pool/libvorbis
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 819992 from multimedia:libs

Browse Source 
OBS-URL: https://build.opensuse.org/request/show/819992
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libvorbis?expand=0&rev=52
This commit is contained in:
Dominique Leuenberger 2020-07-14 05:43:12 +00:00 committed by Git OBS Bridge
commit d85a6f2156
10 changed files with 111 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libvorbis-1.3.6.tar.xz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:af00bb5a784e7c9e69f56823de4637c350643deedaf333d0fa86ecdba6fcb415
size 1195388

BIN
libvorbis-1.3.7.tar.xz (Stored with Git LFS) Normal file
View File

Binary file not shown.

16
libvorbis-1.3.7.tar.xz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEt7AK7h+WDuoP7Wb7klmo8tLUTIQFAl8AIpkACgkQklmo8tLU
TIRcpBAArhcRWPNa+goaPGs0pvfgRHwxGTMNKbd8PDHhDL8yXQnYEzRktgCfwcXZ
+4yd1hoLMFOd1IyBASoCaxk05lbDhGKVHZo3jhxKztxweXvdgYl/dwmZTmN/EO1K
e3RycUYrJ18S4ujdCBxbYTVf6+0rsGL+UYo8rtHtyrKSGuwHqUEq+gtwVPS7U836
Pbgxpin+CwElGRrZLEfh3fUTYnIjZYmlaUcplQdkZuFgSxP1t40InjmwkP+gQfSk
kPfxoqSDH7EgVzOOl8jFxVxyHVUKYbJ4LYnP1E6of1RxOQW7QBxaUY3/i/B6XDTD
cME7BAdr1ogXiDnasDYZzsbK+ySvtlylK6kqdvhHHfHtC1sMj/WnUniwE+I5k7IC
yLArvQyk9okdGCw20tH2Kp3nOVXicoqgIUVQ6LoYusSjccgFYPqAqe50i1iuohRA
W9Nj5jDd0kyf0pngBJn8y/KXThtsbPw//CIVi7amb3kkHUb8O3CJlRfO18wsmvmK
0iBtUUp3E0rL3I7aJnZLIZAppV+yO3hbUJCiPT0YyVdh7o+RCsTV1+XIQcaBrg0V
ThmTUggXO5keuuvu39P3OQakLarAiQcGJqpGekzeJ/q5WTxxvegeqOC0rCgDW7tY
9md0WZ9ATOqrrDfcwp2vCLpleiPUuvrfl8ceEts6WSibqN7Gcg4=
=ZAOg
-----END PGP SIGNATURE-----

12
libvorbis-doc.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package libvorbis-doc
#
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -12,7 +12,7 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
@ -23,13 +23,15 @@
%endif
Name: libvorbis-doc
Version: 1.3.6
Version: 1.3.7
Release: 0
Summary: Documentation of Ogg/Vorbis library
License: BSD-3-Clause
Group: Documentation/Other
Url: http://www.vorbis.com/
Source: http://downloads.xiph.org/releases/vorbis/libvorbis-%{version}.tar.xz
URL: https://www.vorbis.com/
Source: https://downloads.xiph.org/releases/vorbis/libvorbis-%{version}.tar.xz
Source1: https://downloads.xiph.org/releases/vorbis/libvorbis-%{version}.tar.xz.asc
Source99: libvorbis.keyring
Patch1: libvorbis-lib64.dif
Patch2: libvorbis-m4.dif
Patch12: vorbis-ocloexec.patch

26
libvorbis.changes
View File

@ -1,3 +1,29 @@
-------------------------------------------------------------------
Fri Jul 10 10:14:43 UTC 2020 - Martin Hauke <mardnh@gmx.de>
- Update to version 1.3.7
* Fix CVE-2018-10392 and CVE-2018-10393 - out-of-bounds read
encoding very low sample rates
* Fix CVE-2017-14160 - out-of-bounds read encoding very low
sample rates.
* Fix handling invalid bytes per sample arguments.
* Fix handling invalid channel count arguments.
* Fix invalid free on seek failure.
* Fix negative shift reading blocksize.
* Fix accepting unreasonable float32 values.
* Fix tag comparison depending on locale.
* Fix unnecessarily linking libm.
* Fix memory leak in test_sharedbook.
* Distribute CMake build files with the source package.
* Remove unnecessary configure --target switch.
* Add OSS-Fuzz support.
* Build system and integration updates.
- Drop not longer needed patches (fixed by upstream):
* vorbis-CVE-2017-14160.patch
* vorbis-CVE-2018-10392.patch
* vorbis-CVE-2018-10393.patch
- Add source verification
-------------------------------------------------------------------
Tue Jun 5 11:37:54 CEST 2018 - tiwai@suse.de

