Your message dated Sat, 18 Nov 2006 11:07:40 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#370390: fixed in libtunepimp 0.5.2-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: libtunepimp3
Version: 0.4.2-3
Severity: normal
Tags: patch
Note: I run Debian stable, but built libtunepimp3 on a Ubuntu dapper
system as
this comes closer to Debian testing than Debian stable. libtunepimp3 is not
part of dapper (it still uses libtunepimp2), I needed it to port my project
"Kid3" to the new libtunepimp.
Bug reproduction:
Start tp_tagger (from packet libtunepimp-bin), add some MP3 or Ogg files
and
notice that the lookup process is stuck at "TRM Lookup". If you start
tp_tagger from gdb, the lookup thread is reported to crash with a
segmentation
fault in LookupTRM::lookup(), the location can be found out using a
libtunepimp.so.3.0.0 with debugging information not stripped, it is line
170.
Analysis:
lib/lookuptools.cpp:
At line 163, buffer temp is used as a buffer with 256 bytes. However,
there is
no buffer temp with 256 bytes in the innermost scope. The buffer temp used
is
defined in line 56 and has only 100 bytes. Thus when more than 100 bytes
result data are read, temp is overflown and the thread can crash (if it
does
may depend on compiler optimization, linkage, ..., in my system it does).
Patch:
The following patch provides a sufficiently sized temp buffer. It also
fixes
some other buffer length violations (one byte more is used than available).
** begin of patch **
diff -ru libtunepimp-0.4.2.orig/lib/lookuptools.cpp
libtunepimp-0.4.2/lib/lookuptools.cpp
--- libtunepimp-0.4.2.orig/lib/lookuptools.cpp 2006-01-28
21:35:42.000000000 +0100
+++ libtunepimp-0.4.2/lib/lookuptools.cpp 2006-06-04 20:09:51.000000000
+0200
@@ -51,7 +51,7 @@
musicbrainz_t o;
char *args[7];
int ret, trackNum;
- char error[255], data[255], trackURI[256],
+ char error[256], data[256], trackURI[256],
artistURI[256], albumURI[256];
char temp[100], duration[100], status[100];
@@ -159,6 +159,7 @@
// Select the first release date
if (mb_Select1(o, MBS_SelectReleaseDate, j))
{
+ char temp[256];
// Pull back the release date and release country
if (mb_GetResultData(o, MBE_ReleaseGetDate, temp, 256))
{
@@ -211,7 +212,7 @@
musicbrainz_t o;
char *args[3];
int ret;
- char error[255], data[255];
+ char error[256], data[256];
//
-----------------------------------------------------------------------------------------
// NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE NOTE
NOTE NOTE NOTE NOTE NOTE
@@ -299,7 +300,7 @@
{
musicbrainz_t o;
int ret;
- char error[255];
+ char error[256];
if (user.empty() || passwd.empty())
{
** end of patch **
And now for something completely different:
It would be better to check for taglib 1.4 than 1.4.0 in configure, or
taglib
with version "1.4" will not be used. The following patch should solve this:
** begin of patch **
diff -ru libtunepimp-0.4.2.orig/configure libtunepimp-0.4.2/configure
--- libtunepimp-0.4.2.orig/configure 2006-06-04 23:47:52.000000000 +0200
+++ libtunepimp-0.4.2/configure 2006-06-02 19:30:24.000000000 +0200
@@ -19556,9 +19556,9 @@
echo "*** Or see http://developer.kde.org/~wheeler/taglib.html";
else
TAGLIB_VERSION=`$TAGLIB_CONFIG --version`
- echo "$as_me:$LINENO: checking for taglib >= 1.4.0" >&5
-echo $ECHO_N "checking for taglib >= 1.4.0... $ECHO_C" >&6
- VERSION_CHECK=`expr $TAGLIB_VERSION \>\= 1.4.0`
+ echo "$as_me:$LINENO: checking for taglib >= 1.4" >&5
+echo $ECHO_N "checking for taglib >= 1.4... $ECHO_C" >&6
+ VERSION_CHECK=`expr $TAGLIB_VERSION \>\= 1.4`
if test "$VERSION_CHECK" = "1" ; then
echo "$as_me:$LINENO: result: yes" >&5
echo "${ECHO_T}yes" >&6
diff -ru libtunepimp-0.4.2.orig/configure.in libtunepimp-0.4.2/configure.in
--- libtunepimp-0.4.2.orig/configure.in 2006-06-04 23:47:52.000000000 +0200
+++ libtunepimp-0.4.2/configure.in 2006-06-04 23:45:25.000000000 +0200
@@ -77,7 +77,7 @@
AC_CHECK_HEADERS(iconv.h)
dnl Check for TagLib 1.4
-AC_CHECK_TAGLIB(1.4.0,
+AC_CHECK_TAGLIB(1.4,
[TP_PLUGINS="$TP_PLUGINS mpc wma"
AC_DEFINE(HAVE_TAGLIB,1,[TagLib Support])],
[AC_MSG_RESULT([no])
** end of patch **
-- System Information:
Debian Release: testing/unstable
APT prefers dapper-updates
APT policy: (500, 'dapper-updates'), (500, 'dapper-security'), (500,
'dapper')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.15-23-686
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Versions of packages libtunepimp3 depends on:
ii libc6 2.3.6-0ubuntu20 GNU C Library: Shared
libraries an
ii libgcc1 1:4.0.3-1ubuntu5 GCC support library
ii libmusicbrainz4c2a 2.1.2-2ubuntu3 Second generation incarnation
of t
ii libstdc++6 4.0.3-1ubuntu5 The GNU Standard C++ Library
v3
ii zlib1g 1:1.2.3-6ubuntu4 compression library - runtime
libtunepimp3 recommends no packages.
