From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id D87C5139085 for ; Sat, 21 Jan 2017 18:18:08 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 36485E0C69; Sat, 21 Jan 2017 18:18:06 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id F2C91E0C69 for ; Sat, 21 Jan 2017 18:18:05 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id A61E0341686 for ; Sat, 21 Jan 2017 18:18:04 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 1ED6A2B96 for ; Sat, 21 Jan 2017 18:18:03 +0000 (UTC) From: "Alexis Ballier" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Alexis Ballier" Message-ID: <1485022485.d95fcc8b14612f4a91ab015436e4ea709ba1a7e4.aballier@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: media-libs/audiofile/, media-libs/audiofile/files/ X-VCS-Repository: repo/gentoo X-VCS-Files: media-libs/audiofile/audiofile-0.3.6-r3.ebuild media-libs/audiofile/files/audiofile-0.3.6-CVE-2015-7747.patch X-VCS-Directories: media-libs/audiofile/ media-libs/audiofile/files/ X-VCS-Committer: aballier X-VCS-Committer-Name: Alexis Ballier X-VCS-Revision: d95fcc8b14612f4a91ab015436e4ea709ba1a7e4 X-VCS-Branch: master Date: Sat, 21 Jan 2017 18:18:03 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 3b250ce9-95c1-494c-8752-366ab1bedb5e X-Archives-Hash: 88eb16f18d14183dc9ef61940983b332 commit: d95fcc8b14612f4a91ab015436e4ea709ba1a7e4 Author: Thomas Deutschmann gentoo org> AuthorDate: Sat Jan 21 17:03:07 2017 +0000 Commit: Alexis Ballier gentoo org> CommitDate: Sat Jan 21 18:14:45 2017 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d95fcc8b media-libs/audiofile: Add patch for CVE-2015-7747 (bug #562886) Package-Manager: Portage-2.3.3, Repoman-2.3.1 media-libs/audiofile/audiofile-0.3.6-r3.ebuild | 51 +++++++ .../files/audiofile-0.3.6-CVE-2015-7747.patch | 156 +++++++++++++++++++++ 2 files changed, 207 insertions(+) diff --git a/media-libs/audiofile/audiofile-0.3.6-r3.ebuild b/media-libs/audiofile/audiofile-0.3.6-r3.ebuild new file mode 100644 index 00000000..4707a47 --- /dev/null +++ b/media-libs/audiofile/audiofile-0.3.6-r3.ebuild @@ -0,0 +1,51 @@ +# Copyright 1999-2017 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +inherit autotools gnome.org multilib-minimal + +DESCRIPTION="An elegant API for accessing audio files" +HOMEPAGE="http://www.68k.org/~michael/audiofile/" + +LICENSE="GPL-2 LGPL-2.1" +SLOT="0/1" # subslot = soname major version +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc \ + ~x86 ~amd64-fbsd ~x86-fbsd ~x86-freebsd ~x86-interix ~amd64-linux \ + ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x86-solaris" +IUSE="flac static-libs test" + +RDEPEND="flac? ( >=media-libs/flac-1.2.1[${MULTILIB_USEDEP}] )" +DEPEND="${RDEPEND} + virtual/pkgconfig + test? ( dev-cpp/gtest[${MULTILIB_USEDEP}] )" + +PATCHES=( + "${FILESDIR}"/${PN}-0.3.6-gcc6-build-fixes.patch + "${FILESDIR}"/${PN}-0.3.6-system-gtest.patch + "${FILESDIR}"/${PN}-0.3.6-CVE-2015-7747.patch +) + +src_prepare() { + default + eautoreconf +} + +multilib_src_configure() { + local myconf=( + --enable-largefile + --disable-werror + --disable-examples + $(use_enable flac) + $(use_enable static-libs static) + ) + ECONF_SOURCE="${S}" econf "${myconf[@]}" +} + +multilib_src_install_all() { + einstalldocs + + # package provides .pc file + find "${D}" -name '*.la' -delete || die +} diff --git a/media-libs/audiofile/files/audiofile-0.3.6-CVE-2015-7747.patch b/media-libs/audiofile/files/audiofile-0.3.6-CVE-2015-7747.patch new file mode 100644 index 00000000..3325639 --- /dev/null +++ b/media-libs/audiofile/files/audiofile-0.3.6-CVE-2015-7747.patch @@ -0,0 +1,156 @@ +Description: fix buffer overflow when changing both sample format and + number