<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="12">
<package pkgid="600638a83ff48e6fc7bc36808f86452405fd512d60be3d5bb6c2b61a67f2a958" name="iperf" arch="src">
  <version epoch="0" ver="3.20" rel="lp155.2.1"/>
  <changelog author="msvec@suse.com" date="1520856000">- update to 3.5
  * Bug fixes mostly</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1530878400">- update to 3.6
  * A new --extra-data option can be used to fill in a user-defined
    string field that appears in JSON output.
  * A new --repeating-payload option makes iperf3 use a payload pattern
    similar to that used by iperf2, which could help in recreating
    results that might be affected by payload entropy (for example,
    compression).
  * -B now works properly with SCTP tests.
  * A compile fix for Solaris 10 was added.
  * Some minor bug fixes for JSON output.  In particular, warnings for
    debug and/or verbose modes with --json output and a fix for
    JSON output on CentOS 6</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1573732800">- update to 3.7
  * Support for simultaneous bidirectional tests with the --bidir flag
  * Use POSIX standard clock_gettime(3) interface for timekeeping where
    available
  * Passwords for authentication can be provided via environment
    variable
  * Specifying --repeating-payload and --reverse now works
  * Failed authentication doesn't count for --one-off
  * Several memory leaks related to authenticated use were fixed
  * The delay for tearing down the control connection for the default
    timed tests has been increased, to more gracefully handle
    high-delay paths
  * Various improvements to the libiperf APIs
  * Fixed build behavior when OpenSSL is absent
  * Portability fixes
- spec file cleanup</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1594468800">- update to 3.8.1
  * Minor bugfixes and enhancements
- don't apply the profiling patch any more
  (removed iperf-disable-profiling.patch)</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600084800">- update to 3.9:
  * A --timestamps flag has been added, which prepends a timestamp to
    each output line.  An optional argument to this flag, which is a
    format specification to strftime(3), allows for custom timestamp
    formats (#909, #1028).
  * A --server-bitrate-limit flag has been added as a server-side
    command-line argument.  It allows a server to enforce a maximum
    throughput rate; client connections that specify a higher bitrate
    or exceed this bitrate during a test will be terminated.  The
    bitrate is expressed in bits per second, with an optional trailing
    slash and integer count that specifies an averaging interval over
    which to enforce the limit (#999).
  * A bug that caused increased CPU usage with the --bidir option has
    been fixed (#1011).
  * Fixed various minor memory leaks (#1023).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067200">- update to 3.10:
  * Fix a bug where some --reverse tests didn't terminate (#982 /
    [#1054]).
  * Responsiveness of control connections is slightly improved (#1045
    / #1046 / #1063).
  * The allowable clock skew when doing authentication between client
    and server is now configurable with the new --time-skew-threshold
    (#1065 / #1070).
  * Bitrate throttling using the -b option now works when a burst size
    is specified (#1090).
  * A bug with calculating CPU utilization has been fixed (#1076 /
    [#1077]).
  * A --bind-dev option to support binding sockets to a given network
    interface has been added to make iperf3 work better with
    multi-homed machines and/or VRFs (#817 / #1089 / #1097).
  * --pidfile now works with --client mode (#1110).
  * The server is now less likely to get stuck due to network errors
    (#1101, #1125), controlled by the new --rcv-timeout option.
  * Fixed a few bugs in termination conditions for byte or
    block-limited tests (#1113, #1114, #1115).
  * Added tcp_info.snd_wnd to JSON output (#1148).
  * Some bugs with garbled JSON output have been fixed (#1086, #1118,
    [#1143] / #1146).
  * Support for setting the IPv4 don't-fragment (DF) bit has been
    added with the new --dont-fragment option (#1119).
  * A failure with not being able to read the congestion control
    algorithm under WSL1 has been fixed (#1061 / #1126).
  * Error handling and error messages now make more sense in cases
    where sockets were not successfully opened (#1129 / #1132 /
    [#1136], #1135 / #1138, #1128 / #1139).
  * Some buffer overflow hazards were fixed (#1134).
  * It is now possible to use the API to set/get the congestion
    control algorithm (#1036 / #1112).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067201">- update to 3.10.1:
  * Fixed a problem with autoconf scripts that made builds fail in
    some environments (#1154 / #1155).
  * GNU autoconf 2.71 or newer is now required to regenerate iperf3's
    configure scripts.</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1646308800">- update to 3.11:
  * Update links to Discussions in documentation
  * Fix DSCP so that TOS = DSCP * 4 (#1162)
  * Fix --bind-dev for TCP streams (#1153)
  * Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180)
  * Add get/set test_unit_format function declaration to iperf_api.h
  * Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes
  * Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197)
  * Support zerocopy by reverse mode (#1204)
  * Update help and manpage text for #1157, support bind device
  * Consistently print target_bandwidth in JSON start section (#1177)
  * Test bitrate added to JSON output (#1168)
  * Remove fsync call after every write to receiving --file (#1176, #1159)
  * Update documentation for -w (#1175)
  * Fix for #952, different JSON object names for bidir reverse channel</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 3.12:
  * cJSON has been updated to version 1.7.15 (#1383).
  * The --bind &lt;host&gt;%&lt;dev&gt; option syntax now works properly (#1360 /
  * A server-side file descriptor leak with the --logfile option has
    been fixed (#1369 / #1360 / #1369 / #1389 / #1393).
  * A bug that caused some large values from TCP_INFO to be misprinted
    as negative numbers has been fixed (#1372).
  * Using the -k or -n flags with --reverse no longer leak into future
    tests (#1363 / #1364).
  * There are now various debug level options available with the
  - -debug option. These can be used to adjust the amount of
    debugging output (#1327).
  * A new --snd-timeout option has been added to set a termination
    timeout for idle TCP connections (#1215 / #1282).
  * iperf3 is slightly more robust to out-of-order packets during UDP
    connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 /
  * iperf3 will now use different ports for each direction when the
  - -cport and --bdir options are set (#1249 / #1259).
  * The iperf3 server will now exit if it can't open its log file
  * Various help message and output fixes have been made (#1299 /
  * Various compiler warnings have been fixed (#1211 / #1316).
  * Operation of bootstrap.sh has been fixed and simplified (#1335 /
  * Flow label support / compatibility under Linux has been improved
  * Various minor memory leaks have been fixed (#1332 / #1333).
  * A getter/setter has been added for the bind_port parameter
    (--cport option). (#1303, #1305)
  * Various internal documentation improvements (#1265 / #1285 / #1304).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678190400">- update to 3.13:
  * Added missing bind_dev getter and setter.
  * a fix for A resource leak bug in function iperf_create_pidfile (#1443)
  * doc: Fix copy-and-paste error leading to wrong error message
  * Fix crash on rcv-timeout with JSON logfile</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1689854400">- update to 3.14 (bsc#1213430, CVE-2023-38403):
  * fixes a memory allocation hazard that allowed a remote user to
    crash an iperf3 process
  * see
    https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
  * obsoletes CVE-2023-38403.patch in older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695470400">- update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):
  * Several bugs that could allow the iperf3 server to hang waiting
    for input on the control connection has been fixed
    (ESnet Software Security Advisory ESNET-SECADV-2023-0002)
  * A bug that caused garbled output with UDP tests on 32-bit hosts
    has been fixed (PR #1554, PR #1556). This bug was introduced in
    iperf-3.14.
  * A bug in counting UDP messages has been fixed</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1703678400">- update to 3.16:
  * Multiple test streams started with -P/--parallel will now be
    serviced by different threads. This allows iperf3 to take
    advantage of multiple CPU cores on modern processors, and will
    generally result in significant throughput increases
  * OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
    various older, deprecated, APIs will not be used. iperf3 will
    continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
    of the iperf3 authentication functionality
  * The authorized users file used by the authentication
    functionality is now checked for accessibility much earlier
    during the program startup, as opposed to being checked near
    the start of a test (Issue #1583, PR #1585).
  * BREAKING CHANGE: iperf3 now requires pthreads and C atomic
    variables to compile and run.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1715774400">- update to 3.17.1 (bsc#1224262, CVE-2024-26306):
  * BREAKING CHANGE: iperf3's authentication features, when used
    with OpenSSL prior to 3.2.0, contain a vulnerability to a
    side-channel timing attack. To address this flaw, a change
    has been made to the padding applied to encrypted strings.
    This change is not backwards compatible with older versions of
    iperf3 (before 3.17). To restore
    the older (vulnerable) behavior, and hence
    backwards-compatibility, use the --use-pkcs1-padding flag. The
    iperf3 team thanks Hubert Kario from RedHat for reporting this
    issue and providing feedback on the fix. (CVE-2024-26306)(PR#1695)
  * iperf3 no longer changes its current working directory in --daemon
    mode. This results in more predictable behavior with relative
    paths, in particular finding key and credential files for
    authentication. (PR#1672)
  * A new --json-stream option has been added to enable a streaming
    output format, consisting of a series of JSON objects (for the
    start of the test, each measurement interval, and the end of the
    test) separated by newlines (#444, #923, #1098).
  * UDP tests now work correctly between different endian hosts
  * The --fq-rate parameter now works for --reverse tests
  * The statistics reporting interval is now available in the --json
    start test object (#1663).
  * A negative time test duration is now properly flagged as an error
    (IS#1662 / PR#1666).</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;georg.pfuetzenreuter@suse.com&gt;" date="1731672000">- Build with OpenSSL for key based authentication support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1737979200">- update to 3.18 (bsc#1234705, CVE-2024-53580):
  * SECURITY NOTE: Thanks to Leonid Krolle Bi.Zone for
    discovering a JSON type security vulnerability that caused a
    segmentation fault in the server. (CVE-2024-53580)
    This has now been fixed. (PR#1810)
  * UDP packets per second now reports the correct number of
    packets, by reporting NET_SOFTERROR if there's a EAGAIN/EINTR
    errno if no data was sent (#1367/PR#1379).
  * Several segmentation faults related to threading were fixed.
    One where `pthread_cancel` was called on an improperly
    initialized thread (#1801), another where threads were being
    recycled (#1760/PR#1761), and another where threads were
    improperly handling signals (#1750/PR#1752).
