Received: by mail.netbsd.org (Postfix, from userid 605) id 6B75384DA0; Sun, 14 Jul 2019 15:39:34 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id E560584D52 for ; Sun, 14 Jul 2019 15:39:33 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id PXiIkvO9MPit for ; Sun, 14 Jul 2019 15:39:33 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 084E584D3A for ; Sun, 14 Jul 2019 15:39:33 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id F001FFBF4; Sun, 14 Jul 2019 15:39:32 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1563118772132990" MIME-Version: 1.0 Date: Sun, 14 Jul 2019 15:39:32 +0000 From: "Nia Alarie" Subject: CVS commit: pkgsrc/audio/libsndfile To: pkgsrc-changes@NetBSD.org Reply-To: nia@netbsd.org X-Mailer: log_accum Message-Id: <20190714153932.F001FFBF4@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: pkgsrc-changes.NetBSD.org Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1563118772132990 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: nia Date: Sun Jul 14 15:39:32 UTC 2019 Modified Files: pkgsrc/audio/libsndfile: Makefile distinfo Added Files: pkgsrc/audio/libsndfile/patches: patch-CVE-2017-14634 patch-CVE-2018-13139 patch-src_alaw.c patch-src_ulaw.c patch-src_wav.c Log Message: libsndfile: Apply patches from upstream's github for these CVEs: CVE-2017-14245 - information-disclosure CVE-2017-14246 - information-disclosure CVE-2017-14634 - denial-of-service CVE-2017-17456 - denial-of-service CVE-2017-17457 - denial-of-service CVE-2017-8362 - denial-of-service CVE-2017-8363 - heap-overflow CVE-2017-8365 - buffer-overflow CVE-2018-13139 - stack-overflow CVE-2018-19432 - null-pointer-dereference CVE-2018-19661 - denial-of-service CVE-2018-19662 - denial-of-service CVE-2018-19758 - denial-of-service CVE-2019-3832 - denial-of-service Bump PKGREVISION. To generate a diff of this commit: cvs rdiff -u -r1.75 -r1.76 pkgsrc/audio/libsndfile/Makefile cvs rdiff -u -r1.42 -r1.43 pkgsrc/audio/libsndfile/distinfo cvs rdiff -u -r0 -r1.1 pkgsrc/audio/libsndfile/patches/patch-CVE-2017-14634 \ pkgsrc/audio/libsndfile/patches/patch-CVE-2018-13139 \ pkgsrc/audio/libsndfile/patches/patch-src_alaw.c \ pkgsrc/audio/libsndfile/patches/patch-src_ulaw.c \ pkgsrc/audio/libsndfile/patches/patch-src_wav.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1563118772132990 Content-Disposition: inline Content-Length: 8140 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/audio/libsndfile/Makefile diff -u pkgsrc/audio/libsndfile/Makefile:1.75 pkgsrc/audio/libsndfile/Makefile:1.76 --- pkgsrc/audio/libsndfile/Makefile:1.75 Wed May 17 21:58:05 2017 +++ pkgsrc/audio/libsndfile/Makefile Sun Jul 14 15:39:32 2019 @@ -1,7 +1,7 @@ -# $NetBSD: Makefile,v 1.75 2017/05/17 21:58:05 he Exp $ +# $NetBSD: Makefile,v 1.76 2019/07/14 15:39:32 nia Exp $ DISTNAME= libsndfile-1.0.28 -PKGREVISION= 2 +PKGREVISION= 3 CATEGORIES= audio MASTER_SITES= http://www.mega-nerd.com/libsndfile/files/ Index: pkgsrc/audio/libsndfile/distinfo diff -u pkgsrc/audio/libsndfile/distinfo:1.42 pkgsrc/audio/libsndfile/distinfo:1.43 --- pkgsrc/audio/libsndfile/distinfo:1.42 Wed May 17 22:04:08 2017 +++ pkgsrc/audio/libsndfile/distinfo Sun Jul 14 15:39:32 2019 @@ -1,9 +1,14 @@ -$NetBSD: distinfo,v 1.42 2017/05/17 22:04:08 he Exp $ +$NetBSD: distinfo,v 1.43 2019/07/14 15:39:32 nia Exp $ SHA1 (libsndfile-1.0.28.tar.gz) = 85aa967e19f6b9bf975601d79669025e5f8bc77d RMD160 (libsndfile-1.0.28.tar.gz) = f8803966802afe2b5a35cda28c2f764d91c48f37 