51
libvorbis.keyring Normal file
View File

@ -0,0 +1,51 @@
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFsCSDYBEADM27aZ5YfexsnbrsvQ8sdZtUM2afJptN2BEujqvzPN8vR8yIaO
ScfhCPOHI1CYyevT0SVpeoNDW5JIJD5YbpT87PXbi2Ia/zRo8pIOdUqlL4HUtEoc
dTt1ihlmM/3seqvlkEJnnlhVhE6Oz8yy20yjYcNDtgHhirYrV240XRiPflEt0jsd
LHgYtsyEiktRTITX9Dr3V9Pr2W22qd2zFAkdc5G+wo0TiaDXRYC0siOzoV5VbR47
lT7juRD5aO+TDxc4Azs9GJQtrUFpF1rtnQvn/+aXX7uj4mBu8jdoSSCZb9mm3mbE
Sb2QUTzP0gBal6bcPoghpZcCRQ/rtlkMaYnGMe5qBe5x3iPhbPrPNF0kfbj+Jx79
6LygakyLbnINIZyJ7tjTSyruXkWsVkI6YuMa6ld3ejc6bak1WWXS/B5WDq36gBlB
W1QJi0qrMMXFr/AntXQYqudqnZeRJS11CxCy7onh8oR6+QQXs3Ec+fw8uLSEUL/j
iu5nEl6OofmUVvQsPUKzjMFpOmpA6T+JD5RbpgSUP+hrZW/q3JwcON9inYsJvWBJ
3DX9rLSs4pHlW5NzjXBiLGLDZOZszDYZVBkZ5xj+7vWNxBOu32ehUQFMbBkQsAuD
NX45RfsaFxO7pWoV8/oXKrbhn3wwh5GzRi5aGvN8qUuWCvXHCGlgkbBKkwARAQAB
tB9SYWxwaCBHaWxlcyA8Z2lsZXNAdGhhdW1hcy5uZXQ+iQI9BBMBCgAnBQJbAkg2
AhsDBQkFo5qABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEJJZqPLS1EyEzvEP
/1ELKFTm7CKGPMhInqwImHg47w2by42zuqhmWkfi+yO4NnRCAxpXk38aIbWG4ToN
TVACJY7o2Nt7iTsNfuXNiP8L5xBoaeimFXCtoY+Bl3frW6eDwg1XHCzqsrblsYSi
sNN7xiYpUngJdJ9//ij1T6rWIiQwQZxZeHSE08hduNDIvmup9E1xjLtV3KMUB97z
TDcQrBoQOD+ztxGQrtQTpf1hqhmfe94QJlYYmqZHPl2f77qA05nGhuXZvqhD6uEg
XhoRf0a1MHgQ3XMNEXILjb+Tq6ed/GbTUiYdVc9Dzqs+1H0Ozazc2Y3BWslZlE7c
GtdkAWLqBGlFtnyLELEKluR9zi3KTkhwS1cVrA3IB23D+PfzKehfpPSCgRvyU86o
qG5M6deVkPKzbf/lHBTFrG7mUHdgFP67i7ia77jNaN65Jx53vRfbbdjB8UllhbvQ
DfFTywrrdcG0OxnIhlJO22ZvXTJrcMU5AWkgLqTDvnFoefYYK9C2ht8g45Gh+jYG
6SGkgqE0Xl+PYKJfDfZQDAn4xIfRaZyqr8gVT2T/w/LkHLeG/jjDOeISJofRNFqg
