From 90de40e55bd1701bf6799151dbb80d8c942c7f6f Mon Sep 17 00:00:00 2001
From: Miroslav Lichvar <mlichvar@redhat.com>
Date: Wed, 2 May 2018 11:43:33 +0200
Subject: [PATCH] fix memory leak in parsing of vorbis comments (CVE-2017-6888)

---
 flac-memleak.patch | 22 ++++++++++++++++++++++
 flac.spec          |  3 +++
 2 files changed, 25 insertions(+)
 create mode 100644 flac-memleak.patch

diff --git a/flac-memleak.patch b/flac-memleak.patch
new file mode 100644
index 0000000..03fe2d9
--- /dev/null
+++ b/flac-memleak.patch
@@ -0,0 +1,22 @@
+commit 4f47b63e9c971e6391590caf00a0f2a5ed612e67
+Author: Erik de Castro Lopo <erikd@mega-nerd.com>
+Date:   Sat Apr 8 18:34:49 2017 +1000
+
+    stream_decoder.c: Fix a memory leak
+    
+    Leak reported by Secunia Research.
+
+diff --git a/src/libFLAC/stream_decoder.c b/src/libFLAC/stream_decoder.c
+index 14d5fe7f..a5527511 100644
+--- a/src/libFLAC/stream_decoder.c
++++ b/src/libFLAC/stream_decoder.c
+@@ -1753,6 +1753,9 @@ FLAC__bool read_metadata_vorbiscomment_(FLAC__StreamDecoder *decoder, FLAC__Stre
+ 					}
+ 					memset (obj->comments[i].entry, 0, obj->comments[i].length) ;
+ 					if (!FLAC__bitreader_read_byte_block_aligned_no_crc(decoder->private_->input, obj->comments[i].entry, obj->comments[i].length)) {
++						/* Current i-th entry is bad, so we delete it. */
++						free (obj->comments[i].entry) ;
++						obj->comments[i].entry = NULL ;
+ 						obj->num_comments = i;
+ 						goto skip;
+ 					}
diff --git a/flac.spec b/flac.spec
index 54d0c2f..298ab83 100644
--- a/flac.spec
+++ b/flac.spec
@@ -15,6 +15,8 @@ Source0: http://downloads.xiph.org/releases/flac/flac-%{version}.tar.xz
 URL: http://www.xiph.org/flac/
 # use our CFLAGS and don't force SSE intrinsics
 Patch1: flac-cflags.patch
+# fix memory leak in parsing of vorbis comments
+Patch2: flac-memleak.patch
 Requires: %{name}-libs%{?_isa} = %{version}-%{release}
 BuildRequires: libogg-devel
 BuildRequires: automake autoconf libtool gettext-devel doxygen
@@ -79,6 +81,7 @@ This is the input plugin for XMMS to be able to read FLAC files.
 %prep
 %setup -q
 %patch1 -p1 -b .cflags
+%patch2 -p1 -b .memleak
 
 %build
 # use our libtool to avoid problems with RPATH