Source: libogg Version: 1.3.4-0.1 Severity: wishlist Dear maintainer,
there is a new upstream release available, cf. <https://xiph.org/downloads/>. Its CHANGES merely contain | Version 1.3.5 (2020 June 3) | | * Fix unsigned typedef problem on macOS. | * Fix overflow check in ogg_sync_buffer. | * Clean up cmake and autotools build files. | * Remove Symbian and Apple XCode build files. | * Fix documentation cross-reference links. but this "overflow check in ogg_sync_buffer" here seems worthwhile: | diff -ruN libogg-1.3.4/src/framing.c libogg-1.3.5/src/framing.c | --- libogg-1.3.4/src/framing.c 2019-08-12 20:56:41.000000000 +0200 | +++ libogg-1.3.5/src/framing.c 2020-11-23 19:41:04.000000000 +0100 | @@ -597,9 +597,14 @@ | | if(size>oy->storage-oy->fill){ | /* We need to extend the internal buffer */ | - long newsize=size+oy->fill+4096; /* an extra page to be nice */ | + long newsize; | void *ret; | | + if(size>INT_MAX-4096-oy->fill){ | + ogg_sync_clear(oy); | + return NULL; | + } | + newsize=size+oy->fill+4096; /* an extra page to be nice */ | if(oy->data) | ret=_ogg_realloc(oy->data,newsize); | else | @@ -1564,7 +1569,7 @@ | byteskipcount=byteskip; | } | | - ogg_sync_wrote(&oy,next-buf); | + ogg_sync_wrote(&oy,(long)(next-buf)); | | while(1){ | int ret=ogg_sync_pageout(&oy,&og_de); In addition this new release refers to its collection of automated tests that could be executed during build time, cf README.md. Please update the package when you think it is due time. Cheers, Flo
signature.asc
Description: PGP signature
