blosc2 2.6.0__tar.gz → 2.6.2__tar.gz

{blosc2-2.6.0 → blosc2-2.6.2}/ANNOUNCE.rst

@@ -1,15 +1,10 @@
-Announcing Python-Blosc2 2.6.0
+Announcing Python-Blosc2 2.6.2
 ==============================
 
-New evaluation engine (based on numexpr) for NDArray instances.  Now,
-you can evaluate expressions like `a + b + 1` where `a` and `b` are
-NDArray instances.  This is a powerful feature that allows for
-efficient computations on compressed data.  See this
-[example](https://github.com/Blosc/python-blosc2/blob/main/examples/ndarray/eval_expr.py)
-to see how this works.  Thanks to @omaech for her help in the `pow` function.
-
-Also, this is the first version supporting NumPy 2.0.0.  Please tell us
-if you find any issues with this new version of NumPy.
+Updated to latest C-Blosc2 2.14.3. This was necessary to fix
+several CVEs in the C-Blosc2 library.  Also, the new version adds
+protection when platforms have just one CPU. This caused the
+internal number of threads to be 0, producing a division by zero.
 
 For more info, you can have a look at the release notes in:
 

{blosc2-2.6.0/blosc2.egg-info → blosc2-2.6.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: blosc2
-Version: 2.6.0
+Version: 2.6.2
 Summary: Python wrapper for the C-Blosc2 library
 Author-email: Blosc Development Team <blosc@blosc.org>
 Maintainer-email: Blosc Development Team <blosc@blosc.org>

{blosc2-2.6.0 → blosc2-2.6.2}/RELEASE_NOTES.md

@@ -1,16 +1,28 @@
 # Release notes
 
+## Changes from 2.6.1 to 2.6.2
+
+* Protection when platforms have just one CPU. This caused the
+  internal number of threads to be 0, producing a division by zero.
+
+* Updated to latest C-Blosc2 2.14.3.
+
+## Changes from 2.6.0 to 2.6.1
+
+* Updated to latest C-Blosc2 2.14.1. This was necessary to be able to
+  load dynamics plugins on Windows.
+
 ## Changes from 2.5.1 to 2.6.0
 
-* New evaluation engine (based on numexpr) for NDArray instances.  Now,
-  you can evaluate expressions like `a + b + 1` where `a` and `b` are
-  NDArray instances.  This is a powerful feature that allows for
+* [EXP] New evaluation engine (based on numexpr) for NDArray instances.
+  Now, you can evaluate expressions like `a + b + 1` where `a` and `b`
+  are NDArray instances.  This is a powerful feature that allows for
   efficient computations on compressed data.  See this
   [example](https://github.com/Blosc/python-blosc2/blob/main/examples/ndarray/eval_expr.py)
   to see how this works.  Thanks to @omaech for her help in the `pow` function.
 
-* As a consequence, there are many new functions to operate with NDArray
-  instances.  See the function section in
+* As a consequence of the above, there are many new functions to operate with
+  NDArray instances.  See the function section in
   [NDArray API](https://www.blosc.org/python-blosc2/reference/ndarray_api.html#functions)
   for more information.
 

blosc2-2.6.2/VERSION

@@ -0,0 +1 @@
+2.6.2

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/__init__.py

@@ -242,7 +242,9 @@ blosclib_version = f"{VERSION_STRING} ({VERSION_DATE})"
 The blosc2 version + date.
 """
 # Internal Blosc threading
-nthreads = ncores = detect_number_of_cores() // 2
+nthreads = ncores = detect_number_of_cores()
+if ncores > 1:
+    nthreads = ncores // 2
 """Number of threads to be used in compression/decompression.
 """
 # Protection against too many threads

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/.github/workflows/fuzz.yml

@@ -1,5 +1,5 @@
 name: CI Fuzz
-on: [pull_request]
+on: [push, pull_request]
 jobs:
   Fuzzing:
     runs-on: ubuntu-latest

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/ANNOUNCE.md

@@ -1,10 +1,10 @@
-# Announcing C-Blosc2 2.14.0
+# Announcing C-Blosc2 2.14.3
 A fast, compressed and persistent binary data store library for C.
 
 ## What is new?
 
-This is a minor release for adding an accelerated path in `b2nd_append()`.
-Also, many fixes and improvements have been added.
+This is a maintenance release. We have fixed some additional security
+issues discovered by OSS-Fuzz.
 
