diff --git a/0001-libMirage-CSO-filter-validate-part-size.patch b/0001-libMirage-CSO-filter-validate-part-size.patch deleted file mode 100644 index 92102bd..0000000 --- a/0001-libMirage-CSO-filter-validate-part-size.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 0e9292c9aa34bf545f43f7efe5f0b94faba94962 Mon Sep 17 00:00:00 2001 -From: Rok Mandeljc -Date: Sun, 25 Aug 2019 14:53:58 +0200 -Subject: [PATCH 1/2] libMirage: CSO filter: validate part size - -Part size must be always either smaller than the declared block -size (compressed block) or equal to it (raw block). If not, return -error - because we allocate our I/O buffer based on the block size. - -Fixes SF bug #119, which is triggered by part size ending up being -larger than the block size. Thanks to Andrea Fioraldi for report -and thorough analysis of the issue. ---- - libmirage/filters/filter-cso/filter-stream.c | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c -index 5f2f5e25..d43aa54a 100644 ---- a/libmirage/filters/filter-cso/filter-stream.c -+++ b/libmirage/filters/filter-cso/filter-stream.c -@@ -120,6 +120,14 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self - CSO_Part *prev_part = &self->priv->parts[i-1]; - - prev_part->comp_size = cur_part->offset - prev_part->offset; -+ -+ /* Part size must be either smaller than header->block_size -+ (compressed block ) or equal to it (raw block) */ -+ if (prev_part->comp_size > header->block_size) { -+ MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: invalid part/index entry: part data length (%" G_GINT64_MODIFIER "d) exceeds declared block size (%d)!\n", __debug__, prev_part->comp_size, header->block_size); -+ g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!")); -+ return FALSE; -+ } - } - } - --- -2.22.1 - diff --git a/0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch b/0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch deleted file mode 100644 index 7f2f5bc..0000000 --- a/0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch +++ /dev/null @@ -1,37 +0,0 @@ -From f6adcd08beffd9dac2c4a86852ba0bda06870f4f Mon Sep 17 00:00:00 2001 -From: Rok Mandeljc -Date: Sun, 25 Aug 2019 15:11:23 +0200 -Subject: [PATCH 2/2] libMirage: CSO filter: replaced a g_assert() with error - return - ---- - libmirage/filters/filter-cso/filter-stream.c | 9 +++++++-- - 1 file changed, 7 insertions(+), 2 deletions(-) - -diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c -index d43aa54a..065dc40c 100644 ---- a/libmirage/filters/filter-cso/filter-stream.c -+++ b/libmirage/filters/filter-cso/filter-stream.c -@@ -70,12 +70,17 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self - - MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: reading part index\n", __debug__); - -+ if (header->total_bytes % header->block_size) { -+ MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: original stream size (%" G_GUINT64_FORMAT ") is not a multiple of block size (%d)!\n", __debug__, header->total_bytes, header->block_size); -+ g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!")); -+ return FALSE; -+ } -+ - self->priv->num_parts = header->total_bytes / header->block_size; - self->priv->num_indices = self->priv->num_parts + 1; /* Contains EOF offset */ -- g_assert(header->total_bytes % header->block_size == 0); - - MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: number of parts: %d\n", __debug__, self->priv->num_parts); -- MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: original stream size: %" G_GINT64_MODIFIER "d\n", __debug__, header->total_bytes); -+ MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: original stream size: 0x%" G_GINT64_MODIFIER "X (%" G_GUINT64_FORMAT ")\n", __debug__, header->total_bytes, header->total_bytes); - - /* At least one part must be present */ - if (!self->priv->num_parts) { --- -2.22.1 - diff --git a/CVE-2019-15757.patch b/CVE-2019-15757.patch index cf9d37d..acbc696 100644 --- a/CVE-2019-15757.patch +++ b/CVE-2019-15757.patch @@ -4,10 +4,10 @@ Origin: https://gist.github.com/andreafioraldi/343d9ba64060b548c02362a5e61ec932 images/image-nrg/parser.c | 7 +++++++ 1 file changed, 7 insertions(+) -Index: libmirage-3.2.2/images/image-nrg/parser.c +Index: libmirage-3.2.3/images/image-nrg/parser.c =================================================================== ---- a/libmirage-3.2.2.orig/images/image-nrg/parser.c -+++ b/libmirage-3.2.2/images/image-nrg/parser.c +--- libmirage-3.2.3.orig/images/image-nrg/parser.c ++++ libmirage-3.2.3/images/image-nrg/parser.c @@ -987,6 +987,13 @@ static MirageDisc *mirage_parser_nrg_loa /* Set CD-ROM as default medium type, will be changed accordingly if there is a MTYP block provided */ @@ -20,5 +20,5 @@ Index: libmirage-3.2.2/images/image-nrg/parser.c + goto end; + } - /* Read descriptor data */ - self->priv->nrg_data = g_malloc(self->priv->nrg_data_length); + /* Validate data length */ + if (self->priv->nrg_data_length == 0) { diff --git a/libmirage-3.2.2.tar.bz2 b/libmirage-3.2.2.tar.bz2 deleted file mode 100644 index a59504d..0000000 --- a/libmirage-3.2.2.tar.bz2 +++ /dev/null @@ -1,3 +0,0 @@ -version https://git-lfs.github.com/spec/v1 -oid sha256:f1f2d2b1eaa42f2cb1c6edbeefb4c76031c7f2f6de5d71c702117a075474993f -size 234131 diff --git a/libmirage-3.2.3.tar.bz2 b/libmirage-3.2.3.tar.bz2 new file mode 100644 index 0000000..4928e48 --- /dev/null +++ b/libmirage-3.2.3.tar.bz2 @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:ce93d053850936eee981a6ce1484cf85e77aef90241ed29c9e63a0313ddeae22 +size 234761 diff --git a/libmirage.changes b/libmirage.changes index 7dca4b2..163dd20 100644 --- a/libmirage.changes +++ b/libmirage.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Thu Dec 19 22:37:39 UTC 2019 - Jan Engelhardt + +- Update to release 3.2.3 + * No changelog was provided +- Drop 0001-libMirage-CSO-filter-validate-part-size.patch, + 0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch + (merged upstream) + ------------------------------------------------------------------- Tue Sep 3 09:53:55 UTC 2019 - Jan Engelhardt diff --git a/libmirage.spec b/libmirage.spec index d873790..af8885a 100644 --- a/libmirage.spec +++ b/libmirage.spec @@ -1,7 +1,7 @@ # # spec file for package libmirage # -# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany. +# Copyright (c) 2019 SUSE LLC # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -22,14 +22,12 @@ Name: libmirage Summary: A CD-ROM image access library License: GPL-2.0-or-later Group: Development/Libraries/C and C++ -Version: 3.2.2 +Version: 3.2.3 Release: 0 URL: http://cdemu.sf.net/about/libmirage/ #Git-Clone: git://git.code.sf.net/p/cdemu/code Source: https://downloads.sf.net/cdemu/%name-%version.tar.bz2 -Patch1: 0001-libMirage-CSO-filter-validate-part-size.patch -Patch2: 0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch Patch3: CVE-2019-15757.patch BuildRequires: cmake >= 2.8.5 BuildRequires: intltool >= 0.21