/Q3DLoader.cpp 2025-12-14 20:02:55.733930684 +0100 +@@ -55,6 +55,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE + #include + #include + ++#include ++ + namespace Assimp { + + static constexpr aiImporterDesc desc = { +@@ -309,6 +311,11 @@ void Q3DImporter::InternReadFile(const s + throw DeadlyImportError("Quick3D: Invalid texture. Width or height is zero"); + } + ++ const unsigned int uint_max = std::numeric_limits::max(); ++ if (tex->mWidth > (uint_max / tex->mHeight)) { ++ throw DeadlyImportError("Quick3D: Texture dimensions are too large, resulting in overflow."); ++ } ++ + unsigned int mul = tex->mWidth * tex->mHeight; + aiTexel *begin = tex->pcData = new aiTexel[mul]; + aiTexel *const end = &begin[mul - 1] + 1; diff --git a/assimp.spec b/assimp.spec index 9424c0a..c5adec9 100644 --- a/assimp.spec +++ b/assimp.spec @@ -2,7 +2,7 @@ Name: assimp Version: 6.0.2 -Release: 3%{?dist} +Release: 6%{?dist} Summary: Library to import various 3D model formats into applications # Assimp is BSD @@ -33,6 +33,11 @@ Patch2: %{name}-nozlib.patch Patch3: %{name}-docs.patch # Enable ctest Patch4: %{name}-tests.patch +# Backport fix for CVE-2025-11277 +Patch5: https://github.com/assimp/assimp/commit/0978918f7148fbcd3d05cc6573dae7859975a895.patch +# PyAssimp: Re-add 'aiProcess_Triangulate' (#2423174) +Patch6: https://github.com/assimp/assimp/commit/dd98d4aea3d9d2b3544540ea44eeb15c3616dbb7.patch + BuildRequires: boost-devel BuildRequires: cmake @@ -170,6 +175,15 @@ install -m0644 port/PyAssimp/pyassimp/*.py %{buildroot}%{python3_sitelib}/pyassi %changelog +* Fri Jan 16 2026 Fedora Release Engineering - 6.0.2-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Sat Dec 27 2025 Sandro Mani - 6.0.2-5 +- PyAssimp: Re-add 'aiProcess_Triangulate' (#2423174) + +* Sun Dec 14 2025 Sandro Mani - 6.0.2-4 +- Backport fix for CVE-2025-11277 + * Fri Sep 19 2025 Python Maint - 6.0.2-3 - Rebuilt for Python 3.14.0rc3 bytecode diff --git a/dd98d4aea3d9d2b3544540ea44eeb15c3616dbb7.patch b/dd98d4aea3d9d2b3544540ea44eeb15c3616dbb7.patch new file mode 100644 index 0000000..c29e9fb --- /dev/null +++ b/dd98d4aea3d9d2b3544540ea44eeb15c3616dbb7.patch @@ -0,0 +1,30 @@ +diff -rupN --no-dereference assimp-6.0.2/port/PyAssimp/pyassimp/postprocess.py assimp-6.0.2-new/port/PyAssimp/pyassimp/postprocess.py +--- assimp-6.0.2/port/PyAssimp/pyassimp/postprocess.py 2025-06-08 21:50:39.000000000 +0200 ++++ assimp-6.0.2-new/port/PyAssimp/pyassimp/postprocess.py 2025-12-27 19:11:08.846657557 +0100 +@@ -36,13 +36,21 @@ aiProcess_JoinIdenticalVertices = 0x2 + # + aiProcess_MakeLeftHanded = 0x4 + +-##
Triangulates all faces of all meshes. ++##
Triangulates all faces of all meshes. + # + # By default the imported mesh data might contain faces with more than 3 +-# indices. For rendering you'll usually want all faces to be triangles. +-# This post processing stepaiProcess_ForceGenNormals +-##
Removes some parts of the data structure (animations, materials, +-# light sources, cameras, textures, vertex components). ++# indices. For rendering you'll usually want all faces to be triangles. ++# This post processing step splits up faces with more than 3 indices into ++# triangles. Line and point primitives are *not* modified! If you want ++# 'triangles only' with no other kinds of primitives, try the following ++# solution: ++# - Specify both #aiProcess_Triangulate and #aiProcess_SortByPType ++# - Ignore all point and line meshes when you process assimp's output ++# ++aiProcess_Triangulate = 0x8 ++ ++#
Removes some parts of the data structure (animations, materials, ++# light sources, cameras, textures, vertex components). + # + # The components to be removed are specified in a separate + # configuration option, #AI_CONFIG_PP_RVC_FLAGS. This is quite useful