vorbis-tools: Fix linking bug, patch for CVE-{2015-6749, 2014-9639,2014-9640}
This commit is contained in:
Predrag Ivanovic
Fredrik Rinnestam
parent
99dd75d7bb
commit
4f9d4a4c50
@ -1 +1,5 @@
|
||||
79d58a391c1a7b78a56a8978b56debb8 vcut-fix-segfault.diff
|
||||
567e0fb8d321b2cd7124f8208b8b90e6 vorbis-tools-1.4.0.tar.gz
|
||||
8ec105f0c7d0aeac783d5e6425e556aa vorbis-tools-CVE-2015-6749.patch
|
||||
2fce7f67171c23f12132cee098bf8679 vorbis-tools-oggenc-CVE-2014-9639.patch
|
||||
e4be56f42b45c090963f0056c432530d vorbis-tools-r19117-CVE-2014-9640.patch
|
||||
|
||||
@ -1,5 +0,0 @@
|
||||
untrusted comment: verify with /etc/ports/opt.pub
|
||||
RWSE3ohX2g5d/QaohyZTdmFylZWbqwUhAKSDLNcVXM+MQFJH/pT/3S6RSp2DkV6Uxf1WlbkanwlMKSdNm8CWzKnkQPp1mFF8tgM=
|
||||
SHA256 (Pkgfile) = 3447a466de8e43f22fa6f1f5bae87df0a5170f5319d3275ffcae4cc5e443d472
|
||||
SHA256 (.footprint) = 315026915e0068fddb8839e73fe619734907a9417070695e75e6ed5ce14abaa1
|
||||
SHA256 (vorbis-tools-1.4.0.tar.gz) = a389395baa43f8e5a796c99daf62397e435a7e73531c9f44d9084055a05d22bc
|
||||
@ -6,20 +6,31 @@
|
||||
|
||||
name=vorbis-tools
|
||||
version=1.4.0
|
||||
release=2
|
||||
source=(http://downloads.xiph.org/releases/vorbis/$name-$version.tar.gz)
|
||||
release=3
|
||||
source=(http://downloads.xiph.org/releases/vorbis/$name-$version.tar.gz
|
||||
vcut-fix-segfault.diff
|
||||
vorbis-tools-r19117-CVE-2014-9640.patch
|
||||
vorbis-tools-oggenc-CVE-2014-9639.patch
|
||||
vorbis-tools-CVE-2015-6749.patch)
|
||||
|
||||
build() {
|
||||
cd $name-$version
|
||||
cd $name-$version
|
||||
|
||||
./configure --prefix=/usr \
|
||||
--disable-nls \
|
||||
--enable-vcut
|
||||
patch -p1 -i $SRC/vcut-fix-segfault.diff
|
||||
patch -p1 -i $SRC/$name-r19117-CVE-2014-9640.patch
|
||||
patch -p1 -i $SRC/$name-oggenc-CVE-2014-9639.patch
|
||||
patch -p1 -i $SRC/$name-CVE-2015-6749.patch
|
||||
|
||||
make
|
||||
make DESTDIR=$PKG install
|
||||
export LDFLAGS="-lm $LDFLAGS"
|
||||
|
||||
mkdir $PKG/usr/etc
|
||||
mv $PKG/usr/share/doc/$name-$version/ogg123rc-example $PKG/usr/etc
|
||||
rm -rf $PKG/usr/share/doc
|
||||
./configure --prefix=/usr \
|
||||
--disable-nls \
|
||||
--enable-vcut
|
||||
|
||||
make
|
||||
make DESTDIR=$PKG install
|
||||
|
||||
mkdir $PKG/usr/etc
|
||||
mv $PKG/usr/share/doc/$name-$version/ogg123rc-example $PKG/usr/etc
|
||||
rm -rf $PKG/usr/share/doc
|
||||
}
|
||||
|
||||
15
vorbis-tools/vcut-fix-segfault.diff
Normal file
15
vorbis-tools/vcut-fix-segfault.diff
Normal file
@ -0,0 +1,15 @@
|
||||
---
|
||||
vcut/vcut.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/vcut/vcut.c
|
||||
+++ b/vcut/vcut.c
|
||||
@@ -178,7 +178,7 @@ static int submit_headers_to_stream(vcut
|
||||
for(i=0;i<4;i++)
|
||||
{
|
||||
ogg_packet p;
|
||||
- if(i < 4) /* a header packet */
|
||||
+ if(i < 3) /* a header packet */
|
||||
{
|
||||