of channels +Origin: https://github.com/mpruett/audiofile/pull/25 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/audiofile/+bug/1502721 +Bug-Debian: https://bugs.debian.org/801102 + +--- a/libaudiofile/modules/ModuleState.cpp ++++ b/libaudiofile/modules/ModuleState.cpp +@@ -402,7 +402,7 @@ status ModuleState::arrange(AFfilehandle + addModule(new Transform(outfc, in.pcm, out.pcm)); + + if (in.channelCount != out.channelCount) +- addModule(new ApplyChannelMatrix(infc, isReading, ++ addModule(new ApplyChannelMatrix(outfc, isReading, + in.channelCount, out.channelCount, + in.pcm.minClip, in.pcm.maxClip, + track->channelMatrix)); +--- a/test/Makefile.am ++++ b/test/Makefile.am +@@ -26,6 +26,7 @@ TESTS = \ + VirtualFile \ + floatto24 \ + query2 \ ++ sixteen-stereo-to-eight-mono \ + sixteen-to-eight \ + testchannelmatrix \ + testdouble \ +@@ -139,6 +140,7 @@ printmarkers_SOURCES = printmarkers.c + printmarkers_LDADD = $(LIBAUDIOFILE) -lm + + sixteen_to_eight_SOURCES = sixteen-to-eight.c TestUtilities.cpp TestUtilities.h ++sixteen_stereo_to_eight_mono_SOURCES = sixteen-stereo-to-eight-mono.c TestUtilities.cpp TestUtilities.h + + testchannelmatrix_SOURCES = testchannelmatrix.c TestUtilities.cpp TestUtilities.h + +--- /dev/null ++++ b/test/sixteen-stereo-to-eight-mono.c +@@ -0,0 +1,118 @@ ++/* ++ Audio File Library ++ ++ Copyright 2000, Silicon Graphics, Inc. ++ ++ This program is free software; you can redistribute it and/or modify ++ it under the terms of the GNU General Public License as published by ++ the Free Software Foundation; either version 2 of the License, or ++ (at your option) any later version. ++ ++ This program is distributed in the hope that it will be useful, ++ but WITHOUT ANY WARRANTY; without even the implied warranty of ++ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ GNU General Public License for more details. ++ ++ You should have received a copy of the GNU General Public License along ++ with this program; if not, write to the Free Software Foundation, Inc., ++ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. ++*/ ++ ++/* ++ sixteen-stereo-to-eight-mono.c ++ ++ This program tests the conversion from 2-channel 16-bit integers to ++ 1-channel 8-bit integers. ++*/ ++ ++#ifdef HAVE_CONFIG_H ++#include ++#endif ++ ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include ++ ++#include "TestUtilities.h" ++ ++int main (int argc, char **argv) ++{ ++ AFfilehandle file; ++ AFfilesetup setup; ++ int16_t frames16[] = {14298, 392, 3923, -683, 958, -1921}; ++ int8_t frames8[] = {28, 6, -2}; ++ int i, frameCount = 3; ++ int8_t byte; ++ AFframecount result; ++ ++ setup = afNewFileSetup(); ++ ++ afInitFileFormat(setup, AF_FILE_WAVE); ++ ++ afInitSampleFormat(setup, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 16); ++ afInitChannels(setup, AF_DEFAULT_TRACK, 2); ++ ++ char *testFileName; ++ if (!createTemporaryFile("sixteen-to-eight", &testFileName)) ++ { ++ fprintf(stderr, "Could not create temporary file.\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ file = afOpenFile(testFileName, "w", setup); ++ if (file == AF_NULL_FILEHANDLE) ++ { ++ fprintf(stderr, "could not open file for writing\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ afFreeFileSetup(setup); ++ ++ afWriteFrames(file, AF_DEFAULT_TRACK, frames16, frameCount); ++ ++ afCloseFile(file); ++ ++ file = afOpenFile(testFileName, "r", AF_NULL_FILESETUP); ++ if (file == AF_NULL_FILEHANDLE) ++ { ++ fprintf(stderr, "could not open file for reading\n"); ++ exit(EXIT_FAILURE); ++ } ++ ++ afSetVirtualSampleFormat(file, AF_DEFAULT_TRACK, AF_SAMPFMT_TWOSCOMP, 8); ++ afSetVirtualChannels(file, AF_DEFAULT_TRACK, 1); ++ ++ for (i=0; i