  * A segmentation fault from calling `freeaddrinfo` with `NULL`
    was fixed (PR#1755).
  * Some JSON options were fixed, including checking the size for
    `json_read` (PR#1709), but the size limit was removed for
    received server output (PR#1779).
  * A rcv-timeout error has been fixed. The Nread timeout was
    hardcoded and timed out before the `--rcv-timeout` option
  * There is no longer a limit on the omit time period
  * Fixed an output crash under 32-bit big-endian systems
  * An issue was fixed where CPU utilization was unexpectedly
    high during limited baud rate tests. The `--pacing-timer`
    option was removed, but it is still available in the library
  * Add SCTP information to `--json` output and fixed compile
    error when SCTP is not supported (#1731).
  * `--fq-rate` was changed from a uint to a uint64 to allow
    pacing above 32G.  Not yet tested on big-endian systems</changelog>
  <changelog author="pgajdos@suse.com" date="1746619200">- added patches
  https://github.com/esnet/iperf/commit/beadb59b90e8d3339d31f9f15525108072fde135
  + iperf-gcc15.patch</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1747828800">- update to 3.19
  * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
    with the use of the `-m` or `--mptcp` flag. (PR #1661)
  * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
    on the control connection. (#812, #835, PR #1423)
  * iperf3 now supports the `MSG_TRUNC` receive option, specified by
    the `--skip-rx-copy`. This theoretically improves the rated
    throughput of tests at high bitrates by not delivering network
    payload data to userspace. (#1678, PR #1717)
  * A bug that caused the bitrate setting to be ignored when bursts
    are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
  * The congestion control protocol setting, if used, is now
    properly reset between tests. (PR #1812)
  * iperf3 now exits with a non-error 0 exit code if exiting via a
    `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
  * The current behavior of iperf3 with respect to the `-n` and `-k`
    options is now documented as correct. (#1768, #1775, #596, PR #1800)
- switched to official sources from https://downloads.es.net/pub/iperf/
  following the note on https://software.es.net/iperf/obtaining.html#source-distributions
  GitHub releases are not guaranteed to always be released with
  proper checksums, signage and downloads.
- removed patches: iperf-gcc15.patch (included upstream)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1754308800">- update to 3.19.1:
  * SECURITY NOTE: Thanks to Han Lee with Apple Information
    Security for finding and reporting several memory errors
  * off-by-one heap overflow has been fixed in authentication
    (bsc#1247519, CVE-2025-54349, ESNET-SECADV-2025-0003)
  * assert in authentication has been removed
    (bsc#1247520, CVE-2025-54350, ESNET-SECADV-2025-0002)
  * a buffer overflow in the --skip-rx-copy option for zerocopy
    has been fixed (bsc#1247522, CVE-2025-54351,
    ESNET-SECADV-2025-0001)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1765281600">- update to 3.20:
  * Millisecond-resolution representations have been added to JSON
    timestamps. (PR #1846)
  * The reorder_seen metric, where available, is now available in
    the JSON output. (PR #1278)
  * A division by zero error has been fixed. (PR #1906)
  * Some command-line options were not properly restricted to the
    client or server; this problem has been fixed. (#1892 / PR #1894)
  * The combination of `--udp` and `--file` is now explicitly
    disallowed. (PR #1909)
  * It is now possible to get both the full JSON result object as
    well as streaming intermediate JSON result objects. This
    functionality is enabled by using the new `--json-stream-full`
    command-line flag, in addition to the existing `--json-stream`
    flag (PR #1903)
  * Sends with `--zerocopy` are now properly seeded with data
    instead of being all-zeroes. (PR #1949)
  * The `--server-max-duration` flag is now allowed on the iperf3
    server to impose a maximum duration on timed tests. (PR #1684)
  * The `--rcv-timeout` flag is now ignored for `--bidir` tests.
    This change prevents premature termination of bidirectional
    tests. (#1766 / PR #1946)
  * Several errors in the authentication code were uncovered when
    building with OpenSSL 3.5.3 and later versions. These were
    fixed. (#1951 / PR #1956)
  * Various issues in the iperf3 manual page were fixed up. (PR
    [#1887], PR #1927, PR #1936, PR #1941, #1891 / PR #1952)</changelog>
</package>
<package pkgid="4655cec065466413c060f07e7796571af4b2bd8fdd239722e917fe10492a4946" name="iperf" arch="x86_64">
  <version epoch="0" ver="3.20" rel="lp155.2.1"/>
  <changelog author="msvec@suse.com" date="1520856000">- update to 3.5
  * Bug fixes mostly</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1530878400">- update to 3.6
  * A new --extra-data option can be used to fill in a user-defined
    string field that appears in JSON output.
  * A new --repeating-payload option makes iperf3 use a payload pattern
    similar to that used by iperf2, which could help in recreating
    results that might be affected by payload entropy (for example,
    compression).
  * -B now works properly with SCTP tests.
  * A compile fix for Solaris 10 was added.
  * Some minor bug fixes for JSON output.  In particular, warnings for
    debug and/or verbose modes with --json output and a fix for
    JSON output on CentOS 6</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1573732800">- update to 3.7
  * Support for simultaneous bidirectional tests with the --bidir flag
  * Use POSIX standard clock_gettime(3) interface for timekeeping where
    available
  * Passwords for authentication can be provided via environment
    variable
  * Specifying --repeating-payload and --reverse now works
  * Failed authentication doesn't count for --one-off
  * Several memory leaks related to authenticated use were fixed
  * The delay for tearing down the control connection for the default
    timed tests has been increased, to more gracefully handle
    high-delay paths
  * Various improvements to the libiperf APIs
  * Fixed build behavior when OpenSSL is absent
  * Portability fixes
- spec file cleanup</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1594468800">- update to 3.8.1
  * Minor bugfixes and enhancements
- don't apply the profiling patch any more
  (removed iperf-disable-profiling.patch)</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600084800">- update to 3.9:
  * A --timestamps flag has been added, which prepends a timestamp to
    each output line.  An optional argument to this flag, which is a
    format specification to strftime(3), allows for custom timestamp
    formats (#909, #1028).
  * A --server-bitrate-limit flag has been added as a server-side
    command-line argument.  It allows a server to enforce a maximum
    throughput rate; client connections that specify a higher bitrate
    or exceed this bitrate during a test will be terminated.  The
    bitrate is expressed in bits per second, with an optional trailing
    slash and integer count that specifies an averaging interval over
    which to enforce the limit (#999).
  * A bug that caused increased CPU usage with the --bidir option has
    been fixed (#1011).
  * Fixed various minor memory leaks (#1023).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067200">- update to 3.10:
  * Fix a bug where some --reverse tests didn't terminate (#982 /
    [#1054]).
  * Responsiveness of control connections is slightly improved (#1045
    / #1046 / #1063).
  * The allowable clock skew when doing authentication between client
    and server is now configurable with the new --time-skew-threshold
    (#1065 / #1070).
  * Bitrate throttling using the -b option now works when a burst size
    is specified (#1090).
  * A bug with calculating CPU utilization has been fixed (#1076 /
    [#1077]).
  * A --bind-dev option to support binding sockets to a given network
    interface has been added to make iperf3 work better with
    multi-homed machines and/or VRFs (#817 / #1089 / #1097).
  * --pidfile now works with --client mode (#1110).
  * The server is now less likely to get stuck due to network errors
    (#1101, #1125), controlled by the new --rcv-timeout option.
  * Fixed a few bugs in termination conditions for byte or
    block-limited tests (#1113, #1114, #1115).
  * Added tcp_info.snd_wnd to JSON output (#1148).
  * Some bugs with garbled JSON output have been fixed (#1086, #1118,
    [#1143] / #1146).
  * Support for setting the IPv4 don't-fragment (DF) bit has been
    added with the new --dont-fragment option (#1119).
  * A failure with not being able to read the congestion control
    algorithm under WSL1 has been fixed (#1061 / #1126).
  * Error handling and error messages now make more sense in cases
    where sockets were not successfully opened (#1129 / #1132 /
    [#1136], #1135 / #1138, #1128 / #1139).
  * Some buffer overflow hazards were fixed (#1134).
  * It is now possible to use the API to set/get the congestion
    control algorithm (#1036 / #1112).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067201">- update to 3.10.1:
  * Fixed a problem with autoconf scripts that made builds fail in
    some environments (#1154 / #1155).
  * GNU autoconf 2.71 or newer is now required to regenerate iperf3's
    configure scripts.</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1646308800">- update to 3.11:
  * Update links to Discussions in documentation
  * Fix DSCP so that TOS = DSCP * 4 (#1162)
  * Fix --bind-dev for TCP streams (#1153)
  * Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180)
  * Add get/set test_unit_format function declaration to iperf_api.h
  * Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes
  * Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197)
  * Support zerocopy by reverse mode (#1204)
  * Update help and manpage text for #1157, support bind device
  * Consistently print target_bandwidth in JSON start section (#1177)
  * Test bitrate added to JSON output (#1168)
  * Remove fsync call after every write to receiving --file (#1176, #1159)
  * Update documentation for -w (#1175)
  * Fix for #952, different JSON object names for bidir reverse channel</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 3.12:
  * cJSON has been updated to version 1.7.15 (#1383).
  * The --bind &lt;host&gt;%&lt;dev&gt; option syntax now works properly (#1360 /
  * A server-side file descriptor leak with the --logfile option has
    been fixed (#1369 / #1360 / #1369 / #1389 / #1393).
  * A bug that caused some large values from TCP_INFO to be misprinted
    as negative numbers has been fixed (#1372).
  * Using the -k or -n flags with --reverse no longer leak into future
    tests (#1363 / #1364).
  * There are now various debug level options available with the
  - -debug option. These can be used to adjust the amount of
    debugging output (#1327).
  * A new --snd-timeout option has been added to set a termination
    timeout for idle TCP connections (#1215 / #1282).
  * iperf3 is slightly more robust to out-of-order packets during UDP
    connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 /
  * iperf3 will now use different ports for each direction when the
  - -cport and --bdir options are set (#1249 / #1259).
