Accepting request 758347 from filesystems

- Update to release 3.2.3

OBS-URL: https://build.opensuse.org/request/show/758347
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libmirage?expand=0&rev=21

0001-libMirage-CSO-filter-validate-part-size.patch

@@ -1,38 +0,0 @@
-From 0e9292c9aa34bf545f43f7efe5f0b94faba94962 Mon Sep 17 00:00:00 2001
-From: Rok Mandeljc <rok.mandeljc@gmail.com>
-Date: Sun, 25 Aug 2019 14:53:58 +0200
-Subject: [PATCH 1/2] libMirage: CSO filter: validate part size
-
-Part size must be always either smaller than the declared block
-size (compressed block) or equal to it (raw block). If not, return
-error - because we allocate our I/O buffer based on the block size.
-
-Fixes SF bug #119, which is triggered by part size ending up being
-larger than the block size. Thanks to Andrea Fioraldi for report
-and thorough analysis of the issue.
----
- libmirage/filters/filter-cso/filter-stream.c | 8 ++++++++
- 1 file changed, 8 insertions(+)
-
-diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c
-index 5f2f5e25..d43aa54a 100644
---- a/libmirage/filters/filter-cso/filter-stream.c
-+++ b/libmirage/filters/filter-cso/filter-stream.c
-@@ -120,6 +120,14 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self
-             CSO_Part *prev_part = &self->priv->parts[i-1];
- 
-             prev_part->comp_size = cur_part->offset - prev_part->offset;
-+
-+            /* Part size must be either smaller than header->block_size
-+               (compressed block ) or equal to it (raw block) */
-+            if (prev_part->comp_size > header->block_size) {
-+                MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: invalid part/index entry: part data length (%" G_GINT64_MODIFIER "d) exceeds declared block size (%d)!\n", __debug__, prev_part->comp_size, header->block_size);
-+                g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!"));
-+                return FALSE;
-+            }
-         }
-     }
- 
--- 
-2.22.1
-

0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch

@@ -1,37 +0,0 @@
-From f6adcd08beffd9dac2c4a86852ba0bda06870f4f Mon Sep 17 00:00:00 2001
-From: Rok Mandeljc <rok.mandeljc@gmail.com>
-Date: Sun, 25 Aug 2019 15:11:23 +0200
-Subject: [PATCH 2/2] libMirage: CSO filter: replaced a g_assert() with error
- return
-
----
- libmirage/filters/filter-cso/filter-stream.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
-diff --git a/libmirage/filters/filter-cso/filter-stream.c b/libmirage/filters/filter-cso/filter-stream.c
-index d43aa54a..065dc40c 100644
---- a/libmirage/filters/filter-cso/filter-stream.c
-+++ b/libmirage/filters/filter-cso/filter-stream.c
-@@ -70,12 +70,17 @@ static gboolean mirage_filter_stream_cso_read_index (MirageFilterStreamCso *self
- 
-     MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: reading part index\n", __debug__);
- 
-+    if (header->total_bytes % header->block_size) {
-+        MIRAGE_DEBUG(self, MIRAGE_DEBUG_WARNING, "%s: original stream size (%" G_GUINT64_FORMAT ") is not a multiple of block size (%d)!\n", __debug__, header->total_bytes, header->block_size);
-+        g_set_error(error, MIRAGE_ERROR, MIRAGE_ERROR_STREAM_ERROR, Q_("Invalid CSO file!"));
-+        return FALSE;
-+    }
-+
-     self->priv->num_parts = header->total_bytes / header->block_size;
-     self->priv->num_indices = self->priv->num_parts + 1; /* Contains EOF offset */
--    g_assert(header->total_bytes % header->block_size == 0);
- 
-     MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: number of parts: %d\n", __debug__, self->priv->num_parts);
--    MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: original stream size: %" G_GINT64_MODIFIER "d\n", __debug__, header->total_bytes);
-+    MIRAGE_DEBUG(self, MIRAGE_DEBUG_PARSER, "%s: original stream size: 0x%" G_GINT64_MODIFIER "X (%" G_GUINT64_FORMAT ")\n", __debug__, header->total_bytes, header->total_bytes);
- 
-     /* At least one part must be present */
-     if (!self->priv->num_parts) {
--- 
-2.22.1
-

