rpms/mpg123
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Add patch for CVE-2024-10573

Browse Source 
Resolves: RHEL-65445
This commit is contained in:
Wim Taymans 2024-12-02 16:21:08 +01:00
parent 0e73df314b
commit 678ac980c6
3 changed files with 1039 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
0001-libmpg123-first-hot-fix-for-bug-322.patch Normal file
View File

@ -0,0 +1,30 @@
From 27ae9722b26c472838b7d3c078a3701363fce951 Mon Sep 17 00:00:00 2001
From: thor <thor@35dc7657-300d-0410-a2e5-dc2837fedb53>
Date: Sun, 20 Oct 2024 14:59:10 +0000
Subject: [PATCH 1/2] libmpg123: first hot fix for bug 322
git-svn-id: svn://scm.orgis.org/mpg123/trunk@5432 35dc7657-300d-0410-a2e5-dc2837fedb53
---
src/libmpg123/parse.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/libmpg123/parse.c b/src/libmpg123/parse.c
index c2efd3dc..86c98255 100644
--- a/src/libmpg123/parse.c
+++ b/src/libmpg123/parse.c
@@ -588,6 +588,12 @@ init_resync:
debug2("read frame body of %i at %"OFF_P, fr->framesize, framepos+4);
if((ret=fr->rd->read_frame_body(fr,newbuf,fr->framesize))<0)
{
+ freeformat_count = 0;
+ // Re-decoding the old header again _must_ work.
+ // Need to ensure that we do not prepare for actual frame data when there is none
+ // (messing with header change info and decoder state).
+ if(ret != MPG123_NEED_MORE && fr->oldhead)
+ decode_header(fr, fr->oldhead, &freeformat_count);
/* if failed: flip back */
debug1("%s", ret == MPG123_NEED_MORE ? "need more" : "read error");
goto read_frame_bad;
--
2.47.0

1000
0002-libmpg123-separate-header-data-into-a-struct-ensure-.patch Normal file
View File

File diff suppressed because it is too large Load Diff

11
mpg123.spec
View File

@ -4,13 +4,16 @@
Name: mpg123
Version: 1.26.2
Release: 5%{?dist}
Release: 6%{?dist}
Summary: Real time MPEG 1.0/2.0/2.5 audio player/decoder for layers 1, 2 and 3
License: LGPLv2+
URL: http://mpg123.org
Source0: %{url}/download/%{name}-%{version}.tar.bz2
Patch1: 0001-libmpg123-first-hot-fix-for-bug-322.patch
Patch2: 0002-libmpg123-separate-header-data-into-a-struct-ensure-.patch
BuildRequires: make
BuildRequires: autoconf
BuildRequires: automake
@ -98,7 +101,7 @@ Obsoletes: %{name}-libs-devel < 1.23.8-3
Development files for decoding and output libraries.
%prep
%autosetup
%autosetup -p1
%build
autoreconf -vfi
@ -162,6 +165,10 @@ rm %{buildroot}%{_libdir}/*.la
%{_libdir}/pkgconfig/lib%{syn}.pc
%changelog
* Mon Dec 02 2024 Wim Taymans <wtaymans@redhat.com> - 1.26.2-6
- Add patch for CVE-2024-10573
Resolves: RHEL-65445
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 1.26.2-5
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688