Hello community,

here is the log from the commit of package taglib for openSUSE:Factory checked 
in at 2012-05-14 16:22:05
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/taglib (Old)
 and      /work/SRC/openSUSE:Factory/.taglib.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "taglib", Maintainer is "[email protected]"

Changes:
--------
--- /work/SRC/openSUSE:Factory/taglib/taglib.changes    2012-05-10 
14:34:52.000000000 +0200
+++ /work/SRC/openSUSE:Factory/.taglib.new/taglib.changes       2012-05-14 
16:22:11.000000000 +0200
@@ -1,0 +2,14 @@
+Fri May 11 10:22:59 UTC 2012 - [email protected]
+
+-Update to 1.7.2:
+ * Fixed division by zero while parsing corrupted MP4 files (CVE-2012-2396).
+ * Fixed compilation on Haiku.
+ * Improved parsing of corrupted WMA, RIFF and OGG files.
+ * Fixed a memory leak in the WMA parser.
+ * Fixed a memory leak in the FLAC parser.
+ * Fixed a possible division by zero in the APE parser.
+ * Added detection of TTA2 files.
+ * Fixed saving of multiple identically named tags to Vorbis Comments.
+-Fixed a build failure related to doxygen.
+
+-------------------------------------------------------------------

Old:
----
  taglib-1.7.tar.bz2

New:
----
  taglib-1.7.2-doxygen.patch
  taglib-1.7.2.tar.bz2

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ taglib.spec ++++++
--- /var/tmp/diff_new_pack.5JRqmT/_old  2012-05-14 16:22:12.000000000 +0200
+++ /var/tmp/diff_new_pack.5JRqmT/_new  2012-05-14 16:22:12.000000000 +0200
@@ -17,7 +17,7 @@
 
 
 Name:           taglib
-Version:        1.7
+Version:        1.7.2
 Release:        0
 Summary:        Audio Meta-Data Library
 License:        LGPL-2.1+ ; MPL-1.1
@@ -29,6 +29,7 @@
 Source100:      baselibs.conf
 Patch1:         taglib-1.6-ds-rusxmms.patch
 Patch2:         taglib-noansiflags.patch
+Patch3:         taglib-1.7.2-doxygen.patch             
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 BuildRequires:  cmake
 BuildRequires:  doxygen
@@ -98,6 +99,7 @@
 %setup -q
 %patch1 -p1
 %patch2
+%patch3 -p1
 %build
 mkdir build
 cd build

++++++ taglib-1.7.2-doxygen.patch ++++++
Index: taglib-1.7.2/CMakeLists.txt
===================================================================
--- taglib-1.7.2.orig/CMakeLists.txt
+++ taglib-1.7.2/CMakeLists.txt
@@ -76,7 +76,7 @@ endif(NOT WIN32)
 
 INSTALL( PROGRAMS  ${CMAKE_CURRENT_BINARY_DIR}/taglib-config DESTINATION 
${BIN_INSTALL_DIR})
 
-CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile.cmake 
${CMAKE_CURRENT_BINARY_DIR}/Doxyfile)
+CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile.cmake 
${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile)
 file(COPY doc/taglib.png DESTINATION doc)
 ADD_CUSTOM_TARGET(docs doxygen)
 
++++++ taglib-1.7.tar.bz2 -> taglib-1.7.2.tar.bz2 ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/CMakeLists.txt 
new/taglib-1.7.2/CMakeLists.txt
--- old/taglib-1.7/CMakeLists.txt       2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/CMakeLists.txt     2012-04-20 17:57:13.000000000 +0200
@@ -40,7 +40,7 @@
 
 SET(TAGLIB_LIB_MAJOR_VERSION "1")
 SET(TAGLIB_LIB_MINOR_VERSION "7")
-SET(TAGLIB_LIB_PATCH_VERSION "0")
+SET(TAGLIB_LIB_PATCH_VERSION "2")
 
 SET(TAGLIB_LIB_VERSION_STRING 
"${TAGLIB_LIB_MAJOR_VERSION}.${TAGLIB_LIB_MINOR_VERSION}.${TAGLIB_LIB_PATCH_VERSION}")
 
@@ -76,6 +76,7 @@
 
 INSTALL( PROGRAMS  ${CMAKE_CURRENT_BINARY_DIR}/taglib-config DESTINATION 
${BIN_INSTALL_DIR})
 
-CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile.cmake 
${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile)
+CONFIGURE_FILE(${CMAKE_CURRENT_SOURCE_DIR}/Doxyfile.cmake 
${CMAKE_CURRENT_BINARY_DIR}/Doxyfile)
+file(COPY doc/taglib.png DESTINATION doc)
 ADD_CUSTOM_TARGET(docs doxygen)
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/Doxyfile.cmake 
new/taglib-1.7.2/Doxyfile.cmake
--- old/taglib-1.7/Doxyfile.cmake       2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/Doxyfile.cmake     2012-04-20 17:57:13.000000000 +0200
@@ -61,7 +61,7 @@
 #---------------------------------------------------------------------------
 # configuration options related to the input files
 #---------------------------------------------------------------------------
-INPUT                  = taglib
+INPUT                  = @CMAKE_SOURCE_DIR@/taglib
 FILE_PATTERNS          = *.h \
                          *.hh \
                          *.H
@@ -96,9 +96,9 @@
 GENERATE_HTML          = YES
 HTML_OUTPUT            = html
 HTML_FILE_EXTENSION    = .html
-HTML_HEADER            = doc/api-header.html
-HTML_FOOTER            = doc/api-footer.html
-HTML_STYLESHEET        = doc/taglib-api.css
+HTML_HEADER            = @CMAKE_SOURCE_DIR@/doc/api-header.html
+HTML_FOOTER            = @CMAKE_SOURCE_DIR@/doc/api-footer.html
+HTML_STYLESHEET        = @CMAKE_SOURCE_DIR@/doc/taglib-api.css
 HTML_ALIGN_MEMBERS     = YES
 GENERATE_HTMLHELP      = NO
 CHM_FILE               = 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/NEWS new/taglib-1.7.2/NEWS
--- old/taglib-1.7/NEWS 2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/NEWS       2012-04-20 17:57:13.000000000 +0200
@@ -1,3 +1,19 @@
+TagLib 1.7.2 (Apr 20, 2012)
+===========================
+
+ * Fixed division by zero while parsing corrupted MP4 files (CVE-2012-2396).
+ * Fixed compilation on Haiku.
+
+TagLib 1.7.1 (Mar 17, 2012)
+===========================
+
+ * Improved parsing of corrupted WMA, RIFF and OGG files.
+ * Fixed a memory leak in the WMA parser.
+ * Fixed a memory leak in the FLAC parser.
+ * Fixed a possible division by zero in the APE parser.
+ * Added detection of TTA2 files.
+ * Fixed saving of multiple identically named tags to Vorbis Comments.
+
 TagLib 1.7 (Mar 11, 2011)
 =========================
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/ape/apefooter.cpp 
new/taglib-1.7.2/taglib/ape/apefooter.cpp
--- old/taglib-1.7/taglib/ape/apefooter.cpp     2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/ape/apefooter.cpp   2012-04-20 17:57:13.000000000 
+0200
@@ -24,7 +24,7 @@
  *   http://www.mozilla.org/MPL/                                           *
  ***************************************************************************/
 
-#include <ostream>
+#include <iostream>
 #include <bitset>
 
 #include <tstring.h>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/ape/apeproperties.cpp 
new/taglib-1.7.2/taglib/ape/apeproperties.cpp
--- old/taglib-1.7/taglib/ape/apeproperties.cpp 2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/ape/apeproperties.cpp       2012-04-20 
17:57:13.000000000 +0200
@@ -193,7 +193,7 @@
   uint blocksPerFrame = header.mid(4, 4).toUInt(false);
   uint finalFrameBlocks = header.mid(8, 4).toUInt(false);
   uint totalBlocks = totalFrames > 0 ? (totalFrames -  1) * blocksPerFrame + 
finalFrameBlocks : 0;
-  d->length = totalBlocks / d->sampleRate;
+  d->length = d->sampleRate > 0 ? totalBlocks / d->sampleRate : 0;
   d->bitrate = d->length > 0 ? ((d->streamLength * 8L) / d->length) / 1000 : 0;
 }
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/asf/asffile.cpp 
new/taglib-1.7.2/taglib/asf/asffile.cpp
--- old/taglib-1.7/taglib/asf/asffile.cpp       2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/asf/asffile.cpp     2012-04-20 17:57:13.000000000 
+0200
@@ -141,11 +141,19 @@
 {
 public:
   List<ASF::File::BaseObject *> objects;
+  ~HeaderExtensionObject();
   ByteVector guid();
   void parse(ASF::File *file, uint size);
   ByteVector render(ASF::File *file);
 };
 
