Bug#1142962: trixie-pu: package bcg729/1.1.1-3+deb13u1
Guillem Jover
gjover at sipwise.com
Tue Jul 28 20:32:01 BST 2026
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: bcg729 at packages.debian.org, rfuchs at sipwise.com
Control: affects -1 + src:bcg729
User: release.debian.org at packages.debian.org
Usertags: pu
Hi!
[ Reason ]
This update includes a SIGFPE fix due to a division by zero. This was
found to affect rtpengine when processing SIP packets from external
sources, which can cause crashes and DoS scenarios for example on VoIP
services.
[ Impact ]
Crashes/DoS, loss of VoIP service.
[ Tests ]
Richard Fuchs (CCed) tested this when filing this upstream [U], and now
again with the packages I've built. He prepared the attached test program
and the following test session, which shows the SIGFPE with the unfixed
packages, and how the SIGFPE no longer applies once fixed.
[U] https://github.com/BelledonneCommunications/bcg729/issues/21
,---
# dpkg -l libbcg729\*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-========================-============-============-==========================================================
ii libbcg729-0:amd64 1.1.1-3 amd64 ITU G.729 Annex A compatible audio codec
ii libbcg729-0-dbgsym:amd64 1.1.1-3 amd64 debug symbols for libbcg729-0
ii libbcg729-dev:amd64 1.1.1-3 amd64 Development files for the ITU G.729 compatible audio codec
# gcc test.c -o test -lbcg729
# ./test
Floating point exception (core dumped)
# 136 # ls -la *deb
-rw-r--r-- 1 root root 35600 Jul 28 21:10 libbcg729-0_1.1.1-3+deb13u1_amd64.deb
-rw-r--r-- 1 root root 70472 Jul 28 21:10 libbcg729-0-dbgsym_1.1.1-3+deb13u1_amd64.deb
-rw-r--r-- 1 root root 8320 Jul 28 21:10 libbcg729-dev_1.1.1-3+deb13u1_amd64.deb
# dpkg -i *.deb
(Reading database ... 174488 files and directories currently installed.)
Preparing to unpack libbcg729-0_1.1.1-3+deb13u1_amd64.deb ...
Unpacking libbcg729-0:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
Preparing to unpack libbcg729-0-dbgsym_1.1.1-3+deb13u1_amd64.deb ...
Unpacking libbcg729-0-dbgsym:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
Preparing to unpack libbcg729-dev_1.1.1-3+deb13u1_amd64.deb ...
Unpacking libbcg729-dev:amd64 (1.1.1-3+deb13u1) over (1.1.1-3) ...
Setting up libbcg729-0:amd64 (1.1.1-3+deb13u1) ...
Setting up libbcg729-0-dbgsym:amd64 (1.1.1-3+deb13u1) ...
Setting up libbcg729-dev:amd64 (1.1.1-3+deb13u1) ...
Processing triggers for libc-bin (2.41-12+deb13u3) ...
# dpkg -l libbcg729\*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-========================-===============-============-==========================================================
ii libbcg729-0:amd64 1.1.1-3+deb13u1 amd64 ITU G.729 Annex A compatible audio codec
ii libbcg729-0-dbgsym:amd64 1.1.1-3+deb13u1 amd64 debug symbols for libbcg729-0
ii libbcg729-dev:amd64 1.1.1-3+deb13u1 amd64 Development files for the ITU G.729 compatible audio codec
# ./test
`---
[ Risks ]
This has been present in Debian unstable and testing for a while now. It
seems like the targeted fix has low risk.
[ Checklist ]
[√] *all* changes are documented in the d/changelog
[√] I reviewed all changes and I approve them
[√] attach debdiff against the package in (old)stable
[√] the issue is verified as fixed in unstable
[ Changes ]
The fix checks for one of the values to avoid a division by zero, that
then would otherwise cause a SIGFPE.
Thanks,
Guillem
-------------- next part --------------
diff -Nru bcg729-1.1.1/debian/changelog bcg729-1.1.1/debian/changelog
--- bcg729-1.1.1/debian/changelog 2025-02-07 08:42:06.000000000 +0100
+++ bcg729-1.1.1/debian/changelog 2026-07-28 18:26:01.000000000 +0200
@@ -1,3 +1,10 @@
+bcg729 (1.1.1-3+deb13u1) trixie; urgency=medium
+
+ * Fix SIGFPE due to a division by zero in bcg729Encoder().
