commit: a877b25c4d29e1e60df8af384725e83c093fa734 Author: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> AuthorDate: Wed Oct 3 20:48:42 2018 +0000 Commit: Andreas Sturmlechner <asturm <AT> gentoo <DOT> org> CommitDate: Wed Oct 3 21:11:27 2018 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a877b25c
media-libs/libmad: Fix vulnerabilities, EAPI-7 bump Debian does it, so let's use it too. Bug: https://bugs.gentoo.org/618022 Signed-off-by: Andreas Sturmlechner <asturm <AT> gentoo.org> Package-Manager: Portage-2.3.50, Repoman-2.3.11 ...CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch | 197 +++++++++++++++++++++ media-libs/libmad/libmad-0.15.1b-r9.ebuild | 80 +++++++++ 2 files changed, 277 insertions(+) diff --git a/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch b/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch new file mode 100644 index 00000000000..9cc8913e159 --- /dev/null +++ b/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch @@ -0,0 +1,197 @@ +; You can calculate where the next frame will start depending on things +; like the bitrate. See mad_header_decode(). It seems that when decoding +; the frame you can go past that boundary. This attempts to catch those cases, +; but might not catch all of them. +; For more info see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133 +Index: libmad-0.15.1b/layer12.c +=================================================================== +--- a/layer12.c 2008-12-23 21:38:07.000000000 +0100 ++++ b/layer12.c 2008-12-23 21:38:12.000000000 +0100 +@@ -134,6 +134,12 @@ + for (sb = 0; sb < bound; ++sb) { + for (ch = 0; ch < nch; ++ch) { + nb = mad_bit_read(&stream->ptr, 4); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + if (nb == 15) { + stream->error = MAD_ERROR_BADBITALLOC; +@@ -146,6 +152,12 @@ + + for (sb = bound; sb < 32; ++sb) { + nb = mad_bit_read(&stream->ptr, 4); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + if (nb == 15) { + stream->error = MAD_ERROR_BADBITALLOC; +@@ -162,6 +174,12 @@ + for (ch = 0; ch < nch; ++ch) { + if (allocation[ch][sb]) { + scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + # if defined(OPT_STRICT) + /* +@@ -187,6 +205,12 @@ + frame->sbsample[ch][s][sb] = nb ? + mad_f_mul(I_sample(&stream->ptr, nb), + sf_table[scalefactor[ch][sb]]) : 0; ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + } + } + +@@ -195,6 +219,12 @@ + mad_fixed_t sample; + + sample = I_sample(&stream->ptr, nb); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + for (ch = 0; ch < nch; ++ch) { + frame->sbsample[ch][s][sb] = +@@ -403,7 +433,15 @@ + nbal = bitalloc_table[offsets[sb]].nbal; + + for (ch = 0; ch < nch; ++ch) ++ { + allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } ++ } + } + + for (sb = bound; sb < sblimit; ++sb) { +@@ -411,6 +449,13 @@ + + allocation[0][sb] = + allocation[1][sb] = mad_bit_read(&stream->ptr, nbal); ++ ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + } + + /* decode scalefactor selection info */ +@@ -419,6 +464,12 @@ + for (ch = 0; ch < nch; ++ch) { + if (allocation[ch][sb]) + scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + } + } + +@@ -442,6 +493,12 @@ + for (ch = 0; ch < nch; ++ch) { + if (allocation[ch][sb]) { + scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + switch (scfsi[ch][sb]) { + case 2: +@@ -452,11 +509,23 @@ + + case 0: + scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + /* fall through */ + + case 1: + case 3: + scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + } + + if (scfsi[ch][sb] & 1) +@@ -488,6 +557,12 @@ + index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; + + II_samples(&stream->ptr, &qc_table[index], samples); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + for (s = 0; s < 3; ++s) { + frame->sbsample[ch][3 * gr + s][sb] = +@@ -506,6 +581,12 @@ + index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1]; + + II_samples(&stream->ptr, &qc_table[index], samples); ++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + for (ch = 0; ch < nch; ++ch) { + for (s = 0; s < 3; ++s) { +Index: libmad-0.15.1b/layer3.c +=================================================================== +--- a/layer3.c 2008-12-23 21:38:07.000000000 +0100 ++++ b/layer3.c 2008-12-23 21:38:12.000000000 +0100 +@@ -2608,6 +2608,12 @@ + next_md_begin = 0; + + md_len = si.main_data_begin + frame_space - next_md_begin; ++ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN) ++ { ++ stream->error = MAD_ERROR_LOSTSYNC; ++ stream->sync = 0; ++ return -1; ++ } + + frame_used = 0; + diff --git a/media-libs/libmad/libmad-0.15.1b-r9.ebuild b/media-libs/libmad/libmad-0.15.1b-r9.ebuild new file mode 100644 index 00000000000..2740db06857 --- /dev/null +++ b/media-libs/libmad/libmad-0.15.1b-r9.ebuild @@ -0,0 +1,80 @@ +# Copyright 1999-2018 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +inherit autotools flag-o-matic multilib-minimal + +DESCRIPTION="\"M\"peg \"A\"udio \"D\"ecoder library" +HOMEPAGE="http://mad.sourceforge.net"; +SRC_URI="mirror://sourceforge/mad/${P}.tar.gz" + +LICENSE="GPL-2" +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x86-solaris" +IUSE="debug static-libs" + +DEPEND="" +RDEPEND="" + +DOCS=( CHANGES CREDITS README TODO VERSION ) + +MULTILIB_WRAPPED_HEADERS=( + /usr/include/mad.h +) + +PATCHES=( + "${FILESDIR}"/${P}-cflags.patch + "${FILESDIR}"/${P}-cflags-O2.patch + "${FILESDIR}"/${P}-gcc44-mips-h-constraint-removal.patch + "${FILESDIR}"/${P}-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch +) + +src_prepare() { + default + + # bug 467002 + sed -e 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' -i configure.ac || die + + eautoreconf +} + +multilib_src_configure() { + # --enable-speed optimize for speed over accuracy + # --enable-accuracy optimize for accuracy over speed + # --enable-experimental enable code using the EXPERIMENTAL + # preprocessor define + local myconf=( + --enable-accuracy + $(use_enable debug debugging) + $(use_enable static-libs static) + ) + + # Fix for b0rked sound on sparc64 (maybe also sparc32?) + # default/approx is also possible, uses less cpu but sounds worse + use sparc && myconf+=( --enable-fpm=64bit ) + + [[ $(tc-arch) == "amd64" ]] && myconf+=( --enable-fpm=64bit ) + [[ $(tc-arch) == "x86" ]] && myconf+=( --enable-fpm=intel ) + [[ $(tc-arch) == "ppc" ]] && myconf+=( --enable-fpm=default ) + [[ $(tc-arch) == "ppc64" ]] && myconf+=( --enable-fpm=64bit ) + + ECONF_SOURCE="${S}" econf "${myconf[@]}" +} + +multilib_src_install() { + emake DESTDIR="${D}" install + + # This file must be updated with each version update + insinto /usr/$(get_libdir)/pkgconfig + doins "${FILESDIR}"/mad.pc + + # Use correct libdir in pkgconfig file + sed -e "s:^libdir.*:libdir=${EPREFIX}/usr/$(get_libdir):" \ + -i "${ED}"/usr/$(get_libdir)/pkgconfig/mad.pc +} + +multilib_src_install_all() { + einstalldocs + find "${D}" -name '*.la' -delete || die +}