  * The iperf3 server will now exit if it can't open its log file
  * Various help message and output fixes have been made (#1299 /
  * Various compiler warnings have been fixed (#1211 / #1316).
  * Operation of bootstrap.sh has been fixed and simplified (#1335 /
  * Flow label support / compatibility under Linux has been improved
  * Various minor memory leaks have been fixed (#1332 / #1333).
  * A getter/setter has been added for the bind_port parameter
    (--cport option). (#1303, #1305)
  * Various internal documentation improvements (#1265 / #1285 / #1304).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678190400">- update to 3.13:
  * Added missing bind_dev getter and setter.
  * a fix for A resource leak bug in function iperf_create_pidfile (#1443)
  * doc: Fix copy-and-paste error leading to wrong error message
  * Fix crash on rcv-timeout with JSON logfile</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1689854400">- update to 3.14 (bsc#1213430, CVE-2023-38403):
  * fixes a memory allocation hazard that allowed a remote user to
    crash an iperf3 process
  * see
    https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
  * obsoletes CVE-2023-38403.patch in older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695470400">- update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):
  * Several bugs that could allow the iperf3 server to hang waiting
    for input on the control connection has been fixed
    (ESnet Software Security Advisory ESNET-SECADV-2023-0002)
  * A bug that caused garbled output with UDP tests on 32-bit hosts
    has been fixed (PR #1554, PR #1556). This bug was introduced in
    iperf-3.14.
  * A bug in counting UDP messages has been fixed</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1703678400">- update to 3.16:
  * Multiple test streams started with -P/--parallel will now be
    serviced by different threads. This allows iperf3 to take
    advantage of multiple CPU cores on modern processors, and will
    generally result in significant throughput increases
  * OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
    various older, deprecated, APIs will not be used. iperf3 will
    continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
    of the iperf3 authentication functionality
  * The authorized users file used by the authentication
    functionality is now checked for accessibility much earlier
    during the program startup, as opposed to being checked near
    the start of a test (Issue #1583, PR #1585).
  * BREAKING CHANGE: iperf3 now requires pthreads and C atomic
    variables to compile and run.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1715774400">- update to 3.17.1 (bsc#1224262, CVE-2024-26306):
  * BREAKING CHANGE: iperf3's authentication features, when used
    with OpenSSL prior to 3.2.0, contain a vulnerability to a
    side-channel timing attack. To address this flaw, a change
    has been made to the padding applied to encrypted strings.
    This change is not backwards compatible with older versions of
    iperf3 (before 3.17). To restore
    the older (vulnerable) behavior, and hence
    backwards-compatibility, use the --use-pkcs1-padding flag. The
    iperf3 team thanks Hubert Kario from RedHat for reporting this
    issue and providing feedback on the fix. (CVE-2024-26306)(PR#1695)
  * iperf3 no longer changes its current working directory in --daemon
    mode. This results in more predictable behavior with relative
    paths, in particular finding key and credential files for
    authentication. (PR#1672)
  * A new --json-stream option has been added to enable a streaming
    output format, consisting of a series of JSON objects (for the
    start of the test, each measurement interval, and the end of the
    test) separated by newlines (#444, #923, #1098).
  * UDP tests now work correctly between different endian hosts
  * The --fq-rate parameter now works for --reverse tests
  * The statistics reporting interval is now available in the --json
    start test object (#1663).
  * A negative time test duration is now properly flagged as an error
    (IS#1662 / PR#1666).</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;georg.pfuetzenreuter@suse.com&gt;" date="1731672000">- Build with OpenSSL for key based authentication support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1737979200">- update to 3.18 (bsc#1234705, CVE-2024-53580):
  * SECURITY NOTE: Thanks to Leonid Krolle Bi.Zone for
    discovering a JSON type security vulnerability that caused a
    segmentation fault in the server. (CVE-2024-53580)
    This has now been fixed. (PR#1810)
  * UDP packets per second now reports the correct number of
    packets, by reporting NET_SOFTERROR if there's a EAGAIN/EINTR
    errno if no data was sent (#1367/PR#1379).
  * Several segmentation faults related to threading were fixed.
    One where `pthread_cancel` was called on an improperly
    initialized thread (#1801), another where threads were being
    recycled (#1760/PR#1761), and another where threads were
    improperly handling signals (#1750/PR#1752).
  * A segmentation fault from calling `freeaddrinfo` with `NULL`
    was fixed (PR#1755).
  * Some JSON options were fixed, including checking the size for
    `json_read` (PR#1709), but the size limit was removed for
    received server output (PR#1779).
  * A rcv-timeout error has been fixed. The Nread timeout was
    hardcoded and timed out before the `--rcv-timeout` option
  * There is no longer a limit on the omit time period
  * Fixed an output crash under 32-bit big-endian systems
  * An issue was fixed where CPU utilization was unexpectedly
    high during limited baud rate tests. The `--pacing-timer`
    option was removed, but it is still available in the library
  * Add SCTP information to `--json` output and fixed compile
    error when SCTP is not supported (#1731).
  * `--fq-rate` was changed from a uint to a uint64 to allow
    pacing above 32G.  Not yet tested on big-endian systems</changelog>
  <changelog author="pgajdos@suse.com" date="1746619200">- added patches
  https://github.com/esnet/iperf/commit/beadb59b90e8d3339d31f9f15525108072fde135
  + iperf-gcc15.patch</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1747828800">- update to 3.19
  * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
    with the use of the `-m` or `--mptcp` flag. (PR #1661)
  * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
    on the control connection. (#812, #835, PR #1423)
  * iperf3 now supports the `MSG_TRUNC` receive option, specified by
    the `--skip-rx-copy`. This theoretically improves the rated
    throughput of tests at high bitrates by not delivering network
    payload data to userspace. (#1678, PR #1717)
  * A bug that caused the bitrate setting to be ignored when bursts
    are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
  * The congestion control protocol setting, if used, is now
    properly reset between tests. (PR #1812)
  * iperf3 now exits with a non-error 0 exit code if exiting via a
    `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
  * The current behavior of iperf3 with respect to the `-n` and `-k`
    options is now documented as correct. (#1768, #1775, #596, PR #1800)
- switched to official sources from https://downloads.es.net/pub/iperf/
  following the note on https://software.es.net/iperf/obtaining.html#source-distributions
  GitHub releases are not guaranteed to always be released with
  proper checksums, signage and downloads.
- removed patches: iperf-gcc15.patch (included upstream)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1754308800">- update to 3.19.1:
  * SECURITY NOTE: Thanks to Han Lee with Apple Information
    Security for finding and reporting several memory errors
  * off-by-one heap overflow has been fixed in authentication
    (bsc#1247519, CVE-2025-54349, ESNET-SECADV-2025-0003)
  * assert in authentication has been removed
    (bsc#1247520, CVE-2025-54350, ESNET-SECADV-2025-0002)
  * a buffer overflow in the --skip-rx-copy option for zerocopy
    has been fixed (bsc#1247522, CVE-2025-54351,
    ESNET-SECADV-2025-0001)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1765281600">- update to 3.20:
  * Millisecond-resolution representations have been added to JSON
    timestamps. (PR #1846)
  * The reorder_seen metric, where available, is now available in
    the JSON output. (PR #1278)
  * A division by zero error has been fixed. (PR #1906)
  * Some command-line options were not properly restricted to the
    client or server; this problem has been fixed. (#1892 / PR #1894)
  * The combination of `--udp` and `--file` is now explicitly
    disallowed. (PR #1909)
  * It is now possible to get both the full JSON result object as
    well as streaming intermediate JSON result objects. This
    functionality is enabled by using the new `--json-stream-full`
    command-line flag, in addition to the existing `--json-stream`
    flag (PR #1903)
  * Sends with `--zerocopy` are now properly seeded with data
    instead of being all-zeroes. (PR #1949)
  * The `--server-max-duration` flag is now allowed on the iperf3
    server to impose a maximum duration on timed tests. (PR #1684)
  * The `--rcv-timeout` flag is now ignored for `--bidir` tests.
    This change prevents premature termination of bidirectional
    tests. (#1766 / PR #1946)
  * Several errors in the authentication code were uncovered when
    building with OpenSSL 3.5.3 and later versions. These were
    fixed. (#1951 / PR #1956)
  * Various issues in the iperf3 manual page were fixed up. (PR
    [#1887], PR #1927, PR #1936, PR #1941, #1891 / PR #1952)</changelog>
</package>
<package pkgid="1b27197b3cd465fc01192456e5b19ed913ac4067daacae8f9410570e9ddf505b" name="iperf-devel" arch="x86_64">
  <version epoch="0" ver="3.20" rel="lp155.2.1"/>
  <changelog author="msvec@suse.com" date="1520856000">- update to 3.5
  * Bug fixes mostly</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1530878400">- update to 3.6
  * A new --extra-data option can be used to fill in a user-defined
    string field that appears in JSON output.
  * A new --repeating-payload option makes iperf3 use a payload pattern
    similar to that used by iperf2, which could help in recreating
    results that might be affected by payload entropy (for example,
    compression).
  * -B now works properly with SCTP tests.
  * A compile fix for Solaris 10 was added.
  * Some minor bug fixes for JSON output.  In particular, warnings for
    debug and/or verbose modes with --json output and a fix for
    JSON output on CentOS 6</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1573732800">- update to 3.7
  * Support for simultaneous bidirectional tests with the --bidir flag
  * Use POSIX standard clock_gettime(3) interface for timekeeping where
    available
  * Passwords for authentication can be provided via environment
    variable
  * Specifying --repeating-payload and --reverse now works
  * Failed authentication doesn't count for --one-off
  * Several memory leaks related to authenticated use were fixed
  * The delay for tearing down the control connection for the default
    timed tests has been increased, to more gracefully handle
    high-delay paths
  * Various improvements to the libiperf APIs
  * Fixed build behavior when OpenSSL is absent
  * Portability fixes
- spec file cleanup</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1594468800">- update to 3.8.1
  * Minor bugfixes and enhancements
- don't apply the profiling patch any more
  (removed iperf-disable-profiling.patch)</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600084800">- update to 3.9:
  * A --timestamps flag has been added, which prepends a timestamp to
    each output line.  An optional argument to this flag, which is a
    format specification to strftime(3), allows for custom timestamp
    formats (#909, #1028).