+ASF::File::HeaderExtensionObject::~HeaderExtensionObject()
+{
+  for(unsigned int i = 0; i < objects.size(); i++) {
+    delete objects[i];
+  }
+}
+
 void ASF::File::BaseObject::parse(ASF::File *file, unsigned int size)
 {
   data.clear();
@@ -319,7 +327,16 @@
   long long dataPos = 0;
   while(dataPos < dataSize) {
     ByteVector guid = file->readBlock(16);
-    long long size = file->readQWORD();
+    if(guid.size() != 16) {
+      file->setValid(false);
+      break;
+    }
+    bool ok;
+    long long size = file->readQWORD(&ok);
+    if(!ok) {
+      file->setValid(false);
+      break;
+    }
     BaseObject *obj;
     if(guid == metadataGuid) {
       obj = new MetadataObject();
@@ -389,19 +406,37 @@
   ByteVector guid = readBlock(16);
   if(guid != headerGuid) {
     debug("ASF: Not an ASF file.");
+    setValid(false);
     return;
   }
 
   d->tag = new ASF::Tag();
   d->properties = new ASF::Properties();
 
-  d->size = readQWORD();
-  int numObjects = readDWORD();
+  bool ok;
+  d->size = readQWORD(&ok);
+  if(!ok) {
+    setValid(false);
+    return;
+  }
+  int numObjects = readDWORD(&ok);
+  if(!ok) {
+    setValid(false);
+    return;
+  }
   seek(2, Current);
 
   for(int i = 0; i < numObjects; i++) {
     ByteVector guid = readBlock(16);
-    long size = (long)readQWORD();
+    if(guid.size() != 16) {
+      setValid(false);
+      break;
+    }
+    long size = (long)readQWORD(&ok);
+    if(!ok) {
+      setValid(false);
+      break;
+    }
     BaseObject *obj;
     if(guid == filePropertiesGuid) {
       obj = new FilePropertiesObject();
@@ -429,7 +464,12 @@
 bool ASF::File::save()
 {
   if(readOnly()) {
-    debug("ASF: File is read-only.");
+    debug("ASF::File::save() -- File is read only.");
+    return false;
+  }
+
+  if(!isValid()) {
+    debug("ASF::File::save() -- Trying to save invalid file.");
     return false;
   }
 
@@ -491,27 +531,47 @@
 // protected members
 
////////////////////////////////////////////////////////////////////////////////
 
-int ASF::File::readBYTE()
+int ASF::File::readBYTE(bool *ok)
 {
   ByteVector v = readBlock(1);
+  if(v.size() != 1) {
+    if(ok) *ok = false;
+    return 0;
+  }
+  if(ok) *ok = true;
   return v[0];
 }
 
-int ASF::File::readWORD()
+int ASF::File::readWORD(bool *ok)
 {
   ByteVector v = readBlock(2);
+  if(v.size() != 2) {
+    if(ok) *ok = false;
+    return 0;
+  }
+  if(ok) *ok = true;
   return v.toUShort(false);
 }
 
-unsigned int ASF::File::readDWORD()
+unsigned int ASF::File::readDWORD(bool *ok)
 {
   ByteVector v = readBlock(4);
+  if(v.size() != 4) {
+    if(ok) *ok = false;
+    return 0;
+  }
+  if(ok) *ok = true;
   return v.toUInt(false);
 }
 
-long long ASF::File::readQWORD()
+long long ASF::File::readQWORD(bool *ok)
 {
   ByteVector v = readBlock(8);
+  if(v.size() != 8) {
+    if(ok) *ok = false;
+    return 0;
+  }
+  if(ok) *ok = true;
   return v.toLongLong(false);
 }
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/asf/asffile.h 
new/taglib-1.7.2/taglib/asf/asffile.h
--- old/taglib-1.7/taglib/asf/asffile.h 2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/asf/asffile.h       2012-04-20 17:57:13.000000000 
+0200
@@ -88,10 +88,10 @@
 
     private:
 