--- End Message ---
--- Begin Message ---
Source: libtunepimp
Source-Version: 0.5.2-1
We believe that the bug you reported is fixed in the latest version of
libtunepimp, which is due to be installed in the Debian FTP archive:
libtunepimp-dev_0.5.2-1_i386.deb
to pool/main/libt/libtunepimp/libtunepimp-dev_0.5.2-1_i386.deb
libtunepimp5_0.5.2-1_i386.deb
to pool/main/libt/libtunepimp/libtunepimp5_0.5.2-1_i386.deb
libtunepimp_0.5.2-1.diff.gz
to pool/main/libt/libtunepimp/libtunepimp_0.5.2-1.diff.gz
libtunepimp_0.5.2-1.dsc
to pool/main/libt/libtunepimp/libtunepimp_0.5.2-1.dsc
libtunepimp_0.5.2.orig.tar.gz
to pool/main/libt/libtunepimp/libtunepimp_0.5.2.orig.tar.gz
python-tunepimp_0.5.2-1_all.deb
to pool/main/libt/libtunepimp/python-tunepimp_0.5.2-1_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Adam Cécile (Le_Vert) <[EMAIL PROTECTED]> (supplier of updated libtunepimp
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Mon, 6 Nov 2006 12:46:00 +0100
Source: libtunepimp
Binary: libtunepimp-dev python-tunepimp libtunepimp5
Architecture: source all i386
Version: 0.5.2-1
Distribution: experimental
Urgency: low
Maintainer: Adam Cécile (Le_Vert) <[EMAIL PROTECTED]>
Changed-By: Adam Cécile (Le_Vert) <[EMAIL PROTECTED]>
Description:
libtunepimp-dev - MusicBrainz tagging library development files
libtunepimp5 - MusicBrainz tagging library
python-tunepimp - Python bindings for MusicBrainz tagging library
Closes: 362635 370390 389162 397264
Changes:
libtunepimp (0.5.2-1) experimental; urgency=low
.
* New co-maintener.
* New upstream release (Closes: #389162).
Crash in TRM Lookup fixed, see: http://bugs.musicbrainz.org/ticket/1563
(Closes: #370390).
* API change.
* Re-package using debhelper.
Python-support transition done (Closes: #397264).
Remove empty directory in python-tunepimp (Closes: #362635).
Fix all lintian warnings.
* libtunepimp-perl removed, out-dated, not supported by upstream anymore.
* Rename libtunepimp3-dev to libtunepimp-dev.
* Remove libtunepimp-bin package, this is only code sample tools.
* Update long description.
* Update copyright with LGPL license.
Files:
e509c092dd0c7e4236ab9cbf5b489686 935 libs optional libtunepimp_0.5.2-1.dsc
655b254539013f5e7fe50ac035c26dcb 1076084 libs optional
libtunepimp_0.5.2.orig.tar.gz
9e847974802e87dad50f31264c50f083 10362 libs optional
libtunepimp_0.5.2-1.diff.gz
79064460863681ec41e3312e30f0e10a 250758 libdevel optional
libtunepimp-dev_0.5.2-1_i386.deb
45b4fbcb133f72c8c4bdf97c586bc10a 411632 libs optional
libtunepimp5_0.5.2-1_i386.deb
bde5edcee39414effc10e4d977f914db 17686 python optional
python-tunepimp_0.5.2-1_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQFFT1R9+C5cwEsrK54RAuPSAJ0TxC5uP5098Tybxw0x6IKSy/q4VQCfR8Zs
3ozb7dwTQHVsg5SN+hgmT7o=
=HwDi
-----END PGP SIGNATURE-----
--- End Message ---