p.bytes = vs->headers[i].length;
|
||||
p.packet = vs->headers[i].packet;
|
||||
41
vorbis-tools/vorbis-tools-CVE-2015-6749.patch
Normal file
41
vorbis-tools/vorbis-tools-CVE-2015-6749.patch
Normal file
@ -0,0 +1,41 @@
|
||||
From 04815d3e1bfae3a6cdfb2c25358a5a72b61299f7 Mon Sep 17 00:00:00 2001
|
||||
From: Mark Harris <mark.hsj@gmail.com>
|
||||
Date: Sun, 30 Aug 2015 05:54:46 -0700
|
||||
Subject: [PATCH] oggenc: Fix large alloca on bad AIFF input
|
||||
|
||||
Fixes #2212
|
||||
---
|
||||
oggenc/audio.c | 10 +++++-----
|
||||
1 file changed, 5 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/oggenc/audio.c b/oggenc/audio.c
|
||||
index 477da8c..4921fb9 100644
|
||||
--- a/oggenc/audio.c
|
||||
+++ b/oggenc/audio.c
|
||||
@@ -245,8 +245,8 @@ static int aiff_permute_matrix[6][6] =
|
||||
int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
|
||||
{
|
||||
int aifc; /* AIFC or AIFF? */
|
||||
- unsigned int len;
|
||||
- unsigned char *buffer;
|
||||
+ unsigned int len, readlen;
|
||||
+ unsigned char buffer[22];
|
||||
unsigned char buf2[8];
|
||||
aiff_fmt format;
|
||||
aifffile *aiff = malloc(sizeof(aifffile));
|
||||
@@ -269,9 +269,9 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
|
||||
return 0; /* Weird common chunk */
|
||||
}
|
||||
|
||||
- buffer = alloca(len);
|
||||
-
|
||||
- if(fread(buffer,1,len,in) < len)
|
||||
+ readlen = len < sizeof(buffer) ? len : sizeof(buffer);
|
||||
+ if(fread(buffer,1,readlen,in) < readlen ||
|
||||
+ (len > readlen && !seek_forward(in, len-readlen)))
|
||||
{
|
||||
fprintf(stderr, _("Warning: Unexpected EOF in reading AIFF header\n"));
|
||||
return 0;
|
||||
--
|
||||
2.5.0
|
||||
|
||||
72
vorbis-tools/vorbis-tools-oggenc-CVE-2014-9639.patch
Normal file
72
vorbis-tools/vorbis-tools-oggenc-CVE-2014-9639.patch
Normal file
@ -0,0 +1,72 @@
|
||||
Fix CVE-2014-9638 (bnc#914439)
|
||||
CVE-2014-9639 (bnc#914441)
|
||||
|
||||
---
|
||||
oggenc/audio.c | 19 +++++++++++++++++--
|
||||
1 file changed, 17 insertions(+), 2 deletions(-)
|
||||
|
||||
--- a/oggenc/audio.c
|
||||
+++ b/oggenc/audio.c
|
||||
@@ -13,6 +13,7 @@
|
||||
#include <config.h>
|
||||
#endif
|
||||
|
||||
+#include <limits.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
@@ -251,6 +252,7 @@ int aiff_open(FILE *in, oe_enc_opt *opt,
|
||||
aiff_fmt format;
|
||||
aifffile *aiff = malloc(sizeof(aifffile));
|
||||
int i;
|
||||
+ long channels;
|
||||
|
||||
if(buf[11]=='C')
|
||||
aifc=1;
|
||||
@@ -277,11 +279,17 @@ int aiff_open(FILE *in, oe_enc_opt *opt,
|
||||
return 0;
|
||||
}
|
||||
|
||||
- format.channels = READ_U16_BE(buffer);
|
||||
+ format.channels = channels = READ_U16_BE(buffer);
|
||||
format.totalframes = READ_U32_BE(buffer+2);
|
||||
format.samplesize = READ_U16_BE(buffer+6);
|
||||
format.rate = (int)read_IEEE80(buffer+8);
|
||||
|
||||
+ if(channels <= 0L || SHRT_MAX < channels)
