Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=7c602095106ae64a64c0fbaa500287ec9c9f8889
commit 7c602095106ae64a64c0fbaa500287ec9c9f8889 Author: kikadf <[email protected]> Date: Thu Dec 4 14:15:56 2014 +0100 flac-1.2.1-4arcturus1-x86_64 * Fix CVE-2014-8962, CVE-2014-9028 diff --git a/source/multimedia/flac/CVE-2014-8962.patch b/source/multimedia/flac/CVE-2014-8962.patch new file mode 100644 index 0000000..ce21357 --- /dev/null +++ b/source/multimedia/flac/CVE-2014-8962.patch @@ -0,0 +1,35 @@ +From 5b3033a2b355068c11fe637e14ac742d273f076e Mon Sep 17 00:00:00 2001 +From: Erik de Castro Lopo <[email protected]> +Date: Tue, 18 Nov 2014 07:20:25 -0800 +Subject: [PATCH] src/libFLAC/stream_decoder.c : Fix buffer read overflow. + +This is CVE-2014-8962. + +Reported-by: Michele Spagnuolo, + Google Security Team <[email protected]> +--- + src/libFLAC/stream_decoder.c | 6 +++++- + 1 files changed, 5 insertions(+), 1 deletions(-) + +--- a/src/libFLAC/stream_decoder.c ++++ b/src/libFLAC/stream_decoder.c +@@ -94,7 +94,7 @@ + * + ***********************************************************************/ + +-static FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' }; ++static const FLAC__byte ID3V2_TAG_[3] = { 'I', 'D', '3' }; + + /*********************************************************************** + * +@@ -1386,6 +1386,10 @@ + id = 0; + continue; + } ++ ++ if(id >= 3) ++ return false; ++ + if(x == ID3V2_TAG_[id]) { + id++; + i = 0; diff --git a/source/multimedia/flac/CVE-2014-9028-1.patch b/source/multimedia/flac/CVE-2014-9028-1.patch new file mode 100644 index 0000000..0401ce3 --- /dev/null +++ b/source/multimedia/flac/CVE-2014-9028-1.patch @@ -0,0 +1,29 @@ +From fcf0ba06ae12ccd7c67cee3c8d948df15f946b85 Mon Sep 17 00:00:00 2001 +From: Erik de Castro Lopo <[email protected]> +Date: Wed, 19 Nov 2014 19:35:59 -0800 +Subject: [PATCH] src/libFACL/stream_decoder.c : Fail safely to avoid a heap overflow. + +A file provided by the reporters caused the stream decoder to write to +un-allocated heap space resulting in a segfault. The solution is to +error out (by returning false from read_residual_partitioned_rice_()) +instead of trying to continue to decode. + +Fixes: CVE-2014-9028 +Reported-by: Michele Spagnuolo, + Google Security Team <[email protected]> +--- + src/libFLAC/stream_decoder.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +--- a/src/libFLAC/stream_decoder.c ++++ b/src/libFLAC/stream_decoder.c +@@ -2730,7 +2730,8 @@ + if(decoder->private_->frame.header.blocksize < predictor_order) { + send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); + decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; +- return true; ++ /* We have received a potentially malicious bt stream. All we can do is error out to avoid a heap overflow. */ ++ return false; + } + } + else { diff --git a/source/multimedia/flac/CVE-2014-9028-2.patch b/source/multimedia/flac/CVE-2014-9028-2.patch new file mode 100644 index 0000000..eeaf412 --- /dev/null +++ b/source/multimedia/flac/CVE-2014-9028-2.patch @@ -0,0 +1,27 @@ +From 5a365996d739bdf4711af51d9c2c71c8a5e14660 Mon Sep 17 00:00:00 2001 +From: Erik de Castro Lopo <[email protected]> +Date: Thu, 27 Nov 2014 11:55:11 +1100 +Subject: [PATCH] src/libFLAC/stream_decoder.c : Fail safely to avoid a heap overflow. + +This fix is closely related to the fix for CVE-2014-9028. When that +fix went public Miroslav Lichvar noticed a similar potential problem +spot in the same function and was able to craft a file to trigger a +heap write overflow. + +Reported-by : Miroslav Lichvar <[email protected]> +--- + src/libFLAC/stream_decoder.c | 3 ++- + 1 files changed, 2 insertions(+), 1 deletions(-) + +--- a/src/libFLAC/stream_decoder.c ++++ b/src/libFLAC/stream_decoder.c +@@ -2738,7 +2738,8 @@ + if(partition_samples < predictor_order) { + send_error_to_client_(decoder, FLAC__STREAM_DECODER_ERROR_STATUS_LOST_SYNC); + decoder->protected_->state = FLAC__STREAM_DECODER_SEARCH_FOR_FRAME_SYNC; +- return true; ++ /* We have received a potentially malicious bit stream. All we can do is error out to avoid a heap overflow. */ ++ return false; + } + } + diff --git a/source/multimedia/flac/FrugalBuild b/source/multimedia/flac/FrugalBuild index 1755fcd..6382635 100644 --- a/source/multimedia/flac/FrugalBuild +++ b/source/multimedia/flac/FrugalBuild @@ -3,7 +3,7 @@ pkgname=flac pkgver=1.2.1 -pkgrel=3 +pkgrel=4arcturus1 pkgdesc="Free Lossless Audio Coder" depends=('libogg') groups=('multimedia') @@ -16,4 +16,12 @@ sha1sums=('bd54354900181b59db3089347cc84ad81e410b38' \ if [ "$CARCH" == "x86_64" ]; then Fconfopts+=" --enable-sse" fi + +# FSA fix *** +source=(${source[@]} CVE-2014-8962.patch CVE-2014-9028-1.patch CVE-2014-9028-2.patch) +sha1sums=(${sha1sums[@]} '6d8154b600dd52ed547090ce4f5287a2f1bbf60a' \ + '76a9b39ca1c6b52c25a449f7dffd0b41c8d9c406' \ + '73fefe3f041d6ed050a63adc7ee0d208b599b6da') +# *********** + # optimization OK _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