CVE-2019-15757.patch

@@ -4,10 +4,10 @@ Origin: https://gist.github.com/andreafioraldi/343d9ba64060b548c02362a5e61ec932
  images/image-nrg/parser.c |    7 +++++++
  1 file changed, 7 insertions(+)
 
-Index: libmirage-3.2.2/images/image-nrg/parser.c
+Index: libmirage-3.2.3/images/image-nrg/parser.c
 ===================================================================
---- a/libmirage-3.2.2.orig/images/image-nrg/parser.c
-+++ b/libmirage-3.2.2/images/image-nrg/parser.c
+--- libmirage-3.2.3.orig/images/image-nrg/parser.c
++++ libmirage-3.2.3/images/image-nrg/parser.c
 @@ -987,6 +987,13 @@ static MirageDisc *mirage_parser_nrg_loa
      /* Set CD-ROM as default medium type, will be changed accordingly if there
         is a MTYP block provided */
@@ -20,5 +20,5 @@ Index: libmirage-3.2.2/images/image-nrg/parser.c
 +        goto end;
 +    }
  
-     /* Read descriptor data */
-     self->priv->nrg_data = g_malloc(self->priv->nrg_data_length);
+     /* Validate data length */
+     if (self->priv->nrg_data_length == 0) {

libmirage-3.2.2.tar.bz2

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:f1f2d2b1eaa42f2cb1c6edbeefb4c76031c7f2f6de5d71c702117a075474993f
-size 234131

libmirage-3.2.3.tar.bz2

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ce93d053850936eee981a6ce1484cf85e77aef90241ed29c9e63a0313ddeae22
+size 234761

libmirage.changes

@@ -1,3 +1,17 @@
+-------------------------------------------------------------------
+Thu Dec 19 22:37:39 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
+
+- Update to release 3.2.3
+  * CSO filter: replaced a g_assert() with error return
+  * CSO filter: validate part size
+  * NRG parser: validate nrg_data_length
+  * ISO writer: ignore raw and subchannel modes for non-CD media
+  * TOC image writer: return error when trying to open non-CD
+    image for writing
+- Drop 0001-libMirage-CSO-filter-validate-part-size.patch,
+  0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch
+  (merged upstream)
+
 -------------------------------------------------------------------
 Tue Sep  3 09:53:55 UTC 2019 - Jan Engelhardt <jengelh@inai.de>
 

libmirage.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package libmirage
 #
-# Copyright (c) 2019 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2019 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -22,14 +22,12 @@ Name:           libmirage
 Summary:        A CD-ROM image access library
 License:        GPL-2.0-or-later
 Group:          Development/Libraries/C and C++
-Version:        3.2.2
+Version:        3.2.3
 Release:        0
 URL:            http://cdemu.sf.net/about/libmirage/
 
 #Git-Clone:     git://git.code.sf.net/p/cdemu/code
 Source:         https://downloads.sf.net/cdemu/%name-%version.tar.bz2
-Patch1:         0001-libMirage-CSO-filter-validate-part-size.patch
-Patch2:         0002-libMirage-CSO-filter-replaced-a-g_assert-with-error-.patch
 Patch3:         CVE-2019-15757.patch
 BuildRequires:  cmake >= 2.8.5
 BuildRequires:  intltool >= 0.21
@@ -133,7 +131,7 @@ file.
 This package provides the GObject Introspection bindings for libmirage.
 
 %prep
-%autosetup -p2
+%autosetup -p1
 
 %build
 %cmake -DCMAKE_MODULE_LINKER_FLAGS=""