[pkgsrc/trunk]: pkgsrc/audio/id3lib Fix a buffer overflow caused by miscalcul...

[martin <martin%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/025a391205a0
branches:  trunk
changeset: 313865:025a391205a0
user:      martin <martin%pkgsrc.org@localhost>
date:      Fri Oct 12 13:51:59 2018 +0000

description:
Fix a buffer overflow caused by miscalculation of the maximal
VBR header size. Bump revision.

diffstat:

 audio/id3lib/Makefile                         |   4 ++--
 audio/id3lib/distinfo                         |   3 ++-
 audio/id3lib/patches/patch-src__mp3_parse.cpp |  17 +++++++++++++++++
 3 files changed, 21 insertions(+), 3 deletions(-)

diffs (49 lines):

diff -r 0058b33e464a -r 025a391205a0 audio/id3lib/Makefile
--- a/audio/id3lib/Makefile     Fri Oct 12 13:21:24 2018 +0000
+++ b/audio/id3lib/Makefile     Fri Oct 12 13:51:59 2018 +0000
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.34 2018/01/26 10:32:36 jperkin Exp $
+# $NetBSD: Makefile,v 1.35 2018/10/12 13:51:59 martin Exp $
 #
 
 DISTNAME=      id3lib-3.8.3
-PKGREVISION=   5
+PKGREVISION=   6
 CATEGORIES=    audio
 MASTER_SITES=  ${MASTER_SITE_SOURCEFORGE:=id3lib/}
 
diff -r 0058b33e464a -r 025a391205a0 audio/id3lib/distinfo
--- a/audio/id3lib/distinfo     Fri Oct 12 13:21:24 2018 +0000
+++ b/audio/id3lib/distinfo     Fri Oct 12 13:51:59 2018 +0000
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.21 2015/11/03 01:12:35 agc Exp $
+$NetBSD: distinfo,v 1.22 2018/10/12 13:51:59 martin Exp $
 
 SHA1 (id3lib-3.8.3.tar.gz) = c92c880da41d1ec0b242745a901702ae87970838
 RMD160 (id3lib-3.8.3.tar.gz) = bfa2499ec649ed40815ad0a370c78eb1517952c4
@@ -17,3 +17,4 @@
 SHA1 (patch-at) = f5ab25d72d3d6e47c1710bbc17dd0cd0749a0b22
 SHA1 (patch-au) = 2d96d6cadaf8b1055337da6a5f85070ea6222583
 SHA1 (patch-av) = e54c0839ecfe4e3f70758e334666717b5a3b396f
+SHA1 (patch-src__mp3_parse.cpp) = 874614302be7cdcb9b95e8b32e17b488cdf21359
diff -r 0058b33e464a -r 025a391205a0 audio/id3lib/patches/patch-src__mp3_parse.cpp
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/audio/id3lib/patches/patch-src__mp3_parse.cpp     Fri Oct 12 13:51:59 2018 +0000
@@ -0,0 +1,17 @@
+$NetBSD: patch-src__mp3_parse.cpp,v 1.1 2018/10/12 13:51:59 martin Exp $
+
+Fix a miscalculation of the VBR maximal header size,
+upstream has already been notified (there is a user
+review about this issue)
+
+--- src/mp3_parse.cpp.orig     2003-03-02 01:23:00.000000000 +0100
++++ src/mp3_parse.cpp  2018-10-12 15:46:21.863323611 +0200
+@@ -465,7 +465,7 @@ bool Mp3Info::Parse(ID3_Reader& reader, 
+   // from http://www.xingtech.com/developer/mp3/
+ 
+   const size_t VBR_HEADER_MIN_SIZE = 8;     // "xing" + flags are fixed
+-  const size_t VBR_HEADER_MAX_SIZE = 116;   // frames, bytes, toc and scale are optional
++  const size_t VBR_HEADER_MAX_SIZE = 120;   // frames, bytes, toc and scale are optional
+ 
+   if (mp3size >= vbr_header_offest + VBR_HEADER_MIN_SIZE) 
+   {