Accepting request 601932 from multimedia:libs

OBS-URL: https://build.opensuse.org/request/show/601932
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/flac?expand=0&rev=52

flac-CVE-2017-6888.patch

@@ -0,0 +1,22 @@
+From 4f47b63e9c971e6391590caf00a0f2a5ed612e67 Mon Sep 17 00:00:00 2001
+From: Erik de Castro Lopo <erikd@mega-nerd.com>
+Date: Sat, 8 Apr 2017 18:34:49 +1000
+Subject: [PATCH] stream_decoder.c: Fix a memory leak
+
+Leak reported by Secunia Research.
+---
+ src/libFLAC/stream_decoder.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/src/libFLAC/stream_decoder.c
++++ b/src/libFLAC/stream_decoder.c
+@@ -1759,6 +1759,9 @@ FLAC__bool read_metadata_vorbiscomment_(
+ 					}
+ 					memset (obj->comments[i].entry, 0, obj->comments[i].length) ;
+ 					if (!FLAC__bitreader_read_byte_block_aligned_no_crc(decoder->private_->input, obj->comments[i].entry, obj->comments[i].length)) {
++						/* Current i-th entry is bad, so we delete it. */
++						free (obj->comments[i].entry) ;
++						obj->comments[i].entry = NULL ;
+ 						obj->num_comments = i;
+ 						goto skip;
+ 					}

flac.changes

@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Fri Apr 27 15:17:11 CEST 2018 - tiwai@suse.de
+
+- Fix memory leak in read_metadata_vorbiscomment_() function
+  (CVE-2017-6888, bsc#1091045):
+  flac-CVE-2017-6888.patch
+
 -------------------------------------------------------------------
 Sun Jan  1 04:35:06 UTC 2017 - aloisio@gmx.com
 

flac.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package flac
 #
-# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
+# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -20,7 +20,7 @@ Name:           flac
 Version:        1.3.2
 Release:        0
 Summary:        Free Lossless Audio Codec
-License:        BSD-3-Clause and GPL-2.0+ and GFDL-1.2
+License:        BSD-3-Clause AND GPL-2.0-or-later AND GFDL-1.2-only
 Group:          Productivity/Multimedia/Sound/Utilities
 Url:            https://xiph.org/flac/
 #Git-Web:	https://git.xiph.org/?p=flac.git
@@ -28,6 +28,7 @@ Url:            https://xiph.org/flac/
 Source:         http://downloads.xiph.org/releases/flac/%{name}-%{version}.tar.xz
 Source2:        baselibs.conf
 Patch0:         flac-cflags.patch
+Patch1:         flac-CVE-2017-6888.patch
 BuildRequires:  autoconf >= 2.60
 BuildRequires:  automake >= 1.11
 BuildRequires:  doxygen
@@ -85,6 +86,7 @@ FLAC library.
 %prep
 %setup -q
 %patch0 -p1
+%patch1 -p1
 
 %build
 autoreconf -fvi