From 6b6bee3d0a6de4f17ddea2b5da4ca22630364971 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Wed, 20 May 2026 06:19:46 -0400 Subject: [PATCH] import CS git libsndfile-1.0.28-17.el8_10 --- ...t-overflow-when-calculating-sf.frame.patch | 38 +++++++++++++++++++ SPECS/libsndfile.spec | 9 ++++- 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 SOURCES/0001-ima_adpcm-fix-int-overflow-when-calculating-sf.frame.patch diff --git a/SOURCES/0001-ima_adpcm-fix-int-overflow-when-calculating-sf.frame.patch b/SOURCES/0001-ima_adpcm-fix-int-overflow-when-calculating-sf.frame.patch new file mode 100644 index 0000000..6c39c8f --- /dev/null +++ b/SOURCES/0001-ima_adpcm-fix-int-overflow-when-calculating-sf.frame.patch @@ -0,0 +1,38 @@ +From 0e1d2664822358ebae3fdb8ca15ba1b4ed99f22f Mon Sep 17 00:00:00 2001 +From: Wim Taymans +Date: Mon, 18 May 2026 14:33:55 +0200 +Subject: [PATCH] ima_adpcm: fix int overflow when calculating sf.frames + +When calculating sf.frames, pre-cast samplesperblock to sf_count_t, to +provide the calculation with enough numeric space to avoid overflows. + +CVE: CVE-2026-37555 +--- + src/ima_adpcm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/ima_adpcm.c b/src/ima_adpcm.c +index 18b56c49..168aec62 100644 +--- a/src/ima_adpcm.c ++++ b/src/ima_adpcm.c +@@ -164,7 +164,7 @@ ima_close (SF_PRIVATE *psf) + if (pima->samplecount && pima->samplecount < pima->samplesperblock) + pima->encode_block (psf, pima) ; + +- psf->sf.frames = pima->samplesperblock * pima->blockcount / psf->sf.channels ; ++ psf->sf.frames = (sf_count_t) pima->samplesperblock * pima->blockcount / psf->sf.channels ; + } ; + + return 0 ; +@@ -232,7 +232,7 @@ ima_reader_init (SF_PRIVATE *psf, int blockalign, int samplesperblock) + + pima->decode_block = wavlike_ima_decode_block ; + +- psf->sf.frames = pima->samplesperblock * pima->blocks ; ++ psf->sf.frames = (sf_count_t) pima->samplesperblock * pima->blocks ; + break ; + + case SF_FORMAT_AIFF : +-- +2.54.0 + diff --git a/SPECS/libsndfile.spec b/SPECS/libsndfile.spec index ec15180..dacde31 100644 --- a/SPECS/libsndfile.spec +++ b/SPECS/libsndfile.spec @@ -1,7 +1,7 @@ Summary: Library for reading and writing sound files Name: libsndfile Version: 1.0.28 -Release: 16%{?dist} +Release: 17%{?dist} License: LGPLv2+ and GPLv2+ and BSD Group: System Environment/Libraries URL: http://www.mega-nerd.com/libsndfile/ @@ -26,6 +26,8 @@ Patch12: libsndfile-1.0.31-pullrequest979.patch # from upstream, for <= 1.2.2, #RHEL-65095 Patch13: libsndfile-1.0.28-cve-2024-50612prereq.patch Patch14: libsndfile-1.2.2-cve-2024-50612.patch +Patch16: 0001-ima_adpcm-fix-int-overflow-when-calculating-sf.frame.patch + BuildRequires: alsa-lib-devel BuildRequires: flac-devel BuildRequires: libogg-devel @@ -85,6 +87,7 @@ This package contains command line utilities for libsndfile. %patch -P 12 -p1 -b .pullrequest979 %patch -P 13 -p1 -b .cve-2024-50612prereq %patch -P 14 -p1 -b .cve-2024-50612 +%patch -P 16 -p1 -b .0016 rm -r src/GSM610 %build @@ -180,6 +183,10 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check %changelog +* Mon May 18 2026 Wim Taymans - 1.0.28-17 +- apply patch for CVE-2026-37555 + Resolves: RHEL-174533 + * Tue Nov 26 2024 Michal Hlavinka - 1.0.28-16 - fix prerequisit patch (#RHEL-65093)