From f738f717876d8f2b05757ac04610a15c9f40a69a Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 5 Apr 2022 06:24:08 -0400 Subject: [PATCH] import libsndfile-1.0.31-7.el9 --- SOURCES/libsndfile-1.0.31-ced91d7b.patch | 25 ++++++++++++++++++++++++ SPECS/libsndfile.spec | 8 +++++++- 2 files changed, 32 insertions(+), 1 deletion(-) create mode 100644 SOURCES/libsndfile-1.0.31-ced91d7b.patch diff --git a/SOURCES/libsndfile-1.0.31-ced91d7b.patch b/SOURCES/libsndfile-1.0.31-ced91d7b.patch new file mode 100644 index 0000000..c39c029 --- /dev/null +++ b/SOURCES/libsndfile-1.0.31-ced91d7b.patch @@ -0,0 +1,25 @@ +From ced91d7b971be6173b604154c39279ce90ad87cc Mon Sep 17 00:00:00 2001 +From: yuan +Date: Tue, 20 Apr 2021 16:16:32 +0800 +Subject: [PATCH] flac: Fix improper buffer reusing (#732) + +--- + src/flac.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/src/flac.c b/src/flac.c +index 64d0172e6..e33204505 100644 +--- a/src/flac.c ++++ b/src/flac.c +@@ -948,7 +948,11 @@ flac_read_loop (SF_PRIVATE *psf, unsigned len) + /* Decode some more. */ + while (pflac->pos < pflac->len) + { if (FLAC__stream_decoder_process_single (pflac->fsd) == 0) ++ { psf_log_printf (psf, "FLAC__stream_decoder_process_single returned false\n") ; ++ /* Current frame is busted, so NULL the pointer. */ ++ pflac->frame = NULL ; + break ; ++ } ; + state = FLAC__stream_decoder_get_state (pflac->fsd) ; + if (state >= FLAC__STREAM_DECODER_END_OF_STREAM) + { psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ; diff --git a/SPECS/libsndfile.spec b/SPECS/libsndfile.spec index 51f4304..c950c4d 100644 --- a/SPECS/libsndfile.spec +++ b/SPECS/libsndfile.spec @@ -1,7 +1,7 @@ Summary: Library for reading and writing sound files Name: libsndfile Version: 1.0.31 -Release: 6%{?dist} +Release: 7%{?dist} License: LGPLv2+ and GPLv2+ and BSD URL: http://libsndfile.github.io/libsndfile/ Source0: https://github.com/libsndfile/libsndfile/releases/download/%{version}/libsndfile-%{version}.tar.bz2 @@ -9,6 +9,8 @@ Patch0: libsndfile-1.0.25-system-gsm.patch Patch1: libsndfile-1.0.25-zerodivfix.patch # from upstream, for <= 1.0.31, rhbz#1985029 Patch2: libsndfile-1.0.31-deb669ee.patch +# from upstream, fix #2030508, for <= 1.0.31 +Patch3: libsndfile-1.0.31-ced91d7b.patch BuildRequires: gcc-c++ BuildRequires: alsa-lib-devel BuildRequires: flac-devel @@ -61,6 +63,7 @@ rm -r src/GSM610 # TODO: check if this patch is still needed %patch1 -p1 -b .zerodivfix %patch2 -p1 -b .deb669ee +%patch3 -p1 -b .ced91d7b %build autoreconf -I M4 -fiv # for system-gsm patch @@ -152,6 +155,9 @@ LD_LIBRARY_PATH=$PWD/src/.libs make check %changelog +* Wed Jan 12 2022 Michal Hlavinka - 1.0.31-7 +- fix heap buffer overflow in flac (#2030508) + * Wed Aug 11 2021 Michal Hlavinka - 1.0.31-6 - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985029)