  * A --server-bitrate-limit flag has been added as a server-side
    command-line argument.  It allows a server to enforce a maximum
    throughput rate; client connections that specify a higher bitrate
    or exceed this bitrate during a test will be terminated.  The
    bitrate is expressed in bits per second, with an optional trailing
    slash and integer count that specifies an averaging interval over
    which to enforce the limit (#999).
  * A bug that caused increased CPU usage with the --bidir option has
    been fixed (#1011).
  * Fixed various minor memory leaks (#1023).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067200">- update to 3.10:
  * Fix a bug where some --reverse tests didn't terminate (#982 /
    [#1054]).
  * Responsiveness of control connections is slightly improved (#1045
    / #1046 / #1063).
  * The allowable clock skew when doing authentication between client
    and server is now configurable with the new --time-skew-threshold
    (#1065 / #1070).
  * Bitrate throttling using the -b option now works when a burst size
    is specified (#1090).
  * A bug with calculating CPU utilization has been fixed (#1076 /
    [#1077]).
  * A --bind-dev option to support binding sockets to a given network
    interface has been added to make iperf3 work better with
    multi-homed machines and/or VRFs (#817 / #1089 / #1097).
  * --pidfile now works with --client mode (#1110).
  * The server is now less likely to get stuck due to network errors
    (#1101, #1125), controlled by the new --rcv-timeout option.
  * Fixed a few bugs in termination conditions for byte or
    block-limited tests (#1113, #1114, #1115).
  * Added tcp_info.snd_wnd to JSON output (#1148).
  * Some bugs with garbled JSON output have been fixed (#1086, #1118,
    [#1143] / #1146).
  * Support for setting the IPv4 don't-fragment (DF) bit has been
    added with the new --dont-fragment option (#1119).
  * A failure with not being able to read the congestion control
    algorithm under WSL1 has been fixed (#1061 / #1126).
  * Error handling and error messages now make more sense in cases
    where sockets were not successfully opened (#1129 / #1132 /
    [#1136], #1135 / #1138, #1128 / #1139).
  * Some buffer overflow hazards were fixed (#1134).
  * It is now possible to use the API to set/get the congestion
    control algorithm (#1036 / #1112).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067201">- update to 3.10.1:
  * Fixed a problem with autoconf scripts that made builds fail in
    some environments (#1154 / #1155).
  * GNU autoconf 2.71 or newer is now required to regenerate iperf3's
    configure scripts.</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1646308800">- update to 3.11:
  * Update links to Discussions in documentation
  * Fix DSCP so that TOS = DSCP * 4 (#1162)
  * Fix --bind-dev for TCP streams (#1153)
  * Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180)
  * Add get/set test_unit_format function declaration to iperf_api.h
  * Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes
  * Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197)
  * Support zerocopy by reverse mode (#1204)
  * Update help and manpage text for #1157, support bind device
  * Consistently print target_bandwidth in JSON start section (#1177)
  * Test bitrate added to JSON output (#1168)
  * Remove fsync call after every write to receiving --file (#1176, #1159)
  * Update documentation for -w (#1175)
  * Fix for #952, different JSON object names for bidir reverse channel</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 3.12:
  * cJSON has been updated to version 1.7.15 (#1383).
  * The --bind &lt;host&gt;%&lt;dev&gt; option syntax now works properly (#1360 /
  * A server-side file descriptor leak with the --logfile option has
    been fixed (#1369 / #1360 / #1369 / #1389 / #1393).
  * A bug that caused some large values from TCP_INFO to be misprinted
    as negative numbers has been fixed (#1372).
  * Using the -k or -n flags with --reverse no longer leak into future
    tests (#1363 / #1364).
  * There are now various debug level options available with the
  - -debug option. These can be used to adjust the amount of
    debugging output (#1327).
  * A new --snd-timeout option has been added to set a termination
    timeout for idle TCP connections (#1215 / #1282).
  * iperf3 is slightly more robust to out-of-order packets during UDP
    connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 /
  * iperf3 will now use different ports for each direction when the
  - -cport and --bdir options are set (#1249 / #1259).
  * The iperf3 server will now exit if it can't open its log file
  * Various help message and output fixes have been made (#1299 /
  * Various compiler warnings have been fixed (#1211 / #1316).
  * Operation of bootstrap.sh has been fixed and simplified (#1335 /
  * Flow label support / compatibility under Linux has been improved
  * Various minor memory leaks have been fixed (#1332 / #1333).
  * A getter/setter has been added for the bind_port parameter
    (--cport option). (#1303, #1305)
  * Various internal documentation improvements (#1265 / #1285 / #1304).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678190400">- update to 3.13:
  * Added missing bind_dev getter and setter.
  * a fix for A resource leak bug in function iperf_create_pidfile (#1443)
  * doc: Fix copy-and-paste error leading to wrong error message
  * Fix crash on rcv-timeout with JSON logfile</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1689854400">- update to 3.14 (bsc#1213430, CVE-2023-38403):
  * fixes a memory allocation hazard that allowed a remote user to
    crash an iperf3 process
  * see
    https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
  * obsoletes CVE-2023-38403.patch in older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695470400">- update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):
  * Several bugs that could allow the iperf3 server to hang waiting
    for input on the control connection has been fixed
    (ESnet Software Security Advisory ESNET-SECADV-2023-0002)
  * A bug that caused garbled output with UDP tests on 32-bit hosts
    has been fixed (PR #1554, PR #1556). This bug was introduced in
    iperf-3.14.
  * A bug in counting UDP messages has been fixed</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1703678400">- update to 3.16:
  * Multiple test streams started with -P/--parallel will now be
    serviced by different threads. This allows iperf3 to take
    advantage of multiple CPU cores on modern processors, and will
    generally result in significant throughput increases
  * OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
    various older, deprecated, APIs will not be used. iperf3 will
    continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
    of the iperf3 authentication functionality
  * The authorized users file used by the authentication
    functionality is now checked for accessibility much earlier
    during the program startup, as opposed to being checked near
    the start of a test (Issue #1583, PR #1585).
  * BREAKING CHANGE: iperf3 now requires pthreads and C atomic
    variables to compile and run.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1715774400">- update to 3.17.1 (bsc#1224262, CVE-2024-26306):
  * BREAKING CHANGE: iperf3's authentication features, when used
    with OpenSSL prior to 3.2.0, contain a vulnerability to a
    side-channel timing attack. To address this flaw, a change
    has been made to the padding applied to encrypted strings.
    This change is not backwards compatible with older versions of
    iperf3 (before 3.17). To restore
    the older (vulnerable) behavior, and hence
    backwards-compatibility, use the --use-pkcs1-padding flag. The
    iperf3 team thanks Hubert Kario from RedHat for reporting this
    issue and providing feedback on the fix. (CVE-2024-26306)(PR#1695)
  * iperf3 no longer changes its current working directory in --daemon
    mode. This results in more predictable behavior with relative
    paths, in particular finding key and credential files for
    authentication. (PR#1672)
  * A new --json-stream option has been added to enable a streaming
    output format, consisting of a series of JSON objects (for the
    start of the test, each measurement interval, and the end of the
    test) separated by newlines (#444, #923, #1098).
  * UDP tests now work correctly between different endian hosts
  * The --fq-rate parameter now works for --reverse tests
  * The statistics reporting interval is now available in the --json
    start test object (#1663).
  * A negative time test duration is now properly flagged as an error
    (IS#1662 / PR#1666).</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;georg.pfuetzenreuter@suse.com&gt;" date="1731672000">- Build with OpenSSL for key based authentication support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1737979200">- update to 3.18 (bsc#1234705, CVE-2024-53580):
  * SECURITY NOTE: Thanks to Leonid Krolle Bi.Zone for
    discovering a JSON type security vulnerability that caused a
    segmentation fault in the server. (CVE-2024-53580)
    This has now been fixed. (PR#1810)
  * UDP packets per second now reports the correct number of
    packets, by reporting NET_SOFTERROR if there's a EAGAIN/EINTR
    errno if no data was sent (#1367/PR#1379).
  * Several segmentation faults related to threading were fixed.
    One where `pthread_cancel` was called on an improperly
    initialized thread (#1801), another where threads were being
    recycled (#1760/PR#1761), and another where threads were
    improperly handling signals (#1750/PR#1752).
  * A segmentation fault from calling `freeaddrinfo` with `NULL`
    was fixed (PR#1755).
  * Some JSON options were fixed, including checking the size for
    `json_read` (PR#1709), but the size limit was removed for
    received server output (PR#1779).
  * A rcv-timeout error has been fixed. The Nread timeout was
    hardcoded and timed out before the `--rcv-timeout` option
  * There is no longer a limit on the omit time period
  * Fixed an output crash under 32-bit big-endian systems
  * An issue was fixed where CPU utilization was unexpectedly
    high during limited baud rate tests. The `--pacing-timer`
    option was removed, but it is still available in the library
  * Add SCTP information to `--json` output and fixed compile
    error when SCTP is not supported (#1731).
  * `--fq-rate` was changed from a uint to a uint64 to allow
    pacing above 32G.  Not yet tested on big-endian systems</changelog>
  <changelog author="pgajdos@suse.com" date="1746619200">- added patches
  https://github.com/esnet/iperf/commit/beadb59b90e8d3339d31f9f15525108072fde135
  + iperf-gcc15.patch</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1747828800">- update to 3.19
  * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
    with the use of the `-m` or `--mptcp` flag. (PR #1661)
  * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
    on the control connection. (#812, #835, PR #1423)
  * iperf3 now supports the `MSG_TRUNC` receive option, specified by
    the `--skip-rx-copy`. This theoretically improves the rated
    throughput of tests at high bitrates by not delivering network
    payload data to userspace. (#1678, PR #1717)
  * A bug that caused the bitrate setting to be ignored when bursts
    are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
  * The congestion control protocol setting, if used, is now
    properly reset between tests. (PR #1812)
  * iperf3 now exits with a non-error 0 exit code if exiting via a
    `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
  * The current behavior of iperf3 with respect to the `-n` and `-k`
    options is now documented as correct. (#1768, #1775, #596, PR #1800)
- switched to official sources from https://downloads.es.net/pub/iperf/
  following the note on https://software.es.net/iperf/obtaining.html#source-distributions
  GitHub releases are not guaranteed to always be released with
  proper checksums, signage and downloads.
