CVS commit: pkgsrc/audio/libsndfile

["Havard Eidnes" <he%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   he
Date:           Wed May 17 21:58:06 UTC 2017

Modified Files:
        pkgsrc/audio/libsndfile: Makefile
        pkgsrc/audio/libsndfile/patches: patch-src_flac.c

Log Message:
Fix for CVE-2017-8362, ref.
https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd
808
Bump PKGREVISION.


To generate a diff of this commit:
cvs rdiff -u -r1.74 -r1.75 pkgsrc/audio/libsndfile/Makefile
cvs rdiff -u -r1.1 -r1.2 pkgsrc/audio/libsndfile/patches/patch-src_flac.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/audio/libsndfile/Makefile
diff -u pkgsrc/audio/libsndfile/Makefile:1.74 pkgsrc/audio/libsndfile/Makefile:1.75
--- pkgsrc/audio/libsndfile/Makefile:1.74       Wed May 17 21:51:46 2017
+++ pkgsrc/audio/libsndfile/Makefile    Wed May 17 21:58:05 2017
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.74 2017/05/17 21:51:46 he Exp $
+# $NetBSD: Makefile,v 1.75 2017/05/17 21:58:05 he Exp $
 
 DISTNAME=      libsndfile-1.0.28
-PKGREVISION=   1
+PKGREVISION=   2
 CATEGORIES=    audio
 MASTER_SITES=  http://www.mega-nerd.com/libsndfile/files/
 

Index: pkgsrc/audio/libsndfile/patches/patch-src_flac.c
diff -u pkgsrc/audio/libsndfile/patches/patch-src_flac.c:1.1 pkgsrc/audio/libsndfile/patches/patch-src_flac.c:1.2
--- pkgsrc/audio/libsndfile/patches/patch-src_flac.c:1.1        Wed May 17 21:51:46 2017
+++ pkgsrc/audio/libsndfile/patches/patch-src_flac.c    Wed May 17 21:58:05 2017
@@ -1,17 +1,42 @@
-$NetBSD: patch-src_flac.c,v 1.1 2017/05/17 21:51:46 he Exp $
+$NetBSD: patch-src_flac.c,v 1.2 2017/05/17 21:58:05 he Exp $
 
 Fix for CVE-2017-8365, ref.
 https://github.com/erikd/libsndfile/commit/fd0484aba8e51d16af1e3a880f9b8b857b385eb3
+Fix for CVE-2017-8362, ref.
+https://github.com/erikd/libsndfile/commit/ef1dbb2df1c0e741486646de40bd638a9c4cd808
 
 --- src/flac.c.orig    2017-04-02 08:13:30.000000000 +0000
 +++ src/flac.c
-@@ -435,6 +435,19 @@ sf_flac_meta_callback (const FLAC__Strea
+@@ -169,6 +169,14 @@ flac_buffer_copy (SF_PRIVATE *psf)
+       const int32_t* const *buffer = pflac->wbuffer ;
+       unsigned i = 0, j, offset, channels, len ;
+ 
++      if (psf->sf.channels != (int) frame->header.channels)
++      {       psf_log_printf (psf, "Error: FLAC frame changed from %d to %d channels\n"
++                                          "Nothing to do but to error out.\n" ,
++                                          psf->sf.channels, frame->header.channels) ;
++              psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
++              return 0 ;
++              } ;
++
+       /*
+       **      frame->header.blocksize is variable and we're using a constant blocksize
+       **      of FLAC__MAX_BLOCK_SIZE.
+@@ -202,7 +210,6 @@ flac_buffer_copy (SF_PRIVATE *psf)
+               return 0 ;
+               } ;
+ 
+-
+       len = SF_MIN (pflac->len, frame->header.blocksize) ;
+ 
+       if (pflac->remain % channels != 0)
+@@ -435,6 +442,19 @@ sf_flac_meta_callback (const FLAC__Strea
  
        switch (metadata->type)
        {       case FLAC__METADATA_TYPE_STREAMINFO :
 +                      if (psf->sf.channels > 0 && psf->sf.channels != (int) metadata->data.stream_info.channels)
 +                      {       psf_log_printf (psf, "Error: FLAC stream changed from %d to %d channels\n"
-+                                                  "Nothing to be but to error out.\n" ,
++                                                  "Nothing to do but to error out.\n" ,
 +                                                  psf->sf.channels, metadata->data.stream_info.channels) ;
 +                              psf->error = SFE_FLAC_CHANNEL_COUNT_CHANGED ;
 +                              return ;