-      int readBYTE();
-      int readWORD();
-      unsigned int readDWORD();
-      long long readQWORD();
+      int readBYTE(bool *ok = 0);
+      int readWORD(bool *ok = 0);
+      unsigned int readDWORD(bool *ok = 0);
+      long long readQWORD(bool *ok = 0);
       static ByteVector renderString(const String &str, bool includeLength = 
false);
       String readString(int len);
       void read(bool readProperties, Properties::ReadStyle propertiesStyle);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/flac/flacfile.cpp 
new/taglib-1.7.2/taglib/flac/flacfile.cpp
--- old/taglib-1.7/taglib/flac/flacfile.cpp     2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/flac/flacfile.cpp   2012-04-20 17:57:13.000000000 
+0200
@@ -149,7 +149,7 @@
 
   // Create new vorbis comments
 
-  Tag::duplicate(&d->tag, xiphComment(true), true);
+  Tag::duplicate(&d->tag, xiphComment(true), false);
 
   d->xiphCommentData = xiphComment()->render(false);
 
@@ -161,10 +161,12 @@
     MetadataBlock *block = d->blocks[i];
     if(block->code() == MetadataBlock::VorbisComment) {
       // Set the new Vorbis Comment block
+      delete block;
       block = new UnknownMetadataBlock(MetadataBlock::VorbisComment, 
d->xiphCommentData);
       foundVorbisCommentBlock = true;
     }
     if(block->code() == MetadataBlock::Padding) {
+      delete block;
       continue;
     }
     newBlocks.append(block);
@@ -190,7 +192,7 @@
   // Adjust the padding block(s)
 
   long originalLength = d->streamStart - d->flacStart;
-  int paddingLength = originalLength - data.size() - 4; 
+  int paddingLength = originalLength - data.size() - 4;
   if (paddingLength < 0) {
     paddingLength = MinPaddingLength;
   }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/mp4/mp4properties.cpp 
new/taglib-1.7.2/taglib/mp4/mp4properties.cpp
--- old/taglib-1.7/taglib/mp4/mp4properties.cpp 2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/mp4/mp4properties.cpp       2012-04-20 
17:57:13.000000000 +0200
@@ -91,15 +91,24 @@
 
   file->seek(mdhd->offset);
   data = file->readBlock(mdhd->length);
-  if(data[8] == 0) {
-    unsigned int unit = data.mid(20, 4).toUInt();
-    unsigned int length = data.mid(24, 4).toUInt();
-    d->length = length / unit;
-  }
-  else {
+  uint version = data[8];
+  if(version == 1) {
+    if (data.size() < 36 + 8) {
+      debug("MP4: Atom 'trak.mdia.mdhd' is smaller than expected");
+      return;
+    }
     long long unit = data.mid(28, 8).toLongLong();
     long long length = data.mid(36, 8).toLongLong();
-    d->length = int(length / unit);
+    d->length = unit ? int(length / unit) : 0;
+  }
+  else {
+    if (data.size() < 24 + 4) {
+      debug("MP4: Atom 'trak.mdia.mdhd' is smaller than expected");
+      return;
+    }
+    unsigned int unit = data.mid(20, 4).toUInt();
+    unsigned int length = data.mid(24, 4).toUInt();
+    d->length = unit ? length / unit : 0;
   }
 
   MP4::Atom *atom = trak->find("mdia", "minf", "stbl", "stsd");
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/mpeg/id3v2/id3v2header.cpp 
new/taglib-1.7.2/taglib/mpeg/id3v2/id3v2header.cpp
--- old/taglib-1.7/taglib/mpeg/id3v2/id3v2header.cpp    2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/mpeg/id3v2/id3v2header.cpp  2012-04-20 
17:57:13.000000000 +0200
@@ -23,7 +23,7 @@
  *   http://www.mozilla.org/MPL/                                           *
  ***************************************************************************/
 
-#include <ostream>
+#include <iostream>
 #include <bitset>
 
 #include <tstring.h>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/mpeg/id3v2/id3v2synchdata.cpp 
new/taglib-1.7.2/taglib/mpeg/id3v2/id3v2synchdata.cpp
--- old/taglib-1.7/taglib/mpeg/id3v2/id3v2synchdata.cpp 2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/mpeg/id3v2/id3v2synchdata.cpp       2012-04-20 
17:57:13.000000000 +0200
@@ -23,7 +23,7 @@
  *   http://www.mozilla.org/MPL/                                           *
  ***************************************************************************/
 
-#include <ostream>
+#include <iostream>
 
 #include "id3v2synchdata.h"
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/ogg/xiphcomment.cpp 
new/taglib-1.7.2/taglib/ogg/xiphcomment.cpp
--- old/taglib-1.7/taglib/ogg/xiphcomment.cpp   2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/ogg/xiphcomment.cpp 2012-04-20 17:57:13.000000000 
+0200
@@ -287,7 +287,7 @@
 
   int pos = 0;
 
-  int vendorLength = data.mid(0, 4).toUInt(false);
+  uint vendorLength = data.mid(0, 4).toUInt(false);
   pos += 4;
 
   d->vendorID = String(data.mid(pos, vendorLength), String::UTF8);
@@ -295,21 +295,31 @@
 
   // Next the number of fields in the comment vector.
 