lGtHWUtIw+CGOw82UjlSUn9pKKyyimaUNmtRt9cC8voyI5VEWdP345yRC8PNucWs
v2EeWK9bxB6XVP9TEITzTSANxlMNffVbTubCkU221FruuQINBFsCSDYBEACXU7rJ
mnTi7MfJcltrbhctLpbFFeDZn+T7z3T6JnZw9GV/iRYeGrwhNptUg66ffhIC2nBg
mcNQ67olB4vRdDCqA02+rMTySXFhBj4VX/7EECmw14D84cZR+BoIrLDxzfBUux9j
7BlX2bBiQ79VSwng9uCipZj49fWNAm0RnZ/P8LDATUb3i4f/o0qD1Gm39VcRSQdI
La/FpwTKB/B0ToUH5/i0TlWNiRziB/nlM00x5BUqRP8QrQVszsyKlYy5T0eR8MEV
uw0LuQx2qroRh8CTZdWRRBTtcWCFb5cfqZWdUgu0sF/dMIcwBvcnma/aVgF62EdC
CgrMmRqd/IFrmbPZXq7VRCGkEaxHjs41ahRHk51bKwcuGqHw0UQsbv+dcMURvl13
rQulOkwe+1QILspQ/foqugMoWDqcPEBHG+ovfjzSoB5MIEkyJjfeyPXjlYTA+tbm
lw5c6tLQMRlYA5hhc0BYNFYSrx/oAtUg05hz31v2d8UCSZS/wHAh3DzMJgwMj5N+
IZ8iOQNYISQCBASQEhLQk+J0smGmxUx+uvGJvxdo6g5WnIsztcLMOpqUMiy3jfOw
LojIClAUIYoHXLEN8D6oaKJ3EdpOANBb/0Ro7JPPC0wrQZE8+rlCu0EhH/Xt8aMC
HeHkF+rxC0Nu/JACPFLELWAlrYKY79cHJAAPmwARAQABiQIlBBgBCgAPBQJbAkg2
AhsMBQkFo5qAAAoJEJJZqPLS1EyEBtwP/3njDZm35BC1HMPn1ToJwNR1Qtd4Puup
jNNHcHf1v9UQUvRg0dsOY5qmL+GBj3zgRAQ7LP3xbXu0e0/Cwucdv6hf8/6P641w
LwCAGkfshiAxnSCEHLDEdad0wcXM5DDIdqJMR5lWWoo+ln91+AGXgPuWRPcJE56l
INLaZX3cgYKriYdphCcMyMgtHzyKkDwSMGKundtxFx9Gdg57hGEZTYfd9XqWMZwD
2jcfvk9ASJqy4y+k9oc+M/3m40F8Qua26Gfdp8e3d+R/Y1QzKtO8fhoUi0aT8f0X
zBG7Y89actCAO4Hr6z1qEpGbQb3fbqmaaI7uxgUj5+ApUbdtw4581QKGDGp95GMC
Ca1LZ47qhlvr5vkrUU+204qS/i2LurzUPqo7qBiCUCgAERx+kQzBRlziTIkWc6Wt
W2bxugxYEx05yrNdwoxO8PkDF+v4Yv8abL7XBAZgbVvEgPiONducLWnj4h27fGhN
Mj6Y2qK9bsxobAUJtjWw2r/LuS8CgOnRX6mYdVZw5+0BgFc1BKI1GtW0n4eR2gUj
OU3LkzNoSFbl3HTnHYz4SwM62Na50HglKUfoXp0HiL0dxsQEj71WSVtBjNUxfUMk
OfnAbwDUbpDIe68DSCVNLVw6dJZANqW/77vvN17AuX0O0Jt1/bmenv8CDmR0NP/B
ziJMnjt238S8
=MNJb
-----END PGP PUBLIC KEY BLOCK-----