|
||||
+ {
|
||||
+ fprintf(stderr, _("Warning: Unsupported count of channels in AIFF header\n"));
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
aiff->bigendian = 1;
|
||||
|
||||
if(aifc)
|
||||
@@ -412,6 +420,7 @@ int wav_open(FILE *in, oe_enc_opt *opt,
|
||||
wav_fmt format;
|
||||
wavfile *wav = malloc(sizeof(wavfile));
|
||||
int i;
|
||||
+ long channels;
|
||||
|
||||
/* Ok. At this point, we know we have a WAV file. Now we have to detect
|
||||
* whether we support the subtype, and we have to find the actual data
|
||||
@@ -449,12 +458,18 @@ int wav_open(FILE *in, oe_enc_opt *opt,
|
||||
}
|
||||
|
||||
format.format = READ_U16_LE(buf);
|
||||
- format.channels = READ_U16_LE(buf+2);
|
||||
+ format.channels = channels = READ_U16_LE(buf+2);
|
||||
format.samplerate = READ_U32_LE(buf+4);
|
||||
format.bytespersec = READ_U32_LE(buf+8);
|
||||
format.align = READ_U16_LE(buf+12);
|
||||
format.samplesize = READ_U16_LE(buf+14);
|
||||
|
||||
+ if(channels <= 0L || SHRT_MAX < channels)
|
||||
+ {
|
||||
+ fprintf(stderr, _("Warning: Unsupported count of channels in WAV header\n"));
|
||||
+ return 0;
|
||||
+ }
|
||||
+
|
||||
if(format.format == -2) /* WAVE_FORMAT_EXTENSIBLE */
|
||||
{
|
||||
if(len<40)
|
||||
36
vorbis-tools/vorbis-tools-r19117-CVE-2014-9640.patch
Normal file
36
vorbis-tools/vorbis-tools-r19117-CVE-2014-9640.patch
Normal file
@ -0,0 +1,36 @@
|
||||
---
|
||||
oggenc/oggenc.c | 4 ++--
|
||||
oggenc/skeleton.h | 2 +-
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/oggenc/oggenc.c
|
||||
+++ b/oggenc/oggenc.c
|
||||
@@ -97,6 +97,8 @@ int main(int argc, char **argv)
|
||||
.3,-1,
|
||||
0,0,0.f,
|
||||
0, 0, 0, 0, 0};
|
||||
+ input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
|
||||
+ N_("RAW file reader")};
|
||||
|
||||
int i;
|
||||
|
||||
@@ -239,8 +241,6 @@ int main(int argc, char **argv)
|
||||
|
||||
if(opt.rawmode)
|
||||
{
|
||||
- input_format raw_format = {NULL, 0, raw_open, wav_close, "raw",
|
||||
- N_("RAW file reader")};
|
||||
|
||||
enc_opts.rate=opt.raw_samplerate;
|
||||
enc_opts.channels=opt.raw_channels;
|
||||
--- a/oggenc/skeleton.h
|
||||
+++ b/oggenc/skeleton.h
|
||||
@@ -41,7 +41,7 @@ typedef struct {
|
||||
ogg_int64_t granule_rate_d; /* granule rate denominator */
|
||||
ogg_int64_t start_granule; /* start granule value */
|
||||
ogg_uint32_t preroll; /* preroll */
|
||||
- unsigned char granule_shift; // a 8-bit field /* 1 byte value holding the granule shift */
|
||||
+ unsigned char granule_shift; /* 1 byte value holding the granule shift */
|
||||
char *message_header_fields; /* holds all the message header fields */
|
||||
/* current total size of the message header fields, for realloc purpose, initially zero */
|
||||
ogg_uint32_t current_header_size;
|
||||
Loading…
x
Reference in New Issue
Block a user