-  int commentFields = data.mid(pos, 4).toUInt(false);
+  uint commentFields = data.mid(pos, 4).toUInt(false);
   pos += 4;
 
-  for(int i = 0; i < commentFields; i++) {
+  if(commentFields > (data.size() - 8) / 4) {
+    return;
+  }
+
+  for(uint i = 0; i < commentFields; i++) {
 
     // Each comment field is in the format "KEY=value" in a UTF8 string and has
     // 4 bytes before the text starts that gives the length.
 
-    int commentLength = data.mid(pos, 4).toUInt(false);
+    uint commentLength = data.mid(pos, 4).toUInt(false);
     pos += 4;
 
     String comment = String(data.mid(pos, commentLength), String::UTF8);
     pos += commentLength;
+    if(pos > data.size()) {
+      break;
+    }
 
     int commentSeparatorPosition = comment.find("=");
+    if(commentSeparatorPosition == -1) {
+      break;
+    }
 
     String key = comment.substr(0, commentSeparatorPosition);
     String value = comment.substr(commentSeparatorPosition + 1);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/riff/aiff/aifffile.cpp 
new/taglib-1.7.2/taglib/riff/aiff/aifffile.cpp
--- old/taglib-1.7/taglib/riff/aiff/aifffile.cpp        2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/riff/aiff/aifffile.cpp      2012-04-20 
17:57:13.000000000 +0200
@@ -87,6 +87,11 @@
     return false;
   }
 
+  if(!isValid()) {
+    debug("RIFF::AIFF::File::save() -- Trying to save invalid file.");
+    return false;
+  }
+
   setChunkData(d->tagChunkID, d->tag->render());
 
   return true;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/riff/aiff/aiffproperties.cpp 
new/taglib-1.7.2/taglib/riff/aiff/aiffproperties.cpp
--- old/taglib-1.7/taglib/riff/aiff/aiffproperties.cpp  2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/riff/aiff/aiffproperties.cpp        2012-04-20 
17:57:13.000000000 +0200
@@ -149,5 +149,5 @@
   double sampleRate = ConvertFromIeeeExtended(reinterpret_cast<unsigned char 
*>(data.mid(8, 10).data()));
   d->sampleRate     = sampleRate;
   d->bitrate        = (sampleRate * d->sampleWidth * d->channels) / 1000.0;
-  d->length         = sampleFrames / d->sampleRate;
+  d->length         = d->sampleRate > 0 ? sampleFrames / d->sampleRate : 0;
 }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/riff/rifffile.cpp 
new/taglib-1.7.2/taglib/riff/rifffile.cpp
--- old/taglib-1.7/taglib/riff/rifffile.cpp     2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/riff/rifffile.cpp   2012-04-20 17:57:13.000000000 
+0200
@@ -194,6 +194,19 @@
 // private members
 
////////////////////////////////////////////////////////////////////////////////
 
+static bool isValidChunkID(const ByteVector &name)
+{
+  if(name.size() != 4) {
+    return false;
+  }
+  for(int i = 0; i < 4; i++) {
+    if(name[i] < 32 || name[i] > 127) {
+      return false;
+    }
+  }
+  return true;
+}
+
 void RIFF::File::read()
 {
   bool bigEndian = (d->endianness == BigEndian);
@@ -207,8 +220,15 @@
     ByteVector chunkName = readBlock(4);
     uint chunkSize = readBlock(4).toUInt(bigEndian);
 
+    if(!isValidChunkID(chunkName)) {
+      debug("RIFF::File::read() -- Chunk '" + chunkName + "' has invalid ID");
+      setValid(false);
+      break;
+    }
+
     if(tell() + chunkSize > uint(length())) {
-      // something wrong
+      debug("RIFF::File::read() -- Chunk '" + chunkName + "' has invalid size 
(larger than the file size)");
+      setValid(false);
       break;
     }
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/riff/wav/wavfile.cpp 
new/taglib-1.7.2/taglib/riff/wav/wavfile.cpp
--- old/taglib-1.7/taglib/riff/wav/wavfile.cpp  2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/riff/wav/wavfile.cpp        2012-04-20 
17:57:13.000000000 +0200
@@ -87,6 +87,11 @@
     return false;
   }
 
