From fbe442c70dcb76b016e5d43c5d51bc26ed3a90f0a715c7ad1ebf1d732a730a2e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ismail=20D=C3=B6nmez?= Date: Tue, 5 Jun 2018 10:32:55 +0000 Subject: [PATCH] Accepting request 614200 from home:tiwai:branches:multimedia:libs - Replace vorbis-CVE-2017-14160.patch with the upstream fix (commit 018ca26dece6), refresh vorbis-CVE-2018-10393.patch - Fix the validation of channels in mapping0_forward() (CVE-2018-10392, bsc#1091070): vorbis-CVE-2018-10392.patch OBS-URL: https://build.opensuse.org/request/show/614200 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libvorbis?expand=0&rev=62 --- libvorbis.changes | 9 ++++++ libvorbis.spec | 2 ++ vorbis-CVE-2017-14160.patch | 62 +++++++++++-------------------------- vorbis-CVE-2018-10392.patch | 20 ++++++++++++ vorbis-CVE-2018-10393.patch | 25 +++++++-------- 5 files changed, 61 insertions(+), 57 deletions(-) create mode 100644 vorbis-CVE-2018-10392.patch diff --git a/libvorbis.changes b/libvorbis.changes index 9425609..7082c0d 100644 --- a/libvorbis.changes +++ b/libvorbis.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Tue Jun 5 11:37:54 CEST 2018 - tiwai@suse.de + +- Replace vorbis-CVE-2017-14160.patch with the upstream fix + (commit 018ca26dece6), refresh vorbis-CVE-2018-10393.patch +- Fix the validation of channels in mapping0_forward() + (CVE-2018-10392, bsc#1091070): + vorbis-CVE-2018-10392.patch + ------------------------------------------------------------------- Thu May 3 15:56:28 CEST 2018 - tiwai@suse.de diff --git a/libvorbis.spec b/libvorbis.spec index 57fcde8..cb229cc 100644 --- a/libvorbis.spec +++ b/libvorbis.spec @@ -30,6 +30,7 @@ Patch2: libvorbis-m4.dif Patch12: vorbis-ocloexec.patch Patch101: vorbis-CVE-2017-14160.patch Patch102: vorbis-CVE-2018-10393.patch +Patch103: vorbis-CVE-2018-10392.patch BuildRequires: libogg-devel BuildRequires: libtool BuildRequires: pkgconfig @@ -120,6 +121,7 @@ fi %patch12 %patch101 -p1 %patch102 -p1 +%patch103 -p1 %build # Fix optimization level diff --git a/vorbis-CVE-2017-14160.patch b/vorbis-CVE-2017-14160.patch index eb08c04..2ec3f2e 100644 --- a/vorbis-CVE-2017-14160.patch +++ b/vorbis-CVE-2017-14160.patch @@ -1,53 +1,27 @@ -From 98a60969315dba8c1e8231f561e1551670bc80ae Mon Sep 17 00:00:00 2001 -Message-Id: <98a60969315dba8c1e8231f561e1551670bc80ae.1511192857.git.agx@sigxcpu.org> -From: =?UTF-8?q?Guido=20G=C3=BCnther?= -Date: Wed, 15 Nov 2017 13:12:00 +0100 -Subject: [PATCH] CVE-2017-14160: make sure we don't overflow +From 018ca26dece618457dd13585cad52941193c4a25 Mon Sep 17 00:00:00 2001 +From: Thomas Daede +Date: Wed, 9 May 2018 14:56:59 -0700 +Subject: [PATCH] CVE-2017-14160: fix bounds check on very low sample rates. --- - lib/psy.c | 9 ++++----- - 1 file changed, 4 insertions(+), 5 deletions(-) + lib/psy.