20
libvorbis.spec
View File

@ -1,7 +1,7 @@
#
# spec file for package libvorbis
#
# Copyright (c) 2018 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2020 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@ -12,25 +12,24 @@
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
# Please submit bugfixes or comments via https://bugs.opensuse.org/
#
Name: libvorbis
Version: 1.3.6
Version: 1.3.7
Release: 0
Summary: The Vorbis General Audio Compression Codec
License: BSD-3-Clause
Group: System/Libraries
Url: http://www.vorbis.com/
Source: http://downloads.xiph.org/releases/vorbis/%{name}-%{version}.tar.xz
Source1: baselibs.conf
URL: http://www.vorbis.com/
Source: https://downloads.xiph.org/releases/vorbis/%{name}-%{version}.tar.xz
Source1: https://downloads.xiph.org/releases/vorbis/libvorbis-%{version}.tar.xz.asc
Source10: baselibs.conf
Source99: libvorbis.keyring
Patch1: libvorbis-lib64.dif
Patch2: libvorbis-m4.dif
Patch12: vorbis-ocloexec.patch
Patch101: vorbis-CVE-2017-14160.patch
Patch102: vorbis-CVE-2018-10393.patch
Patch103: vorbis-CVE-2018-10392.patch
BuildRequires: libogg-devel
BuildRequires: libtool
BuildRequires: pkgconfig
@ -119,9 +118,6 @@ if [ "%{_lib}" == "lib64" ]; then
%patch1
fi
%patch12
%patch101 -p1
%patch102 -p1
%patch103 -p1
%build
# Fix optimization level

27
vorbis-CVE-2017-14160.patch
View File

@ -1,27 +0,0 @@
From 018ca26dece618457dd13585cad52941193c4a25 Mon Sep 17 00:00:00 2001
From: Thomas Daede <daede003@umn.edu>
Date: Wed, 9 May 2018 14:56:59 -0700
Subject: [PATCH] CVE-2017-14160: fix bounds check on very low sample rates.
---
lib/psy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/psy.c b/lib/psy.c
index 422c6f1e412d..13101230ea3a 100644
--- a/lib/psy.c
+++ b/lib/psy.c
@@ -602,8 +602,9 @@ static void bark_noise_hybridmp(int n,const long *b,
for (i = 0, x = 0.f;; i++, x += 1.f) {
lo = b[i] >> 16;
- if( lo>=0 ) break;
hi = b[i] & 0xffff;
+ if( lo>=0 ) break;
+ if( hi>=n ) break;
tN = N[hi] + N[-lo];
tX = X[hi] - X[-lo];
--
2.17.0

20
vorbis-CVE-2018-10392.patch
View File

@ -1,20 +0,0 @@
From 112d3bd0aaacad51305e1464d4b381dabad0e88b Mon Sep 17 00:00:00 2001
From: Thomas Daede <daede003@umn.edu>
Date: Thu, 17 May 2018 16:19:19 -0700
Subject: [PATCH] Sanity check number of channels in setup.
Fixes #2335.
---
lib/vorbisenc.c | 1 +
1 file changed, 1 insertion(+)
--- a/lib/vorbisenc.c
+++ b/lib/vorbisenc.c
@@ -684,6 +684,7 @@ int vorbis_encode_setup_init(vorbis_info
highlevel_encode_setup *hi=&ci->hi;
if(ci==NULL)return(OV_EINVAL);
+ if(vi->channels<1||vi->channels>255)return(OV_EINVAL);
if(!hi->impulse_block_p)i0=1;
/* too low/high an ATH floater is nonsensical, but doesn't break anything */

38
vorbis-CVE-2018-10393.patch
View File

@ -1,38 +0,0 @@
---
lib/psy.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/lib/psy.c
+++ b/lib/psy.c
@@ -605,6 +605,7 @@ static void bark_noise_hybridmp(int n,co
hi = b[i] & 0xffff;
if( lo>=0 ) break;
if( hi>=n ) break;
+ if( -lo >=n ) break;
tN = N[hi] + N[-lo];
tX = X[hi] - X[-lo];
@@ -627,6 +628,7 @@ static void bark_noise_hybridmp(int n,co
lo = b[i] >> 16;
hi = b[i] & 0xffff;
if(hi>=n)break;
+ if(lo >=n)break;
tN = N[hi] - N[lo];
tX = X[hi] - X[lo];
@@ -656,6 +658,7 @@ static void bark_noise_hybridmp(int n,co
hi = i + fixed / 2;
lo = hi - fixed;
if(lo>=0)break;
+ if( hi>=n || -lo >=n ) break;
tN = N[hi] + N[-lo];
tX = X[hi] - X[-lo];
@@ -676,6 +679,7 @@ static void bark_noise_hybridmp(int n,co
hi = i + fixed / 2;
lo = hi - fixed;
if(hi>=n)break;
+ if( hi>=n || lo >=n ) break;
tN = N[hi] - N[lo];
tX = X[hi] - X[lo];