diff --git a/.gitignore b/.gitignore index 08e0df3..b238d22 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -/flac-1.3.3.tar.xz +/flac-1.3.4.tar.xz diff --git a/flac-cve-2020-0499.patch b/flac-cve-2020-0499.patch deleted file mode 100644 index 712294a..0000000 --- a/flac-cve-2020-0499.patch +++ /dev/null @@ -1,23 +0,0 @@ -commit 2e7931c27eb15e387da440a37f12437e35b22dd4 -Author: Erik de Castro Lopo -Date: Mon Oct 7 12:55:58 2019 +1100 - - libFLAC/bitreader.c: Fix out-of-bounds read - - Credit: Oss-Fuzz - Issue: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17069 - Testcase: fuzzer_decoder-5670265022840832 - -diff --git a/src/libFLAC/bitreader.c b/src/libFLAC/bitreader.c -index 5e4b5918..3df4d02c 100644 ---- a/src/libFLAC/bitreader.c -+++ b/src/libFLAC/bitreader.c -@@ -869,7 +869,7 @@ incomplete_lsbs: - cwords = br->consumed_words; - words = br->words; - ucbits = FLAC__BITS_PER_WORD - br->consumed_bits; -- b = br->buffer[cwords] << br->consumed_bits; -+ b = cwords < br->capacity ? br->buffer[cwords] << br->consumed_bits : 0; - } while(cwords >= words && val < end); - } - diff --git a/flac.spec b/flac.spec index c9dafac..715d2a9 100644 --- a/flac.spec +++ b/flac.spec @@ -1,6 +1,6 @@ Summary: An encoder/decoder for the Free Lossless Audio Codec Name: flac -Version: 1.3.3 +Version: 1.3.4 Release: 10%{?dist} License: BSD and GPLv2+ and GFDL Source0: https://downloads.xiph.org/releases/flac/flac-%{version}.tar.xz @@ -14,8 +14,6 @@ BuildRequires: nasm >= 2.0 %endif BuildRequires: make -Patch1: flac-cve-2020-0499.patch - %description FLAC stands for Free Lossless Audio Codec. Grossly oversimplified, FLAC is similar to Ogg Vorbis, but lossless. The FLAC project consists of @@ -52,7 +50,6 @@ will use the Free Lossless Audio Codec. %prep %setup -q -%patch1 -p1 -b .cve-2020-0499 %build # use our libtool to avoid problems with RPATH diff --git a/sources b/sources index 2956500..9e604c0 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (flac-1.3.3.tar.xz) = d6417e14fab0c41b2df369e5e39ce62a5f588e491af4d465b0162f74e171e5549b2f061867f344bfbf8aaccd246bf5f2acd697e532a2c7901c920c69429b1a28 +SHA512 (flac-1.3.4.tar.xz) = 4a626e8a1bd126e234c0e5061e3b46f3a27c2065fdfa228fd8cf00d3c7fa2c05fafb5cec36acce7bfce4914bfd7db0b2a27ee15decf2d8c4caad630f62d44ec9