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) +diff --git a/lib/psy.c b/lib/psy.c +index 422c6f1e412d..13101230ea3a 100644 --- a/lib/psy.c +++ b/lib/psy.c -@@ -599,7 +599,7 @@ static void bark_noise_hybridmp(int n,co - XY[i] = tXY; - } - -- for (i = 0, x = 0.f;; i++, x += 1.f) { -+ for (i = 0, x = 0.f; i < n; i++, x += 1.f) { - - lo = b[i] >> 16; - if( lo>=0 ) break; -@@ -621,12 +621,11 @@ static void bark_noise_hybridmp(int n,co - noise[i] = R - offset; - } - -- for ( ;; i++, x += 1.f) { -+ for ( ; i < n; i++, x += 1.f) { +@@ -602,8 +602,9 @@ static void bark_noise_hybridmp(int n,const long *b, + for (i = 0, x = 0.f;; i++, x += 1.f) { lo = b[i] >> 16; +- if( lo>=0 ) break; hi = b[i] & 0xffff; - if(hi>=n)break; -- - tN = N[hi] - N[lo]; - tX = X[hi] - X[lo]; - tXX = XX[hi] - XX[lo]; -@@ -651,7 +650,7 @@ static void bark_noise_hybridmp(int n,co ++ if( lo>=0 ) break; ++ if( hi>=n ) break; - if (fixed <= 0) return; - -- for (i = 0, x = 0.f;; i++, x += 1.f) { -+ for (i = 0, x = 0.f; i < n; i++, x += 1.f) { - hi = i + fixed / 2; - lo = hi - fixed; - if(lo>=0)break; -@@ -670,7 +669,7 @@ static void bark_noise_hybridmp(int n,co - - if (R - offset < noise[i]) noise[i] = R - offset; - } -- for ( ;; i++, x += 1.f) { -+ for ( ; i < n; i++, x += 1.f) { - - hi = i + fixed / 2; - lo = hi - fixed; + tN = N[hi] + N[-lo]; + tX = X[hi] - X[-lo]; +-- +2.17.0 + diff --git a/vorbis-CVE-2018-10392.patch b/vorbis-CVE-2018-10392.patch new file mode 100644 index 0000000..7fe859b --- /dev/null +++ b/vorbis-CVE-2018-10392.patch @@ -0,0 +1,20 @@ +From 112d3bd0aaacad51305e1464d4b381dabad0e88b Mon Sep 17 00:00:00 2001 +From: Thomas Daede +Date: Thu, 17 May 2018 16:19:19 -0700 +Subject: [PATCH] Sanity check number of channels in setup. + +Fixes #2335. +--- + lib/vorbisenc.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/lib/vorbisenc.c ++++ b/lib/vorbisenc.c +@@ -684,6 +684,7 @@ int vorbis_encode_setup_init(vorbis_info + highlevel_encode_setup *hi=&ci->hi; + + if(ci==NULL)return(OV_EINVAL); ++ if(vi->channels<1||vi->channels>255)return(OV_EINVAL); + if(!hi->impulse_block_p)i0=1; + + /* too low/high an ATH floater is nonsensical, but doesn't break anything */ diff --git a/vorbis-CVE-2018-10393.patch b/vorbis-CVE-2018-10393.patch index 9bc99a5..cf075b2 100644 --- a/vorbis-CVE-2018-10393.patch +++ b/vorbis-CVE-2018-10393.patch @@ -1,27 +1,26 @@ --- - lib/psy.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) + lib/psy.c | 4 ++++ + 1 file changed, 4 insertions(+) --- a/lib/psy.c +++ b/lib/psy.c -@@ -604,6 +604,7 @@ static void bark_noise_hybridmp(int n,co - lo = b[i] >> 16; - if( lo>=0 ) break; +@@ -605,6 +605,7 @@ static void bark_noise_hybridmp(int n,co hi = b[i] & 0xffff; -+ if( hi>=n || -lo >=n ) break; + if( lo>=0 ) break; + if( hi>=n ) break; ++ if( -lo >=n ) break; tN = N[hi] + N[-lo]; tX = X[hi] - X[-lo]; -@@ -625,7 +626,7 @@ static void bark_noise_hybridmp(int n,co - +@@ -627,6 +628,7 @@ static void bark_noise_hybridmp(int n,co lo = b[i] >> 16; hi = b[i] & 0xffff; -- if(hi>=n)break; -+ if( hi>=n || lo >=n ) break; + if(hi>=n)break; ++ if(lo >=n)break; + tN = N[hi] - N[lo]; tX = X[hi] - X[lo]; - tXX = XX[hi] - XX[lo]; -@@ -654,6 +655,7 @@ static void bark_noise_hybridmp(int n,co +@@ -656,6 +658,7 @@ static void bark_noise_hybridmp(int n,co hi = i + fixed / 2; lo = hi - fixed; if(lo>=0)break; @@ -29,7 +28,7 @@ tN = N[hi] + N[-lo]; tX = X[hi] - X[-lo]; -@@ -674,6 +676,7 @@ static void bark_noise_hybridmp(int n,co +@@ -676,6 +679,7 @@ static void bark_noise_hybridmp(int n,co hi = i + fixed / 2; lo = hi - fixed; if(hi>=n)break;