From a7ba8543e7564d2c9cb9e72211b5f71eca173c39 Mon Sep 17 00:00:00 2001
From: Jindrich Novy <jnovy@fedoraproject.org>
Date: Mon, 2 Nov 2009 14:12:14 +0000
Subject: [PATCH] - backport patches to fix CVE-2009-3379 (#531765) from
 upstream

---
 libvorbis.spec |  7 +++++++
 r16326.diff    | 12 ++++++++++++
 r16597.diff    | 11 +++++++++++
 3 files changed, 30 insertions(+)
 create mode 100644 r16326.diff
 create mode 100644 r16597.diff

diff --git a/libvorbis.spec b/libvorbis.spec
index e87ba31..7f3562f 100644
--- a/libvorbis.spec
+++ b/libvorbis.spec
@@ -9,6 +9,8 @@ URL:		http://www.xiph.org/
 Source:		http://downloads.xiph.org/releases/vorbis/%{name}-%{version}.tar.bz2
 BuildRoot:      %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)	
 BuildRequires: 	libogg-devel >= 2:1.1
+Patch0:		r16326.diff
+Patch1:		r16597.diff
 
 %description
 Ogg Vorbis is a fully open, non-proprietary, patent- and royalty-free,
@@ -40,6 +42,8 @@ Documentation for developing applications with libvorbis.
 %prep
 
 %setup -q
+%patch0 -p1
+%patch1 -p1
 sed -i "s/-O20/$RPM_OPT_FLAGS/" configure
 sed -i "s/-ffast-math//" configure
 
@@ -82,6 +86,9 @@ rm -rf $RPM_BUILD_ROOT
 %postun -p /sbin/ldconfig
 
 %changelog
+* Mon Nov  2 2009 Jindrich Novy <jnovy@redhat.com> 1.2.3-3
+- backport patches to fix CVE-2009-3379 (#531765) from upstream
+
 * Sat Jul 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1:1.2.3-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
 
diff --git a/r16326.diff b/r16326.diff
new file mode 100644
index 0000000..cacee99
--- /dev/null
+++ b/r16326.diff
@@ -0,0 +1,12 @@
+diff -up libvorbis-1.2.3/lib/backends.h.r16326 libvorbis-1.2.3/lib/backends.h
+--- libvorbis-1.2.3/lib/backends.h.r16326	2009-07-09 11:12:08.000000000 +0200
++++ libvorbis-1.2.3/lib/backends.h	2009-11-02 14:55:42.000000000 +0100
+@@ -111,7 +111,7 @@ typedef struct vorbis_info_residue0{
+   int    partitions;       /* possible codebooks for a partition */
+   int    groupbook;        /* huffbook for partitioning */
+   int    secondstages[64]; /* expanded out to pointers in lookup */
+-  int    booklist[256];    /* list of second stage books */
++  int    booklist[512];    /* list of second stage books */
+ 
+   const float classmetric1[64];
+   const float classmetric2[64];
diff --git a/r16597.diff b/r16597.diff
new file mode 100644
index 0000000..6f0a065
--- /dev/null
+++ b/r16597.diff
@@ -0,0 +1,11 @@
+diff -up libvorbis-1.2.3/lib/codebook.c.r16597 libvorbis-1.2.3/lib/codebook.c
+--- libvorbis-1.2.3/lib/codebook.c.r16597	2009-07-09 11:12:08.000000000 +0200
++++ libvorbis-1.2.3/lib/codebook.c	2009-11-02 14:51:15.000000000 +0100
+@@ -198,6 +198,7 @@ int vorbis_staticbook_unpack(oggpack_buf
+       for(i=0;i<s->entries;){
+         long num=oggpack_read(opb,_ilog(s->entries-i));
+         if(num==-1)goto _eofout;
++        if(length>32)goto _errout;
+         for(j=0;j<num && i<s->entries;j++,i++)
+           s->lengthlist[i]=length;
+         length++;