- removed patches: iperf-gcc15.patch (included upstream)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1754308800">- update to 3.19.1:
  * SECURITY NOTE: Thanks to Han Lee with Apple Information
    Security for finding and reporting several memory errors
  * off-by-one heap overflow has been fixed in authentication
    (bsc#1247519, CVE-2025-54349, ESNET-SECADV-2025-0003)
  * assert in authentication has been removed
    (bsc#1247520, CVE-2025-54350, ESNET-SECADV-2025-0002)
  * a buffer overflow in the --skip-rx-copy option for zerocopy
    has been fixed (bsc#1247522, CVE-2025-54351,
    ESNET-SECADV-2025-0001)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1765281600">- update to 3.20:
  * Millisecond-resolution representations have been added to JSON
    timestamps. (PR #1846)
  * The reorder_seen metric, where available, is now available in
    the JSON output. (PR #1278)
  * A division by zero error has been fixed. (PR #1906)
  * Some command-line options were not properly restricted to the
    client or server; this problem has been fixed. (#1892 / PR #1894)
  * The combination of `--udp` and `--file` is now explicitly
    disallowed. (PR #1909)
  * It is now possible to get both the full JSON result object as
    well as streaming intermediate JSON result objects. This
    functionality is enabled by using the new `--json-stream-full`
    command-line flag, in addition to the existing `--json-stream`
    flag (PR #1903)
  * Sends with `--zerocopy` are now properly seeded with data
    instead of being all-zeroes. (PR #1949)
  * The `--server-max-duration` flag is now allowed on the iperf3
    server to impose a maximum duration on timed tests. (PR #1684)
  * The `--rcv-timeout` flag is now ignored for `--bidir` tests.
    This change prevents premature termination of bidirectional
    tests. (#1766 / PR #1946)
  * Several errors in the authentication code were uncovered when
    building with OpenSSL 3.5.3 and later versions. These were
    fixed. (#1951 / PR #1956)
  * Various issues in the iperf3 manual page were fixed up. (PR
    [#1887], PR #1927, PR #1936, PR #1941, #1891 / PR #1952)</changelog>
</package>
<package pkgid="6444b206e7ff9cd9793fffc345ad7d041bd0aa4a15fd7fae029a1a0eae04217d" name="libiperf0" arch="x86_64">
  <version epoch="0" ver="3.20" rel="lp155.2.1"/>
  <changelog author="msvec@suse.com" date="1520856000">- update to 3.5
  * Bug fixes mostly</changelog>
  <changelog author="liedke@rz.uni-mannheim.de" date="1530878400">- update to 3.6
  * A new --extra-data option can be used to fill in a user-defined
    string field that appears in JSON output.
  * A new --repeating-payload option makes iperf3 use a payload pattern
    similar to that used by iperf2, which could help in recreating
    results that might be affected by payload entropy (for example,
    compression).
  * -B now works properly with SCTP tests.
  * A compile fix for Solaris 10 was added.
  * Some minor bug fixes for JSON output.  In particular, warnings for
    debug and/or verbose modes with --json output and a fix for
    JSON output on CentOS 6</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1573732800">- update to 3.7
  * Support for simultaneous bidirectional tests with the --bidir flag
  * Use POSIX standard clock_gettime(3) interface for timekeeping where
    available
  * Passwords for authentication can be provided via environment
    variable
  * Specifying --repeating-payload and --reverse now works
  * Failed authentication doesn't count for --one-off
  * Several memory leaks related to authenticated use were fixed
  * The delay for tearing down the control connection for the default
    timed tests has been increased, to more gracefully handle
    high-delay paths
  * Various improvements to the libiperf APIs
  * Fixed build behavior when OpenSSL is absent
  * Portability fixes
- spec file cleanup</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1594468800">- update to 3.8.1
  * Minor bugfixes and enhancements
- don't apply the profiling patch any more
  (removed iperf-disable-profiling.patch)</changelog>
  <changelog author="Dirk Mueller &lt;dmueller@suse.com&gt;" date="1600084800">- update to 3.9:
  * A --timestamps flag has been added, which prepends a timestamp to
    each output line.  An optional argument to this flag, which is a
    format specification to strftime(3), allows for custom timestamp
    formats (#909, #1028).
  * A --server-bitrate-limit flag has been added as a server-side
    command-line argument.  It allows a server to enforce a maximum
    throughput rate; client connections that specify a higher bitrate
    or exceed this bitrate during a test will be terminated.  The
    bitrate is expressed in bits per second, with an optional trailing
    slash and integer count that specifies an averaging interval over
    which to enforce the limit (#999).
  * A bug that caused increased CPU usage with the --bidir option has
    been fixed (#1011).
  * Fixed various minor memory leaks (#1023).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067200">- update to 3.10:
  * Fix a bug where some --reverse tests didn't terminate (#982 /
    [#1054]).
  * Responsiveness of control connections is slightly improved (#1045
    / #1046 / #1063).
  * The allowable clock skew when doing authentication between client
    and server is now configurable with the new --time-skew-threshold
    (#1065 / #1070).
  * Bitrate throttling using the -b option now works when a burst size
    is specified (#1090).
  * A bug with calculating CPU utilization has been fixed (#1076 /
    [#1077]).
  * A --bind-dev option to support binding sockets to a given network
    interface has been added to make iperf3 work better with
    multi-homed machines and/or VRFs (#817 / #1089 / #1097).
  * --pidfile now works with --client mode (#1110).
  * The server is now less likely to get stuck due to network errors
    (#1101, #1125), controlled by the new --rcv-timeout option.
  * Fixed a few bugs in termination conditions for byte or
    block-limited tests (#1113, #1114, #1115).
  * Added tcp_info.snd_wnd to JSON output (#1148).
  * Some bugs with garbled JSON output have been fixed (#1086, #1118,
    [#1143] / #1146).
  * Support for setting the IPv4 don't-fragment (DF) bit has been
    added with the new --dont-fragment option (#1119).
  * A failure with not being able to read the congestion control
    algorithm under WSL1 has been fixed (#1061 / #1126).
  * Error handling and error messages now make more sense in cases
    where sockets were not successfully opened (#1129 / #1132 /
    [#1136], #1135 / #1138, #1128 / #1139).
  * Some buffer overflow hazards were fixed (#1134).
  * It is now possible to use the API to set/get the congestion
    control algorithm (#1036 / #1112).</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1623067201">- update to 3.10.1:
  * Fixed a problem with autoconf scripts that made builds fail in
    some environments (#1154 / #1155).
  * GNU autoconf 2.71 or newer is now required to regenerate iperf3's
    configure scripts.</changelog>
  <changelog author="Michal Svec &lt;msvec@suse.com&gt;" date="1646308800">- update to 3.11:
  * Update links to Discussions in documentation
  * Fix DSCP so that TOS = DSCP * 4 (#1162)
  * Fix --bind-dev for TCP streams (#1153)
  * Fix interface specification so doesn't overlap with IPv6 link-local addresses for -c and -B (#1157, #1180)
  * Add get/set test_unit_format function declaration to iperf_api.h
  * Auto adjustment of test-end condition for file transfers (-F), if no end condition is set, it will automatically adjust it to file size in bytes
  * Exit if idle time expires waiting for a connection in one-off mode (#1187, #1197)
  * Support zerocopy by reverse mode (#1204)
  * Update help and manpage text for #1157, support bind device
  * Consistently print target_bandwidth in JSON start section (#1177)
  * Test bitrate added to JSON output (#1168)
  * Remove fsync call after every write to receiving --file (#1176, #1159)
  * Update documentation for -w (#1175)
  * Fix for #952, different JSON object names for bidir reverse channel</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1670068800">- update to 3.12:
  * cJSON has been updated to version 1.7.15 (#1383).
  * The --bind &lt;host&gt;%&lt;dev&gt; option syntax now works properly (#1360 /
  * A server-side file descriptor leak with the --logfile option has
    been fixed (#1369 / #1360 / #1369 / #1389 / #1393).
  * A bug that caused some large values from TCP_INFO to be misprinted
    as negative numbers has been fixed (#1372).
  * Using the -k or -n flags with --reverse no longer leak into future
    tests (#1363 / #1364).
  * There are now various debug level options available with the
  - -debug option. These can be used to adjust the amount of
    debugging output (#1327).
  * A new --snd-timeout option has been added to set a termination
    timeout for idle TCP connections (#1215 / #1282).
  * iperf3 is slightly more robust to out-of-order packets during UDP
    connection setup in --reverse mode (#914 / #1123 / #1182 / #1212 /
  * iperf3 will now use different ports for each direction when the
  - -cport and --bdir options are set (#1249 / #1259).
  * The iperf3 server will now exit if it can't open its log file
  * Various help message and output fixes have been made (#1299 /
  * Various compiler warnings have been fixed (#1211 / #1316).
  * Operation of bootstrap.sh has been fixed and simplified (#1335 /
  * Flow label support / compatibility under Linux has been improved
  * Various minor memory leaks have been fixed (#1332 / #1333).
  * A getter/setter has been added for the bind_port parameter
    (--cport option). (#1303, #1305)
  * Various internal documentation improvements (#1265 / #1285 / #1304).</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1678190400">- update to 3.13:
  * Added missing bind_dev getter and setter.
