libsndfile/sndfile-deinterlace-channels-check.patch

Index: libsndfile-1.0.31/programs/sndfile-deinterleave.c
===================================================================
--- libsndfile-1.0.31.orig/programs/sndfile-deinterleave.c
+++ libsndfile-1.0.31/programs/sndfile-deinterleave.c
@@ -96,6 +96,11 @@ main (int argc, char **argv)
 		} ;
 
 
+	if (sfinfo.channels > MAX_CHANNELS)
+	{	printf ("\nError : Too many channels %d in input file '%s'.\n", sfinfo.channels, argv[1]) ;
+		exit (1) ;
+		}
+
 	state.channels = sfinfo.channels ;
 	sfinfo.channels = 1 ;
Accepting request 879319 from home:dirkmueller:Factory - update to 1.0.31: * documentation fixes and updates * Change CMake's project name from sndfile to libsndfile as it should be. * Fix memory leak in wav_read_smpl_chunk() function, credit to OSS-Fuzz. * Fix aiff_read_header() memory leak(), credit to OSS-Fuzz. * Fix leak in wav_read_header(), credit to OSS-Fuzz. * Fix leak in wavlike_read_cart_chunk(), credit to OSS-Fuzz. * Fix memory leak in wav_read_acid_chunk(), credit to OSS-Fuzz. * Fix memory leak in aiff_read_basc_chunk(), credit to OSS-Fuzz. * Fix memory leak in wavlike_read_peak_chunk(), credit to OSS-Fuzz. * Fix memory leak in aiff_read_header(), credit to OSS-Fuzz. * Fix use of uninitialized value in exif_subchunk_parse(), credit to OSS-Fuzz. * Fix use of uninitialized value in endswap_int64_t_array(), credit to * OSS-Fuzz. * Fix up the fuzzer so that it can't under or overseek, * thanks to Max Dymond cmeister2@gmail.com. * Fix Autotools configure on macOS, thanks to @tmcguire and @nwh. * Exclude repository-configuration from git-archive, thanks to @umlaeute. * Use version-script when compiling with clang on Unix with Autotools, thanks * to @tstellar. * Improve handling of SMPL chunks in WAV files, thanks to @zodf0055980. - update to 1.0.30: * Move sndfile.h.in from src/ to include/ directory. * Huge documentation update. * Fix opus test failures on BE platforms * Fix bug when sf_open_fd() function sometimes leaves filehandle open, even if close_desc parameter is TRUE, thanks to @umläute. * Fix infinite loops on some pathological SD2 files * Switch to GitHub Actions for continuous integration. * Add OSS-Fuzz tests to GitHub Actions workflow * Fix memory leak in wavlike_read_bext_chunk() function, credit to OSS-Fuzz. OBS-URL: https://build.opensuse.org/request/show/879319 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libsndfile?expand=0&rev=79 2021-03-16 08:20:11 +00:00			`Index: libsndfile-1.0.31/programs/sndfile-deinterleave.c`
			`===================================================================`
			`--- libsndfile-1.0.31.orig/programs/sndfile-deinterleave.c`
			`+++ libsndfile-1.0.31/programs/sndfile-deinterleave.c`
			`@@ -96,6 +96,11 @@ main (int argc, char **argv)`
Accepting request 621327 from home:tiwai:branches:multimedia:libs - Fix buffer overflow in sndfile-deinterlace, which isn't really a security issue (bsc#1100167, CVE-2018-13139): sndfile-deinterlace-channels-check.patch OBS-URL: https://build.opensuse.org/request/show/621327 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libsndfile?expand=0&rev=68 2018-07-06 12:28:14 +00:00			`} ;`

Accepting request 879319 from home:dirkmueller:Factory - update to 1.0.31: * documentation fixes and updates * Change CMake's project name from sndfile to libsndfile as it should be. * Fix memory leak in wav_read_smpl_chunk() function, credit to OSS-Fuzz. * Fix aiff_read_header() memory leak(), credit to OSS-Fuzz. * Fix leak in wav_read_header(), credit to OSS-Fuzz. * Fix leak in wavlike_read_cart_chunk(), credit to OSS-Fuzz. * Fix memory leak in wav_read_acid_chunk(), credit to OSS-Fuzz. * Fix memory leak in aiff_read_basc_chunk(), credit to OSS-Fuzz. * Fix memory leak in wavlike_read_peak_chunk(), credit to OSS-Fuzz. * Fix memory leak in aiff_read_header(), credit to OSS-Fuzz. * Fix use of uninitialized value in exif_subchunk_parse(), credit to OSS-Fuzz. * Fix use of uninitialized value in endswap_int64_t_array(), credit to * OSS-Fuzz. * Fix up the fuzzer so that it can't under or overseek, * thanks to Max Dymond cmeister2@gmail.com. * Fix Autotools configure on macOS, thanks to @tmcguire and @nwh. * Exclude repository-configuration from git-archive, thanks to @umlaeute. * Use version-script when compiling with clang on Unix with Autotools, thanks * to @tstellar. * Improve handling of SMPL chunks in WAV files, thanks to @zodf0055980. - update to 1.0.30: * Move sndfile.h.in from src/ to include/ directory. * Huge documentation update. * Fix opus test failures on BE platforms * Fix bug when sf_open_fd() function sometimes leaves filehandle open, even if close_desc parameter is TRUE, thanks to @umläute. * Fix infinite loops on some pathological SD2 files * Switch to GitHub Actions for continuous integration. * Add OSS-Fuzz tests to GitHub Actions workflow * Fix memory leak in wavlike_read_bext_chunk() function, credit to OSS-Fuzz. OBS-URL: https://build.opensuse.org/request/show/879319 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libsndfile?expand=0&rev=79 2021-03-16 08:20:11 +00:00
Accepting request 621327 from home:tiwai:branches:multimedia:libs - Fix buffer overflow in sndfile-deinterlace, which isn't really a security issue (bsc#1100167, CVE-2018-13139): sndfile-deinterlace-channels-check.patch OBS-URL: https://build.opensuse.org/request/show/621327 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libsndfile?expand=0&rev=68 2018-07-06 12:28:14 +00:00			`+ if (sfinfo.channels > MAX_CHANNELS)`
			`+ { printf ("\nError : Too many channels %d in input file '%s'.\n", sfinfo.channels, argv[1]) ;`
			`+ exit (1) ;`
			`+ }`
			`+`
			`state.channels = sfinfo.channels ;`
			`sfinfo.channels = 1 ;`