pool/flac
SHA256
4
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 601932 from multimedia:libs

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/601932
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/flac?expand=0&rev=52
This commit is contained in:
Dominique Leuenberger 2018-05-01 21:08:50 +00:00 committed by Git OBS Bridge
commit d0f180b2ed
3 changed files with 33 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
flac-CVE-2017-6888.patch Normal file
View File

@ -0,0 +1,22 @@
From 4f47b63e9c971e6391590caf00a0f2a5ed612e67 Mon Sep 17 00:00:00 2001
From: Erik de Castro Lopo <erikd@mega-nerd.com>
Date: Sat, 8 Apr 2017 18:34:49 +1000
Subject: [PATCH] stream_decoder.c: Fix a memory leak
Leak reported by Secunia Research.
---
src/libFLAC/stream_decoder.c | 3 +++
1 file changed, 3 insertions(+)
--- a/src/libFLAC/stream_decoder.c
+++ b/src/libFLAC/stream_decoder.c
@@ -1759,6 +1759,9 @@ FLAC__bool read_metadata_vorbiscomment_(
}
memset (obj->comments[i].entry, 0, obj->comments[i].length) ;
if (!FLAC__bitreader_read_byte_block_aligned_no_crc(decoder->private_->input, obj->comments[i].entry, obj->comments[i].length)) {
+ /* Current i-th entry is bad, so we delete it. */
+ free (obj->comments[i].entry) ;
+ obj->comments[i].entry = NULL ;
obj->num_comments = i;
goto skip;
}

7
flac.changes
View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Fri Apr 27 15:17:11 CEST 2018 - tiwai@suse.de
- Fix memory leak in read_metadata_vorbiscomment_() function
(CVE-2017-6888, bsc#1091045):
flac-CVE-2017-6888.patch
-------------------------------------------------------------------
Sun Jan 1 04:35:06 UTC 2017 - aloisio@gmx.com

6
flac.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package flac
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -20,7 +20,7 @@ Name: flac
Version: 1.3.2
Release: 0
Summary: Free Lossless Audio Codec
License: BSD-3-Clause and GPL-2.0+ and GFDL-1.2
License: BSD-3-Clause AND GPL-2.0-or-later AND GFDL-1.2-only
Group: Productivity/Multimedia/Sound/Utilities
Url: https://xiph.org/flac/
#Git-Web: https://git.xiph.org/?p=flac.git
@ -28,6 +28,7 @@ Url: https://xiph.org/flac/
Source: http://downloads.xiph.org/releases/flac/%{name}-%{version}.tar.xz
Source2: baselibs.conf
Patch0: flac-cflags.patch
Patch1: flac-CVE-2017-6888.patch
BuildRequires: autoconf >= 2.60
BuildRequires: automake >= 1.11
BuildRequires: doxygen
@ -85,6 +86,7 @@ FLAC library.
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%build
autoreconf -fvi