  * a fix for A resource leak bug in function iperf_create_pidfile (#1443)
  * doc: Fix copy-and-paste error leading to wrong error message
  * Fix crash on rcv-timeout with JSON logfile</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1689854400">- update to 3.14 (bsc#1213430, CVE-2023-38403):
  * fixes a memory allocation hazard that allowed a remote user to
    crash an iperf3 process
  * see
    https://downloads.es.net/pub/iperf/esnet-secadv-2023-0001.txt.asc
  * obsoletes CVE-2023-38403.patch in older dists</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1695470400">- update to 3.15 (bsc#1215662, ESNET-SECADV-2023-0002):
  * Several bugs that could allow the iperf3 server to hang waiting
    for input on the control connection has been fixed
    (ESnet Software Security Advisory ESNET-SECADV-2023-0002)
  * A bug that caused garbled output with UDP tests on 32-bit hosts
    has been fixed (PR #1554, PR #1556). This bug was introduced in
    iperf-3.14.
  * A bug in counting UDP messages has been fixed</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1703678400">- update to 3.16:
  * Multiple test streams started with -P/--parallel will now be
    serviced by different threads. This allows iperf3 to take
    advantage of multiple CPU cores on modern processors, and will
    generally result in significant throughput increases
  * OpenSSL 3 is now detected at build time. If OpenSSL 3 is found,
    various older, deprecated, APIs will not be used. iperf3 will
    continue to work with OpenSSL 1.1.1. OpenSSL is used as a part
    of the iperf3 authentication functionality
  * The authorized users file used by the authentication
    functionality is now checked for accessibility much earlier
    during the program startup, as opposed to being checked near
    the start of a test (Issue #1583, PR #1585).
  * BREAKING CHANGE: iperf3 now requires pthreads and C atomic
    variables to compile and run.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1715774400">- update to 3.17.1 (bsc#1224262, CVE-2024-26306):
  * BREAKING CHANGE: iperf3's authentication features, when used
    with OpenSSL prior to 3.2.0, contain a vulnerability to a
    side-channel timing attack. To address this flaw, a change
    has been made to the padding applied to encrypted strings.
    This change is not backwards compatible with older versions of
    iperf3 (before 3.17). To restore
    the older (vulnerable) behavior, and hence
    backwards-compatibility, use the --use-pkcs1-padding flag. The
    iperf3 team thanks Hubert Kario from RedHat for reporting this
    issue and providing feedback on the fix. (CVE-2024-26306)(PR#1695)
  * iperf3 no longer changes its current working directory in --daemon
    mode. This results in more predictable behavior with relative
    paths, in particular finding key and credential files for
    authentication. (PR#1672)
  * A new --json-stream option has been added to enable a streaming
    output format, consisting of a series of JSON objects (for the
    start of the test, each measurement interval, and the end of the
    test) separated by newlines (#444, #923, #1098).
  * UDP tests now work correctly between different endian hosts
  * The --fq-rate parameter now works for --reverse tests
  * The statistics reporting interval is now available in the --json
    start test object (#1663).
  * A negative time test duration is now properly flagged as an error
    (IS#1662 / PR#1666).</changelog>
  <changelog author="Georg Pfuetzenreuter &lt;georg.pfuetzenreuter@suse.com&gt;" date="1731672000">- Build with OpenSSL for key based authentication support</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1737979200">- update to 3.18 (bsc#1234705, CVE-2024-53580):
  * SECURITY NOTE: Thanks to Leonid Krolle Bi.Zone for
    discovering a JSON type security vulnerability that caused a
    segmentation fault in the server. (CVE-2024-53580)
    This has now been fixed. (PR#1810)
  * UDP packets per second now reports the correct number of
    packets, by reporting NET_SOFTERROR if there's a EAGAIN/EINTR
    errno if no data was sent (#1367/PR#1379).
  * Several segmentation faults related to threading were fixed.
    One where `pthread_cancel` was called on an improperly
    initialized thread (#1801), another where threads were being
    recycled (#1760/PR#1761), and another where threads were
    improperly handling signals (#1750/PR#1752).
  * A segmentation fault from calling `freeaddrinfo` with `NULL`
    was fixed (PR#1755).
  * Some JSON options were fixed, including checking the size for
    `json_read` (PR#1709), but the size limit was removed for
    received server output (PR#1779).
  * A rcv-timeout error has been fixed. The Nread timeout was
    hardcoded and timed out before the `--rcv-timeout` option
  * There is no longer a limit on the omit time period
  * Fixed an output crash under 32-bit big-endian systems
  * An issue was fixed where CPU utilization was unexpectedly
    high during limited baud rate tests. The `--pacing-timer`
    option was removed, but it is still available in the library
  * Add SCTP information to `--json` output and fixed compile
    error when SCTP is not supported (#1731).
  * `--fq-rate` was changed from a uint to a uint64 to allow
    pacing above 32G.  Not yet tested on big-endian systems</changelog>
  <changelog author="pgajdos@suse.com" date="1746619200">- added patches
  https://github.com/esnet/iperf/commit/beadb59b90e8d3339d31f9f15525108072fde135
  + iperf-gcc15.patch</changelog>
  <changelog author="Aeneas Jai&#xDF;le &lt;aj@ajaissle.de&gt;" date="1747828800">- update to 3.19
  * iperf3 now supports the use of Multi-Path TCP (MPTCPv1) on Linux
    with the use of the `-m` or `--mptcp` flag. (PR #1661)
  * iperf3 now supports a `--cntl-ka` option to enable TCP keepalives
    on the control connection. (#812, #835, PR #1423)
  * iperf3 now supports the `MSG_TRUNC` receive option, specified by
    the `--skip-rx-copy`. This theoretically improves the rated
    throughput of tests at high bitrates by not delivering network
    payload data to userspace. (#1678, PR #1717)
  * A bug that caused the bitrate setting to be ignored when bursts
    are set, has been fixed. (#1773, #1820, PR #1821, PR #1848)
  * The congestion control protocol setting, if used, is now
    properly reset between tests. (PR #1812)
  * iperf3 now exits with a non-error 0 exit code if exiting via a
    `SIGTERM`, `SIGHUP`, or `SIGINT`. (#1009, PR# 1829)
  * The current behavior of iperf3 with respect to the `-n` and `-k`
    options is now documented as correct. (#1768, #1775, #596, PR #1800)
- switched to official sources from https://downloads.es.net/pub/iperf/
  following the note on https://software.es.net/iperf/obtaining.html#source-distributions
  GitHub releases are not guaranteed to always be released with
  proper checksums, signage and downloads.
- removed patches: iperf-gcc15.patch (included upstream)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1754308800">- update to 3.19.1:
  * SECURITY NOTE: Thanks to Han Lee with Apple Information
    Security for finding and reporting several memory errors
  * off-by-one heap overflow has been fixed in authentication
    (bsc#1247519, CVE-2025-54349, ESNET-SECADV-2025-0003)
  * assert in authentication has been removed
    (bsc#1247520, CVE-2025-54350, ESNET-SECADV-2025-0002)
  * a buffer overflow in the --skip-rx-copy option for zerocopy
    has been fixed (bsc#1247522, CVE-2025-54351,
    ESNET-SECADV-2025-0001)</changelog>
  <changelog author="Arvin Schnell &lt;aschnell@suse.com&gt;" date="1765281600">- update to 3.20:
  * Millisecond-resolution representations have been added to JSON
    timestamps. (PR #1846)
  * The reorder_seen metric, where available, is now available in
    the JSON output. (PR #1278)
  * A division by zero error has been fixed. (PR #1906)
  * Some command-line options were not properly restricted to the
    client or server; this problem has been fixed. (#1892 / PR #1894)
  * The combination of `--udp` and `--file` is now explicitly
    disallowed. (PR #1909)
  * It is now possible to get both the full JSON result object as
    well as streaming intermediate JSON result objects. This
    functionality is enabled by using the new `--json-stream-full`
    command-line flag, in addition to the existing `--json-stream`
    flag (PR #1903)
  * Sends with `--zerocopy` are now properly seeded with data
    instead of being all-zeroes. (PR #1949)
  * The `--server-max-duration` flag is now allowed on the iperf3
    server to impose a maximum duration on timed tests. (PR #1684)
  * The `--rcv-timeout` flag is now ignored for `--bidir` tests.
    This change prevents premature termination of bidirectional
    tests. (#1766 / PR #1946)
  * Several errors in the authentication code were uncovered when
    building with OpenSSL 3.5.3 and later versions. These were
    fixed. (#1951 / PR #1956)
  * Various issues in the iperf3 manual page were fixed up. (PR
    [#1887], PR #1927, PR #1936, PR #1941, #1891 / PR #1952)</changelog>
</package>
<package pkgid="47cfafbd9dce61e6cf3a0b7affed695f7b96d611689cd718d403e4c0f73d20dc" name="libjpeg-turbo" arch="src">
  <version epoch="0" ver="3.1.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="e104e561f0adbcde3328879a2e87684e87833f0810a68b5ff75e7b4c91477e8c" name="libjpeg-turbo" arch="x86_64">
  <version epoch="0" ver="3.1.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="f3630b0e7fc4719344e50ab08ce6b7b4d9641567b5ee1a9a00752c217253d51d" name="libjpeg62" arch="x86_64">
  <version epoch="0" ver="62.4.0" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="79fd59e42fc70c7799297dad370a075edbd131ea4e145a38db14584d6a0bf6e3" name="libjpeg62-devel" arch="x86_64">
  <version epoch="0" ver="62.4.0" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="9aed74dff0de15e343530a1fd171734fcade5ecb36f26cdbd444c5188c5e8570" name="libjpeg62-turbo" arch="src">
  <version epoch="0" ver="3.1.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="32ffee177c42d99b3c82b4376b404d7a48a37683f2a127702c8fc1d8a442d0c9" name="libjpeg8" arch="x86_64">
  <version epoch="0" ver="8.3.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="ad400609d0e8eb64b07d8131e2da4e0cc7d3d40aff31d1364932a7164a6afa00" name="libjpeg8-devel" arch="x86_64">
  <version epoch="0" ver="8.3.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
<package pkgid="3f26273abfdb0e64481de33ea10eee98037a3c545127c820e1df57b9e319ee8f" name="libturbojpeg0" arch="x86_64">
  <version epoch="0" ver="8.3.2" rel="lp155.1.1"/>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1620129600">- disable SIMD for armv6hl, not available</changelog>
  <changelog author="pgajdos@suse.com" date="1629460800">- version update to 2.1.1
  1. Fixed a regression introduced in 2.1.0 that caused build failures
    with non-GCC-compatible compilers for Un*x/Arm platforms.