SHA512 (libsndfile-1.0.28.tar.gz) = 890731a6b8173f714155ce05eaf6d991b31632c8ab207fbae860968861a107552df26fcf85602df2e7f65502c7256c1b41735e1122485a3a07ddb580aa83b57f Size (libsndfile-1.0.28.tar.gz) = 1202833 bytes +SHA1 (patch-CVE-2017-14634) = 9b64abe6a8950e8d79ebb913903a644ba7081f34 +SHA1 (patch-CVE-2018-13139) = d11afed645e096d6c836f7214b24832708ff9c5f +SHA1 (patch-src_alaw.c) = 7e9e0d1c6d30391c24b21afca1b568a3af643ab4 SHA1 (patch-src_common.h) = ed366417009008f816d688cd33809f680cf2f674 SHA1 (patch-src_flac.c) = 27f58cd77c1a1828d069e5e4178d2477724100cd SHA1 (patch-src_sndfile.c) = 34b27502839b8ef271ced8ba562b7281c68ff4da +SHA1 (patch-src_ulaw.c) = 5cfb7fa6af394f2cc8e76bcc48da0f93d115a137 +SHA1 (patch-src_wav.c) = 67e0dff27079d14bf6d1480db5fcb2ed1861718d Added files: Index: pkgsrc/audio/libsndfile/patches/patch-CVE-2017-14634 diff -u /dev/null pkgsrc/audio/libsndfile/patches/patch-CVE-2017-14634:1.1 --- /dev/null Sun Jul 14 15:39:32 2019 +++ pkgsrc/audio/libsndfile/patches/patch-CVE-2017-14634 Sun Jul 14 15:39:32 2019 @@ -0,0 +1,18 @@ +$NetBSD: patch-CVE-2017-14634,v 1.1 2019/07/14 15:39:32 nia Exp $ + +Fixes: CVE-2017-14634 + +Upstream commit: +https://github.com/erikd/libsndfile/commit/85c877d5072866aadbe8ed0c3e0590fbb5e16788.patch + +--- src/double64.c.orig 2016-04-01 21:08:53.000000000 +0000 ++++ src/double64.c +@@ -91,7 +91,7 @@ int + double64_init (SF_PRIVATE *psf) + { static int double64_caps ; + +- if (psf->sf.channels < 1) ++ if (psf->sf.channels < 1 || psf->sf.channels > SF_MAX_CHANNELS) + { psf_log_printf (psf, "double64_init : internal error : channels = %d\n", psf->sf.channels) ; + return SFE_INTERNAL ; + } ; Index: pkgsrc/audio/libsndfile/patches/patch-CVE-2018-13139 diff -u /dev/null pkgsrc/audio/libsndfile/patches/patch-CVE-2018-13139:1.1 --- /dev/null Sun Jul 14 15:39:32 2019 +++ pkgsrc/audio/libsndfile/patches/patch-CVE-2018-13139 Sun Jul 14 15:39:32 2019 @@ -0,0 +1,23 @@ +$NetBSD: patch-CVE-2018-13139,v 1.1 2019/07/14 15:39:32 nia Exp $ + +Fixes: CVE-2018-13139, CVE-2018-19432 + +Upstream commit: +https://github.com/erikd/libsndfile/commit/df18323c622b54221ee7ace74b177cdcccc152d7.patch + +--- programs/sndfile-deinterleave.c.orig 2016-04-01 21:08:52.000000000 +0000 ++++ programs/sndfile-deinterleave.c +@@ -89,6 +89,13 @@ main (int argc, char **argv) + exit (1) ; + } ; + ++ if (sfinfo.channels > MAX_CHANNELS) ++ { printf ("\nError : Input file '%s' has too many (%d) channels. Limit is %d.\n", ++ argv [1], sfinfo.channels, MAX_CHANNELS) ; ++ exit (1) ; ++ } ; ++ ++ + state.channels = sfinfo.channels ; + sfinfo.channels = 1 ; + Index: pkgsrc/audio/libsndfile/patches/patch-src_alaw.c diff -u /dev/null pkgsrc/audio/libsndfile/patches/patch-src_alaw.c:1.1 --- /dev/null Sun Jul 14 15:39:32 2019 +++ pkgsrc/audio/libsndfile/patches/patch-src_alaw.c Sun Jul 14 15:39:32 2019 @@ -0,0 +1,39 @@ +$NetBSD: patch-src_alaw.c,v 1.1 2019/07/14 15:39:32 nia Exp $ + +Fix: CVE-2018-19662, CVE-2017-17456 + +Upstream commit: +https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f.patch + +--- src/alaw.c.orig 2016-04-01 21:08:52.000000000 +0000 ++++ src/alaw.c +@@ -19,6 +19,7 @@ + #include "sfconfig.h" + + #include ++#include + + #include "sndfile.h" + #include "common.h" +@@ -326,7 +327,9 @@ s2alaw_array (const short *ptr, int coun + static inline void + i2alaw_array (const int *ptr, int count, unsigned char *buffer) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (ptr [count] == INT_MIN) ++ buffer [count] = alaw_encode [INT_MAX >> (16 + 4)] ; ++ else if (ptr [count] >= 0) + buffer [count] = alaw_encode [ptr [count] >> (16 + 4)] ; + else + buffer [count] = 0x7F & alaw_encode [- ptr [count] >> (16 + 4)] ; +@@ -346,7 +349,9 @@ f2alaw_array (const float *ptr, int coun + static inline void + d2alaw_array (const double *ptr, int count, unsigned char *buffer, double normfact) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (!isfinite (ptr [count])) ++ buffer [count] = 0 ; ++ else if (ptr [count] >= 0) + buffer [count] = alaw_encode [lrint (normfact * ptr [count])] ; + else + buffer [count] = 0x7F & alaw_encode [- lrint (normfact * ptr [count])] ; Index: pkgsrc/audio/libsndfile/patches/patch-src_ulaw.c diff -u /dev/null pkgsrc/audio/libsndfile/patches/patch-src_ulaw.c:1.1 --- /dev/null Sun Jul 14 15:39:32 2019 +++ pkgsrc/audio/libsndfile/patches/patch-src_ulaw.c Sun Jul 14 15:39:32 2019 @@ -0,0 +1,39 @@ +$NetBSD: patch-src_ulaw.c,v 1.1 2019/07/14 15:39:32 nia Exp $ + +Fix: CVE-2018-19661, CVE-2017-17457 + +Upstream commit: +https://github.com/erikd/libsndfile/commit/8ddc442d539ca775d80cdbc7af17a718634a743f.patch + +--- src/ulaw.c.orig 2016-04-01 21:08:53.000000000 +0000 ++++ src/ulaw.c +@@ -19,6 +19,7 @@ + #include "sfconfig.h" + + #include ++#include + + #include "sndfile.h" + #include "common.h" +@@ -827,7 +828,9 @@ s2ulaw_array (const short *ptr, int coun + static inline void + i2ulaw_array (const int *ptr, int count, unsigned char *buffer) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (ptr [count] == INT_MIN) ++ buffer [count] = ulaw_encode [INT_MAX >> (16 + 2)] ; ++ else if (ptr [count] >= 0) + buffer [count] = ulaw_encode [ptr [count] >> (16 + 2)] ; + else + buffer [count] = 0x7F & ulaw_encode [-ptr [count] >> (16 + 2)] ; +@@ -847,7 +850,9 @@ f2ulaw_array (const float *ptr, int coun + static inline void + d2ulaw_array (const double *ptr, int count, unsigned char *buffer, double normfact) + { while (--count >= 0) +- { if (ptr [count] >= 0) ++ { if (!isfinite (ptr [count])) ++ buffer [count] = 0 ; ++ else if (ptr [count] >= 0) + buffer [count] = ulaw_encode [lrint (normfact * ptr [count])] ; + else + buffer [count] = 0x7F & ulaw_encode [- lrint (normfact * ptr [count])] ; Index: pkgsrc/audio/libsndfile/patches/patch-src_wav.c diff -u /dev/null pkgsrc/audio/libsndfile/patches/patch-src_wav.c:1.1 --- /dev/null Sun Jul 14 15:39:32 2019 +++ pkgsrc/audio/libsndfile/patches/patch-src_wav.c Sun Jul 14 15:39:32 2019 @@ -0,0 +1,23 @@ +$NetBSD: patch-src_wav.c,v 1.1 2019/07/14 15:39:32 nia Exp $ + +Fix CVE-2019-3832 and CVE-2018-19758. + +CVE-2019-3832 was introduced by a non-working patch for CVE-2018-19758... + +Upstream commits: +https://github.com/erikd/libsndfile/commit/42132c543358cee9f7c3e9e9b15bb6c1063a608e.patch +https://github.com/erikd/libsndfile/commit/6d7ce94c020cc720a6b28719d1a7879181790008.patch + +--- src/wav.c.orig 2017-04-01 07:18:02.000000000 +0000 ++++ src/wav.c +@@ -1094,6 +1094,10 @@ wav_write_header (SF_PRIVATE *psf, int c + psf_binheader_writef (psf, "44", 0, 0) ; /* SMTPE format */ + psf_binheader_writef (psf, "44", psf->instrument->loop_count, 0) ; + ++ /* Make sure we don't read past the loops array end. */ ++ if (psf->instrument->loop_count > ARRAY_LEN (psf->instrument->loops)) ++ psf->instrument->loop_count = ARRAY_LEN (psf->instrument->loops) ; ++ + for (tmp = 0 ; tmp < psf->instrument->loop_count ; tmp++) + { int type ; + --_----------=_1563118772132990--