 For more info, please see the release notes in:
 

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/RELEASE_NOTES.md

@@ -1,6 +1,24 @@
 Release notes for C-Blosc2
 ==========================
 
+Changes from 2.14.2 to 2.14.3
+=============================
+
+* More fixes for internal fuzzer.
+
+Changes from 2.14.1 to 2.14.2
+=============================
+
+* Fixes for CVE-2024-3203 and CVE-2024-3204.
+
+
+Changes from 2.14.0 to 2.14.1
+=============================
+
+* When loading plugins, first try with `python` and then `python3`.
+  This is because many linux distros do not have `python` as a
+  symlink to `python3` anymore.
+
 Changes from 2.13.2 to 2.14.0
 =============================
 

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/RELEASING.rst

@@ -83,7 +83,7 @@ Announcing
 - Send an announcement to the blosc and comp.compression mailing lists.
   Use the ``ANNOUNCE.md`` file as skeleton (likely as the definitive version).
 
-- Tweet about it from the @Blosc2 account.
+- Toot about it from the @Blosc2 account in https://fosstodon.org.
 
 
 Post-release actions

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/blosc/blosc-private.h

@@ -246,20 +246,32 @@ static inline const char *dlerror (void) {
 #endif
 
 
-static inline void* load_lib(char *plugin_name, char *libpath) {
+static inline int get_libpath(char *plugin_name, char *libpath, char *python_version) {
+  BLOSC_TRACE_INFO("Trying to get plugin path with python%s\n", python_version);
   char python_cmd[PATH_MAX] = {0};
-  sprintf(python_cmd, "python3 -c \"import blosc2_%s; blosc2_%s.print_libpath()\"", plugin_name, plugin_name);
+  sprintf(python_cmd, "python%s -c \"import blosc2_%s; blosc2_%s.print_libpath()\"", python_version, plugin_name, plugin_name);
   FILE *fp = popen(python_cmd, "r");
   if (fp == NULL) {
     BLOSC_TRACE_ERROR("Could not run python");
-    return NULL;
+    return BLOSC2_ERROR_FAILURE;
   }
   if (fgets(libpath, PATH_MAX, fp) == NULL) {
     BLOSC_TRACE_ERROR("Could not read python output");
     pclose(fp);
-    return NULL;
+    return BLOSC2_ERROR_FAILURE;
   }
   pclose(fp);
+
+  return BLOSC2_ERROR_SUCCESS;
+}
+
+
+static inline void* load_lib(char *plugin_name, char *libpath) {
+  if (get_libpath(plugin_name, libpath, "") < 0 && get_libpath(plugin_name, libpath, "3") < 0) {
+    BLOSC_TRACE_ERROR("Problems when running python or python3 for getting plugin path");
+    return NULL;
+  }
+
   if (strlen(libpath) == 0) {
     BLOSC_TRACE_ERROR("Could not find plugin libpath");
     return NULL;

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/include/blosc2.h

@@ -83,10 +83,10 @@ extern "C" {
 /* Version numbers */
 #define BLOSC2_VERSION_MAJOR    2    /* for major interface/format changes  */
 #define BLOSC2_VERSION_MINOR    14   /* for minor interface/format changes  */
-#define BLOSC2_VERSION_RELEASE  0    /* for tweaks, bug-fixes, or development */
+#define BLOSC2_VERSION_RELEASE  3    /* for tweaks, bug-fixes, or development */
 
-#define BLOSC2_VERSION_STRING   "2.14.0"  /* string version.  Sync with above! */
-#define BLOSC2_VERSION_DATE     "$Date:: 2023-04-01 #$"    /* date version */
+#define BLOSC2_VERSION_STRING   "2.14.3"  /* string version.  Sync with above! */
+#define BLOSC2_VERSION_DATE     "$Date:: 2023-04-06 #$"    /* date version */
 
