CVE-2020-23903.patch removed since it's included in 1.2.1 License-Update: Add "Organisation (CSIRO)" to Copyright 2005-2008
Changelog: =========== Check for _WIN32 instead of WIN32 in preprocessor checks wav_io: check for EOF when seeking in wav (fixes hang discovered by fuzzing, see #9) CI: add gitlab CI integration fixed-point: make left shift macros use unsigned to avoid undefined behaviour math_approx: use unsigned int for LCG pseudorandom generator (avoids integer overflow) oss-fuzz: add integration and fuzzing target speexenc: guard against invalid channel numbers (see #13) speexdec: make left shift macros use unsigned to avoid undefined behaviour autotools: do not use deprecated macros Signed-off-by: Wang Mingyu <[email protected]> --- .../speex/speex/CVE-2020-23903.patch | 30 ------------------- .../speex/{speex_1.2.0.bb => speex_1.2.1.bb} | 12 ++++---- 2 files changed, 5 insertions(+), 37 deletions(-) delete mode 100644 meta/recipes-multimedia/speex/speex/CVE-2020-23903.patch rename meta/recipes-multimedia/speex/{speex_1.2.0.bb => speex_1.2.1.bb} (65%) diff --git a/meta/recipes-multimedia/speex/speex/CVE-2020-23903.patch b/meta/recipes-multimedia/speex/speex/CVE-2020-23903.patch deleted file mode 100644 index eb16e95ffc..0000000000 --- a/meta/recipes-multimedia/speex/speex/CVE-2020-23903.patch +++ /dev/null @@ -1,30 +0,0 @@ -Backport patch to fix CVE-2020-23903. - -CVE: CVE-2020-23903 -Upstream-Status: Backport [https://github.com/xiph/speex/commit/870ff84] - -Signed-off-by: Kai Kang <[email protected]> - -From 870ff845b32f314aec0036641ffe18aba4916887 Mon Sep 17 00:00:00 2001 -From: Tristan Matthews <[email protected]> -Date: Mon, 13 Jul 2020 23:25:03 -0400 -Subject: [PATCH] wav_io: guard against invalid channel numbers - -Fixes #13 ---- - src/wav_io.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/src/wav_io.c b/src/wav_io.c -index b5183015..09d62eb0 100644 ---- a/src/wav_io.c -+++ b/src/wav_io.c -@@ -111,7 +111,7 @@ int read_wav_header(FILE *file, int *rate, int *channels, int *format, spx_int32 - stmp = le_short(stmp); - *channels = stmp; - -- if (stmp>2) -+ if (stmp>2 || stmp<1) - { - fprintf (stderr, "Only mono and (intensity) stereo supported\n"); - return -1; diff --git a/meta/recipes-multimedia/speex/speex_1.2.0.bb b/meta/recipes-multimedia/speex/speex_1.2.1.bb similarity index 65% rename from meta/recipes-multimedia/speex/speex_1.2.0.bb rename to meta/recipes-multimedia/speex/speex_1.2.1.bb index ea475f0f1b..c40198fa8f 100644 --- a/meta/recipes-multimedia/speex/speex_1.2.0.bb +++ b/meta/recipes-multimedia/speex/speex_1.2.1.bb @@ -3,17 +3,15 @@ DESCRIPTION = "Speex is an Open Source/Free Software patent-free audio compressi HOMEPAGE = "http://www.speex.org"; SECTION = "libs" LICENSE = "BSD-3-Clause" -LIC_FILES_CHKSUM = "file://COPYING;md5=314649d8ba9dd7045dfb6683f298d0a8 \ - file://include/speex/speex.h;beginline=1;endline=34;md5=ef8c8ea4f7198d71cf3509c6ed05ea50" +LIC_FILES_CHKSUM = "file://COPYING;md5=eff3f76350f52a99a3df5eec6b79c02a \ + file://include/speex/speex.h;beginline=1;endline=34;md5=ef8c8ea4f7198d71cf3509c6ed05ea50 \ + " DEPENDS = "libogg speexdsp" -SRC_URI = "http://downloads.xiph.org/releases/speex/speex-${PV}.tar.gz \ - file://CVE-2020-23903.patch \ - " +SRC_URI = "http://downloads.xiph.org/releases/speex/speex-${PV}.tar.gz"; UPSTREAM_CHECK_REGEX = "speex-(?P<pver>\d+(\.\d+)+)\.tar" -SRC_URI[md5sum] = "8ab7bb2589110dfaf0ed7fa7757dc49c" -SRC_URI[sha256sum] = "eaae8af0ac742dc7d542c9439ac72f1f385ce838392dc849cae4536af9210094" +SRC_URI[sha256sum] = "4b44d4f2b38a370a2d98a78329fefc56a0cf93d1c1be70029217baae6628feea" inherit autotools pkgconfig lib_package -- 2.25.1
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#167397): https://lists.openembedded.org/g/openembedded-core/message/167397 Mute This Topic: https://lists.openembedded.org/mt/92080568/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