+ Patch taken from upstream.
+
+ -- Guillem Jover <gjover at sipwise.com> Tue, 28 Jul 2026 18:26:01 +0200
+
bcg729 (1.1.1-3) unstable; urgency=medium
* cmake patches from upstream
diff -Nru bcg729-1.1.1/debian/patches/0006-Avoid-possible-division-by-0.patch bcg729-1.1.1/debian/patches/0006-Avoid-possible-division-by-0.patch
--- bcg729-1.1.1/debian/patches/0006-Avoid-possible-division-by-0.patch 1970-01-01 01:00:00.000000000 +0100
+++ bcg729-1.1.1/debian/patches/0006-Avoid-possible-division-by-0.patch 2026-07-28 18:23:41.000000000 +0200
@@ -0,0 +1,29 @@
+From 53d06732711b8b03d292a4218c9570ec464cb751 Mon Sep 17 00:00:00 2001
+From: johan pascal <johan.pascal at belledonne-communications.com>
+Date: Mon, 6 Jul 2026 22:49:06 +0200
+Subject: [PATCH] Avoid possible division by 0 thanks Richard Fuchs
+
+---
+ src/LP2LSPConversion.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/LP2LSPConversion.c b/src/LP2LSPConversion.c
+index 2bbae5d..40d57bc 100644
+--- a/src/LP2LSPConversion.c
++++ b/src/LP2LSPConversion.c
+@@ -100,7 +100,11 @@ int LP2LSPConversion(word16_t LPCoefficients[], word16_t LSPCoefficients[])
+
+ /* linear interpolation for better root accuracy */
+ /* xMean = xLow - (xHigh-xLow)* previousCx/(Cx-previousCx); */
+- xMean = (word16_t)SUB32(xLow, MULT16_32_Q15(SUB32(xHigh, xLow), DIV32(SSHL(SATURATE(previousCx, MAXINT17), 14), SHR(SUB32(Cx, previousCx), 1)))); /* Cx are in Q2.15 so we can shift them left 14 bits, the denominator is shifted righ by 1 so the division result is in Q15 */
++ if (previousCx == Cx) { // avoid possible division by 0: consider previousCx/(Cx-previousCx) to be MAXINT32 or MININT32 depending on previousCx sign
++ xMean = (word16_t)SUB32(xLow, MULT16_32_Q15(SUB32(xHigh, xLow), previousCx>0?MAXINT32:MININT32));
++ } else {
++ xMean = (word16_t)SUB32(xLow, MULT16_32_Q15(SUB32(xHigh, xLow), SSHL(DIV32(SSHL(SATURATE(previousCx, MAXINT17), 14), SUB32(Cx, previousCx)), 1))); /* Cx are in Q2.15 so we can shift them left 14 bits, the division result is in Q14 so we shift left it one to put it back to Q15 */
++ }
+
+ /* recompute previousCx with the new coefficients */
+ previousCx = ChebyshevPolynomial(xMean, polynomialCoefficients);
+--
+2.53.0
+
diff -Nru bcg729-1.1.1/debian/patches/series bcg729-1.1.1/debian/patches/series
--- bcg729-1.1.1/debian/patches/series 2025-02-07 08:42:06.000000000 +0100
+++ bcg729-1.1.1/debian/patches/series 2026-07-28 18:25:25.000000000 +0200
@@ -3,3 +3,4 @@
0003-No-longer-use-CMAKE_BUILD_TYPE-to-allow-configuratio.patch
0004-cmake-files-installed-under-usr-lib-arch-triplet.patch
0005-Prevent-RPM-.spec-file-generation-which-breaks-repea.patch
+0006-Avoid-possible-division-by-0.patch
-------------- next part --------------
A non-text attachment was scrubbed...
Name: bcg729_sigfpe-test.c
Type: text/x-csrc
Size: 1927 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-voip-maintainers/attachments/20260728/5939abf1/attachment.c>
More information about the Pkg-voip-maintainers
mailing list