 
 /* The maximum number of dimensions for Blosc2 NDim arrays */

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c

@@ -522,8 +522,8 @@ int ndlz4_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   uint8_t *ip_limit = ip + input_len;
   uint8_t *op = (uint8_t *) output;
   uint8_t ndim;
-  uint32_t blockshape[2];
-  uint32_t eshape[2];
+  int32_t blockshape[2];
+  int32_t eshape[2];
   uint8_t *buffercpy;
   uint8_t local_buffer[16];
   uint8_t token;
@@ -542,10 +542,18 @@ int ndlz4_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   ip += 4;
   memcpy(&blockshape[1], ip, 4);
   ip += 4;
+
+  // Sanity check.  See https://www.cve.org/CVERecord?id=CVE-2024-3204
+  if (output_len < 0 || blockshape[0] < 0 || blockshape[1] < 0) {
+    BLOSC_TRACE_ERROR("Output length or blockshape is negative");
+    return BLOSC2_ERROR_FAILURE;
+  }
+
   eshape[0] = ((blockshape[0] + 3) / 4) * 4;
   eshape[1] = ((blockshape[1] + 3) / 4) * 4;
 
   if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
+    BLOSC_TRACE_ERROR("The blockshape is bigger than the output buffer");
     return 0;
   }
   memset(op, 0, blockshape[0] * blockshape[1]);
@@ -691,7 +699,7 @@ int ndlz4_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   }
   ind += padding[1];
 
-  if (ind != (blockshape[0] * blockshape[1])) {
+  if ((int32_t)ind != (blockshape[0] * blockshape[1])) {
     BLOSC_TRACE_ERROR("Output size is not compatible with embedded blockshape");
     return BLOSC2_ERROR_FAILURE;
   }

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c

@@ -460,9 +460,18 @@ int ndlz8_decompress(const uint8_t *input, int32_t input_len, uint8_t *output, i
   ip += 4;
   memcpy(&blockshape[1], ip, 4);
   ip += 4;
+
+  // Sanity check.  See https://www.cve.org/CVERecord?id=CVE-2024-3203
+  if (output_len < 0 || blockshape[0] < 0 || blockshape[1] < 0) {
+    BLOSC_TRACE_ERROR("Output length or blockshape is negative");
+    return BLOSC2_ERROR_FAILURE;
+  }
+
   eshape[0] = ((blockshape[0] + 7) / cell_shape) * cell_shape;
   eshape[1] = ((blockshape[1] + 7) / cell_shape) * cell_shape;
+
   if (NDLZ_UNEXPECT_CONDITIONAL((int64_t)output_len < (int64_t)blockshape[0] * (int64_t)blockshape[1])) {
+    BLOSC_TRACE_ERROR("The blockshape is bigger than the output buffer");
     return 0;
   }
   memset(op, 0, blockshape[0] * blockshape[1]);

{blosc2-2.6.0 → blosc2-2.6.2}/blosc2/core.py

@@ -394,8 +394,6 @@ def unpack_array(packed_array, **kwargs):
     if kwargs:
         arr = pickle.loads(pickled_array, **kwargs)
         if all(isinstance(x, bytes) for x in arr.tolist()):
-            import numpy as np
-
             arr = np.array([x.decode("utf-8") for x in arr.tolist()])
     else:
         arr = pickle.loads(pickled_array)
@@ -618,8 +616,6 @@ def pack_tensor(tensor, chunksize=None, **kwargs):
     :func:`~blosc2.unpack_tensor`
     :func:`~blosc2.save_tensor`
     """
-    import numpy as np
-
     arr = np.asarray(tensor)
 
     schunk = blosc2.SChunk(chunksize=chunksize, data=arr, **kwargs)
@@ -647,8 +643,6 @@ def pack_tensor(tensor, chunksize=None, **kwargs):
 
 
 def _unpack_tensor(schunk):
-    import numpy as np
-
     kind, shape, dtype = schunk.vlmeta["__pack_tensor__"]
     out = np.empty(shape, dtype=dtype)
     schunk.get_slice(out=out)

blosc2-2.6.2/blosc2/version.py

@@ -0,0 +1 @@
+__version__ = "2.6.2"

{blosc2-2.6.0 → blosc2-2.6.2/blosc2.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: blosc2
-Version: 2.6.0
+Version: 2.6.2
 Summary: Python wrapper for the C-Blosc2 library
 Author-email: Blosc Development Team <blosc@blosc.org>
 Maintainer-email: Blosc Development Team <blosc@blosc.org>

blosc2-2.6.0/VERSION

@@ -1 +0,0 @@
-2.6.0

blosc2-2.6.0/blosc2/version.py

@@ -1 +0,0 @@
-__version__ = "2.6.0"