[pkgsrc/trunk]: pkgsrc/audio/libsndfile Fix for CVE-2017-8362, ref.

[he <he%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/7a042368714f
branches:  trunk
changeset: 362566:7a042368714f
user:      he <he%pkgsrc.org@localhost>
date:      Wed May 17 21:58:05 2017 +0000

description:
Fix for CVE-2017-8362, ref.
https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd
808
Bump PKGREVISION.

diffstat:

 audio/libsndfile/Makefile                 |   4 ++--
 audio/libsndfile/patches/patch-src_flac.c |  31 ++++++++++++++++++++++++++++---
 2 files changed, 30 insertions(+), 5 deletions(-)

diffs (62 lines):

diff -r 767167da0878 -r 7a042368714f audio/libsndfile/Makefile
--- a/audio/libsndfile/Makefile Wed May 17 21:52:24 2017 +0000
+++ b/audio/libsndfile/Makefile Wed May 17 21:58:05 2017 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.74 2017/05/17 21:51:46 he Exp $
+# $NetBSD: Makefile,v 1.75 2017/05/17 21:58:05 he Exp $
 
 DISTNAME=      libsndfile-1.0.28
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    audio
 MASTER_SITES=  http://www.mega-nerd.com/libsndfile/files/
 
diff -r 767167da0878 -r 7a042368714f audio/libsndfile/patches/patch-src_flac.c
--- a/audio/libsndfile/patches/patch-src_flac.c Wed May 17 21:52:24 2017 +0000
+++ b/audio/libsndfile/patches/patch-src_flac.c Wed May 17 21:58:05 2017 +0000
@@ -1,17 +1,42 @@
-$NetBSD: patch-src_flac.c,v 1.1 2017/05/17 21:51:46 he Exp $
+$NetBSD: patch-src_flac.c,v 1.2 2017/05/17 21:58:05 he Exp $
 
 Fix for CVE-2017-8365, ref.
 https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3
+Fix for CVE-2017-8362, ref.
+https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808
 
 --- src/flac.c.orig    2017-04-02 08:13:30.000000000 +0000
 +++ src/flac.c
-@@ -435,6 +435,19 @@ sf_flac_meta_callback (const FLAC__Strea
+@@ -169,6 +169,14 @@ flac_buffer_copy (SF_PRIVATE *psf)
+       const int32_t* const *buffer = pflac->wbuffer ;
+       unsigned i = 0, j, offset, channels, len ;
+ 
++      if (psf->sf.channels != (int) frame->header.channels)
++      {       psf_log_printf (psf, "Error: FLAC frame changed from %d to %d channels\n"
++                                          "Nothing to do but to error out.\n" ,
++                                          psf->sf.channels, frame->header.channels) ;
++              psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
++              return 0 ;
++              } ;
++
+       /*
+       **      frame->header.blocksize is variable and we're using a constant blocksize
+       **      of FLAC__MAX_BLOCK_SIZE.
+@@ -202,7 +210,6 @@ flac_buffer_copy (SF_PRIVATE *psf)
+               return 0 ;
+               } ;
+ 
+-
+       len = SF_MIN (pflac->len, frame->header.blocksize) ;
+ 
+       if (pflac->remain % channels != 0)
+@@ -435,6 +442,19 @@ sf_flac_meta_callback (const FLAC__Strea
  
        switch (metadata->type)
        {       case FLAC__METADATA_TYPE_STREAMINFO :
 +                      if (psf->sf.channels > 0 && psf->sf.channels != (int) metadata->data.stream_info.channels)
 +                      {       psf_log_printf (psf, "Error: FLAC stream changed from %d to %d channels\n"
-+                                                  "Nothing to be but to error out.\n" ,
++                                                  "Nothing to do but to error out.\n" ,
 +                                                  psf->sf.channels, metadata->data.stream_info.channels) ;
 +                              psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
 +                              return ;