  2. Fixed a regression introduced by 2.1 beta1[13] that prevented the
    Arm 32-bit (AArch32) Neon SIMD extensions from building unless
    the C compiler flags included -mfloat-abi=softfp or -mfloat-abi=hard.
  3. Fixed an issue in the AArch32 Neon SIMD Huffman encoder whereby
    reliance on undefined C compiler behavior led to crashes
    ("SIGBUS: illegal alignment") on Android systems when running
    AArch32/Thumb builds of libjpeg-turbo built with recent versions
    of Clang.
  4. Added a command-line argument (-copy icc) to jpegtran that causes
    it to copy only the ICC profile markers from the source file and
    discard any other metadata.
  5. libjpeg-turbo should now build and run on CHERI-enabled
    architectures, which use capability pointers that are larger than
    the size of size_t.
  6. Fixed a regression introduced by 2.1 beta1[5] that caused a segfault
    in the 64-bit SSE2 Huffman encoder when attempting to losslessly
    transform a specially-crafted malformed JPEG image.</changelog>
  <changelog author="pgajdos@suse.com" date="1632916800">- previous version updates fixes following bugs:
  CVE-2014-9092, CVE-2018-14498, CVE-2019-2201, CVE-2020-17541
  (bsc#1128712, bsc#1186764, bsc#807183, bsc#906761)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1637755200">- update to 2.1.2:
  * Fixed a regression introduced by 2.1 beta1[13] that caused the remaining
    GAS implementations of AArch64 (Arm 64-bit) Neon SIMD functions (which are used
    by default with GCC for performance reasons) to be placed in the `.rodata`
    section rather than in the `.text` section.  This caused the GNU linker to
    automatically place the `.rodata` section in an executable segment, which
    prevented libjpeg-turbo from working properly with other linkers and also
    represented a potential security risk.
  * Fixed an issue whereby the `tjTransform()` function incorrectly computed the
    MCU block size for 4:4:4 JPEG images with non-unary sampling factors and thus
    unduly rejected some cropping regions, even though those regions aligned with
    8x8 MCU block boundaries.
  * Fixed a regression introduced by 2.1 beta1[13] that caused the build system
    to enable the Arm Neon SIMD extensions when targetting Armv6 and other legacy
    architectures that do not support Neon instructions.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    FreeBSD/PowerPC systems if AltiVec instructions are not enabled at compile
    time.  This allows both AltiVec-equipped and non-AltiVec-equipped CPUs to be
    supported using the same build of libjpeg-turbo.
  * cjpeg now accepts a `-strict` argument similar to that of djpeg and
    jpegtran, which causes the compressor to abort if an LZW-compressed GIF input
    image contains incomplete or corrupt image data.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1647777600">- update to 2.1.3:
  * Fixed a regression introduced by 2.0 beta1[7] whereby cjpeg compressed PGM
    input files into full-color JPEG images unless the `-grayscale` option was
    used.
  * cjpeg now automatically compresses GIF and 8-bit BMP input files into
    grayscale JPEG images if the input files contain only shades of gray.
  * The build system now enables the intrinsics implementation of the AArch64
    (Arm 64-bit) Neon SIMD extensions by default when using GCC 12 or later.
  * Fixed a segfault that occurred while decompressing a 4:2:0 JPEG image using
    the merged (non-fancy) upsampling algorithms (that is, with
    `cinfo.do_fancy_upsampling` set to `FALSE`) along with `jpeg_crop_scanline()`.
    Specifically, the segfault occurred if the number of bytes remaining in the
    output buffer was less than the number of bytes required to represent one
    uncropped scanline of the output image.  For that reason, the issue could only
    be reproduced using the libjpeg API, not using djpeg.</changelog>
  <changelog author="Cristian Rodr&#xED;guez &lt;crrodriguez@opensuse.org&gt;" date="1650283200">- Use nasm instead of yasm, the latter has not released any update
  in 7 years.</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1657022400">- Add requires between baselibs</changelog>
  <changelog author="Tom Mbrt &lt;tom.mbrt@googlemail.com&gt;" date="1660564800">- update to 2.1.4:
  * Fixed a regression introduced in 2.1.3 that caused build failures with
    Visual Studio 2010.
  * The tjDecompressHeader3() function in the TurboJPEG C API and the
    TJDecompressor.setSourceImage() method in the TurboJPEG Java API now
    accept "abbreviated table specification" (AKA "tables-only") datastreams,
    which can be used to prime the decompressor with quantization and Huffman
    tables that can be used when decompressing subsequent "abbreviated image"
    datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile
    time. This allows both AltiVec-equipped (PowerPC G4 and G5) and
    non-AltiVec-equipped (PowerPC G3) CPUs to be supported using the same
    build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when
    attempting to decompress a progressive JPEG image with a height less than
    or equal to one iMCU (8 * the vertical sampling factor) using
    buffered-image mode with interblock smoothing enabled. This was a
    regression introduced by 2.1 beta1[6(b)].
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  * Attempting to call jpeg_crop_scanline() after jpeg_start_decompress()
    but before jpeg_start_output() resulted in an error ("Improper call to
    JPEG library in state 207".)
  * Attempting to use jpeg_skip_scanlines() resulted in an error ("Bogus
    virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1660737600">- update to 2.1.4:
  * The `tjDecompressHeader3()` function in the TurboJPEG C API and the
    `TJDecompressor.setSourceImage()` method in the TurboJPEG Java API now accept
    "abbreviated table specification" (AKA "tables-only") datastreams, which can be
    used to prime the decompressor with quantization and Huffman tables that can be
    used when decompressing subsequent "abbreviated image" datastreams.
  * libjpeg-turbo now performs run-time detection of AltiVec instructions on
    OS X/PowerPC systems if AltiVec instructions are not enabled at compile time.
    This allows both AltiVec-equipped (PowerPC G4 and G5) and non-AltiVec-equipped
    (PowerPC G3) CPUs to be supported using the same build of libjpeg-turbo.
  * Fixed an error ("Bogus virtual array access") that occurred when attempting
    to decompress a progressive JPEG image with a height less than or equal to one
    iMCU (8 * the vertical sampling factor) using buffered-image mode with
    interblock smoothing enabled.
  * Fixed two issues that prevented partial image decompression from working
    properly with buffered-image mode:
  - Attempting to call `jpeg_crop_scanline()` after
  `jpeg_start_decompress()` but before `jpeg_start_output()` resulted in an error
  ("Improper call to JPEG library in state 207".)
  - Attempting to use `jpeg_skip_scanlines()` resulted in an error ("Bogus
  virtual array access") under certain circumstances.</changelog>
  <changelog author="Dirk Stoecker &lt;opensuse@dstoecker.de&gt;" date="1671883200">- Add explicit provides for jpegtran, so it can be installed easier</changelog>
  <changelog author="Paolo Stivanin &lt;info@paolostivanin.com&gt;" date="1676980800">- update to 2.1.5.1:
  * Fixed a regression introduced by 2.0 beta1[15] that caused a buffer
    overrun in the progressive Huffman encoder when attempting to transform
    a specially-crafted malformed 12-bit-per-component JPEG image into a
    progressive 12-bit-per-component JPEG image using a 12-bit-per-component
    build of libjpeg-turbo.
  * Fixed an issue whereby, when using a 12-bit-per-component build of
    libjpeg-turbo (-DWITH_12BIT=1), passing samples with values greater than 4095
    or less than 0 to jpeg_write_scanlines() caused a buffer overrun or
    underrun in the RGB-to-YCbCr color converter.
  * Fixed a floating point exception that occurred when attempting to use
    the jpegtran -drop and -trim options to losslessly transform a
    specially-crafted malformed JPEG image.
  * Fixed an issue in tjBufSizeYUV2() whereby it returned a bogus result,
    rather than throwing an error, if the align parameter was not a power of 2.
  * Fixed a similar issue in tjCompressFromYUV() whereby it generated a corrupt
    JPEG image in certain cases, rather than throwing an error,
    if the align parameter was not a power of 2.
  * Fixed an issue whereby tjDecompressToYUV2(), which is a wrapper for
    tjDecompressToYUVPlanes(), used the desired YUV image dimensions
    rather than the actual scaled image dimensions when computing the plane
    pointers and strides to pass to tjDecompressToYUVPlanes().
    This caused a buffer overrun and subsequent segfault if the desired
    image dimensions exceeded the scaled image dimensions.
  * Fixed an issue whereby, when decompressing a 12-bit-per-component JPEG
    image (-DWITH_12BIT=1) using an alpha-enabled output color space such as
    JCS_EXT_RGBA, the alpha channel was set to 255 rather than 4095.
  * Fixed an issue whereby the Java version of TJBench did not accept a range
    of quality values.
  * Fixed an issue whereby, when -progressive was passed to TJBench,
    the JPEG input image was not transformed into a progressive JPEG image
    prior to decompression.</changelog>
  <changelog author="Martin Pluskal &lt;mpluskal@suse.com&gt;" date="1678276800">- Build AVX2 enabled hwcaps library for x86_64-v3</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1683201600">- Add _multibuild to define 2nd spec file as additional flavor.
  Eliminates the need for source package links in OBS.</changelog>
  <changelog author="pgajdos@suse.com" date="1687521600">- merge two spec files into one</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1704110400">- update to 3.0.1 (bsc#1211542, CVE-2023-2804):
  * The x86-64 SIMD functions now use a standard stack frame,
    prologue, and epilogue so that debuggers and profilers can
    reliably capture backtraces from within the functions.
  * Fixed two minor issues in the interblock smoothing algorithm
    that caused mathematical (but not necessarily perceptible)
    edge block errors when decompressing progressive JPEG images
    exactly two MCU blocks in width or that use vertical
    chrominance subsampling.
  * The TurboJPEG API now supports 4:4:1 (transposed 4:1:1)
    chrominance subsampling, which allows losslessly transposed or
    rotated 4:1:1 JPEG images to be losslessly cropped, partially
    decompressed, or decompressed to planar YUV images.
  * Fixed various segfaults and buffer overruns (CVE-2023-2804)
  * that occurred when attempting to decompress various
    specially-crafted malformed 12-bit-per-component and
    16-bit-per-component lossless JPEG images using color
    quantization or merged chroma upsampling/color conversion.  The
    underlying cause of these issues was that the color
    quantization and merged chroma upsampling/color conversion
    algorithms were not designed with lossless decompression
    in mind.  Since libjpeg-turbo explicitly does not support color
    conversion when compressing or decompressing lossless JPEG
    images, merged chroma upsampling/color conversion never should
    have been enabled for such images.  Color quantization is a
    legacy feature that serves little or no purpose with lossless
    JPEG images, so it is also now disabled when decompressing such
    images.  (As a result, djpeg can no longer decompress a
    lossless JPEG image into a GIF image.)
  * Fixed an oversight in 1.4 beta1[8] that caused various
    segfaults and buffer overruns when attempting to decompress
    various specially-crafted malformed 12-bit-per-component JPEG
    images using djpeg with both color quantization and RGB565
    color conversion enabled.
  * Fixed an issue whereby `jpeg_crop_scanline()` sometimes
    miscalculated the downsampled width for components with 4x2 or
    2x4 subsampling factors if decompression scaling was enabled.
    This caused the components to be upsampled incompletely, which
    caused the color converter to read from uninitialized memory.
    With 12-bit data precision, this caused a buffer overrun or
    underrun and subsequent segfault if the sample value read from
    uninitialized memory was outside of the valid sample range.
  * Fixed a long-standing issue whereby the `tj3Transform()`
    function, when used with the `TJXOP_TRANSPOSE`,
    `TJXOP_TRANSVERSE`, `TJXOP_ROT90`, or `TJXOP_ROT270` transform
    operation and without automatic JPEG destination buffer
    (re)allocation or lossless cropping, computed the worst-case
    transformed JPEG image size based on the source image
    dimensions rather than the transformed image dimensions.  If a
    calling program allocated the JPEG destination buffer based on
    the transformed image dimensions, as the API documentation
    instructs, and attempted to transform a specially-crafted
    4:2:2, 4:4:0, 4:1:1, or 4:4:1 JPEG source image containing a
    large amount of metadata, the issue caused `tj3Transform()` to
    overflow the JPEG destination buffer rather than fail
    gracefully.  The issue could be worked around by setting
    `TJXOPT_COPYNONE`.  Note that, irrespective of this issue,
    `tj3Transform()` cannot reliably transform JPEG source images
    that contain a large amount of metadata unless automatic JPEG
    destination buffer (re)allocation is used or `TJXOPT_COPYNONE`
    is set.
  * Significantly sped up the computation of optimal Huffman
    tables. This speeds up the compression of tiny images by as
    much as 2x and provides a noticeable speedup for images as
    large as 256x256 when using optimal Huffman tables.
  * All deprecated fields, constructors, and methods in the
    TurboJPEG Java API have been removed.
  * Arithmetic entropy coding is now supported with
    12-bit-per-component JPEG images.
  * Overhauled the TurboJPEG API to address long-standing
    limitations and to make the API more extensible and intuitive.</changelog>
  <changelog author="Andreas Schwab &lt;schwab@suse.de&gt;" date="1705320000">- Do not require SIMD support when it does not exist</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1707134400">- Update to version 3.0.2
  * Fixed a signed integer overflow in the tj3CompressFromYUV8(),
    tj3DecodeYUV8(), tj3DecompressToYUV8(), and tj3EncodeYUV8()
    functions, detected by the Clang and GCC undefined behavior
    sanitizers, that could be triggered by setting the align
    parameter to an unreasonably large value. This issue did not
    pose a security threat, but removing the warning made it
    easier to detect actual security issues, should they arise in
    the future.
  * Introduced a new parameter (TJPARAM_MAXMEMORY in the
    TurboJPEG C API and TJ.PARAM_MAXMEMORY in the TurboJPEG Java
    API) and a corresponding TJBench option (-maxmemory) for
    specifying the maximum amount of memory (in megabytes) that
    will be allocated for intermediate buffers, which are used
    with progressive JPEG compression and decompression, optimized
    baseline entropy coding, lossless JPEG compression, and
    lossless transformation. The new parameter and option serve
    the same purpose as the max_memory_to_use field in the
    jpeg_memory_mgr struct in the libjpeg API, the JPEGMEM
    environment variable, and the cjpeg/djpeg/jpegtran -maxmemory
    option.
  * Introduced a new parameter (TJPARAM_MAXPIXELS in the TurboJPEG
    C API and TJ.PARAM_MAXPIXELS in the TurboJPEG Java API) and a
    corresponding TJBench option (-maxpixels) for specifying the
    maximum number of pixels that the decompression, lossless
    transformation, and packed-pixel image loading
    functions/methods will process.
  * Fixed an error ("Unsupported color conversion request") that
    occurred when attempting to decompress a 3-component lossless
    JPEG image without an Adobe APP14 marker. The decompressor
    now assumes that a 3-component lossless JPEG image without an
    Adobe APP14 marker uses the RGB colorspace if its component
    IDs are 1, 2, and 3.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1725105600">- update to 3.0.3:
  * The x86-64 SIMD extensions now include support for Intel
    Control-flow Enforcement Technology (CET), which is enabled
    automatically if CET is enabled in the C compiler.
  * Fixed a regression introduced by 3.0 beta2[6] that made it
    impossible for calling applications to supply custom Huffman
    tables when generating 12-bit-per-component lossy JPEG images
    using the libjpeg API.
  * Fixed a segfault that occurred when attempting to use the
    jpegtran `-drop` option with a specially-crafted malformed
    input image or drop image (specifically an image in which all
    of the scans contain fewer components than the number of
    components specified in the Start Of Frame segment.)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1727524800">- update to 3.0.4:
  * Fixed an issue whereby the CPU usage of the default marker
    processor in the decompressor grew exponentially with the
    number of markers.  This caused an unreasonable slow-down in
    `jpeg_read_header()` if an application called `jpeg_save_markers()`
    to save markers of a particular type and then attempted to
    decompress a JPEG image containing an excessive number of markers
    of that type.
  * Hardened the default marker processor in the decompressor to guard
    against an issue (exposed by 3.0 beta2[6]) whereby attempting to
    decompress a specially-crafted malformed JPEG image (specifically
    an image with a complete 12-bit-per-sample Start Of Frame segment
    followed by an incomplete 8-bit-per-sample Start Of Frame segment)
    using buffered-image mode and input prefetching caused a segfault
    if the `fill_input_buffer()` method in the calling application's
    custom source manager incorrectly returned `FALSE` in response to a
    prematurely-terminated JPEG data stream.
  * Fixed an issue in cjpeg whereby, when generating a
    12-bit-per-sample or 16-bit-per-sample lossless JPEG image,
    specifying a point transform value greater than 7 resulted in an
    error ("Invalid progressive/lossless parameters") unless the
    `-precision` option was specified before the `-lossless` option.
  * Fixed a regression introduced by 3.0.3[3] that made it impossible
    for calling applications to generate 12-bit-per-sample
    arithmetic-coded lossy JPEG images using the TurboJPEG API.
  * Fixed an error ("Destination buffer is not large enough") that
    occurred when attempting to generate a full-color lossless JPEG
    image using the TurboJPEG Java API's `byte[]
    TJCompressor.compress()` method if the value of `TJ.PARAM_SUBSAMP`
    was not `TJ.SAMP_444`.
  * Fixed a segfault in djpeg that occurred if a negative width was
    specified with the `-crop` option.  Since the cropping region width
    was read into an unsigned 32-bit integer, a negative width was
    interpreted as a very large value.  With certain negative width and
    positive left boundary values, the bounds checks in djpeg and
    `jpeg_crop_scanline()` overflowed and did not detect the
    out-of-bounds width, which caused a buffer overrun in the
    upsampling or color conversion routine.  Both bounds checks now use
    64-bit integers to guard against overflow, and djpeg now checks for
    negative numbers when it parses the crop specification from the
    command line.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods checked the specified cropping region against
    the source image dimensions and level of chrominance subsampling
    rather than the destination image dimensions and level of
    chrominance subsampling, which caused some cropping regions to be
    unduly rejected when performing 90-degree rotation, 270-degree
    rotation, transposition, transverse transposition, or grayscale
    conversion.
  * Fixed an issue whereby the TurboJPEG lossless transformation
    function and methods did not honor
    `TJXOPT_COPYNONE`/`TJTransform.OPT_COPYNONE` unless it was
    specified for all lossless transforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1757505600">- version update to 3.1.2
  * The libjpeg-turbo source tree has been reorganized.
  * cjpeg no longer allows GIF input files to be converted into
    12-bit-per-sample JPEG files.
  * Added support for lossless JPEG images with 2 to 15 bits per
    sample to the libjpeg and TurboJPEG APIs.
  * All deprecated constants and methods in the TurboJPEG Java API
    have been removed.
  * TJBench command-line arguments are now more consistent with
    those of cjpeg, djpeg, and jpegtran.
  * Added a new TJBench option (-pixelformat gray) that can be
    used to test the performance of compressing/decompressing
    a grayscale JPEG image from/to a packed-pixel grayscale image.
  * Fixed an issue whereby, if TJPARAM_NOREALLOC was set, TurboJPEG
    compression and lossless transformation functions ignored the
    JPEG buffer size(s) passed to them and assumed that the JPEG
    buffer(s) had been allocated to a worst-case size returned by
    tj3JPEGBufSize().
  * The TurboJPEG C and Java APIs have been improved.
  * TJExample has been replaced with three programs (TJComp,
    TJDecomp, and TJTran) that demonstrate how to approximate the
    functionality of cjpeg, djpeg, and jpegtran using the TurboJPEG
    C and Java APIs.
- modified patches
  * libjpeg-turbo-1.3.0-tiff-ojpeg.patch (refreshed)</changelog>
</package>
</otherdata>