+  if(!isValid()) {
+    debug("RIFF::WAV::File::save() -- Trying to save invalid file.");
+    return false;
+  }
+
   setChunkData(d->tagChunkID, d->tag->render());
 
   return true;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/toolkit/tbytevector.cpp 
new/taglib-1.7.2/taglib/toolkit/tbytevector.cpp
--- old/taglib-1.7/taglib/toolkit/tbytevector.cpp       2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/toolkit/tbytevector.cpp     2012-04-20 
17:57:13.000000000 +0200
@@ -23,7 +23,7 @@
  *   http://www.mozilla.org/MPL/                                           *
  ***************************************************************************/
 
-#include <ostream>
+#include <iostream>
 
 #include <tstring.h>
 #include <tdebug.h>
@@ -363,7 +363,7 @@
 
   ConstIterator endIt;
 
-  if(length < 0xffffffff && length + index < size())
+  if(length < size() - index)
     endIt = d->data.begin() + index + length;
   else
     endIt = d->data.end();
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/toolkit/tbytevector.h 
new/taglib-1.7.2/taglib/toolkit/tbytevector.h
--- old/taglib-1.7/taglib/toolkit/tbytevector.h 2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/toolkit/tbytevector.h       2012-04-20 
17:57:13.000000000 +0200
@@ -30,7 +30,7 @@
 #include "taglib_export.h"
 
 #include <vector>
-#include <ostream>
+#include <iostream>
 
 namespace TagLib {
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/toolkit/tstring.cpp 
new/taglib-1.7.2/taglib/toolkit/tstring.cpp
--- old/taglib-1.7/taglib/toolkit/tstring.cpp   2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/toolkit/tstring.cpp 2012-04-20 17:57:13.000000000 
+0200
@@ -27,7 +27,7 @@
 #include "unicode.h"
 #include "tdebug.h"
 
-#include <ostream>
+#include <iostream>
 
 #include <string.h>
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/toolkit/tstring.h 
new/taglib-1.7.2/taglib/toolkit/tstring.h
--- old/taglib-1.7/taglib/toolkit/tstring.h     2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/toolkit/tstring.h   2012-04-20 17:57:13.000000000 
+0200
@@ -31,7 +31,7 @@
 #include "tbytevector.h"
 
 #include <string>
-#include <ostream>
+#include <iostream>
 
 /*!
  * \relates TagLib::String
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/toolkit/tstringlist.h 
new/taglib-1.7.2/taglib/toolkit/tstringlist.h
--- old/taglib-1.7/taglib/toolkit/tstringlist.h 2011-03-11 14:15:38.000000000 
+0100
+++ new/taglib-1.7.2/taglib/toolkit/tstringlist.h       2012-04-20 
17:57:13.000000000 +0200
@@ -31,7 +31,7 @@
 #include "tbytevectorlist.h"
 #include "taglib_export.h"
 
-#include <ostream>
+#include <iostream>
 
 namespace TagLib {
 
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/taglib/trueaudio/trueaudioproperties.cpp 
new/taglib-1.7.2/taglib/trueaudio/trueaudioproperties.cpp
--- old/taglib-1.7/taglib/trueaudio/trueaudioproperties.cpp     2011-03-11 
14:15:38.000000000 +0100
+++ new/taglib-1.7.2/taglib/trueaudio/trueaudioproperties.cpp   2012-04-20 
17:57:13.000000000 +0200
@@ -118,19 +118,26 @@
   int pos = 3;
 
   d->version = d->data[pos] - '0';
-  pos += 1 + 2;
+  pos += 1;
 
-  d->channels = d->data.mid(pos, 2).toShort(false);
-  pos += 2;
+  // According to 
http://en.true-audio.com/TTA_Lossless_Audio_Codec_-_Format_Description
+  // TTA2 headers are in development, and have a different format
+  if(1 == d->version) {
+    // Skip the audio format
+    pos += 2;
 
-  d->bitsPerSample = d->data.mid(pos, 2).toShort(false);
-  pos += 2;
+    d->channels = d->data.mid(pos, 2).toShort(false);
+    pos += 2;
 
-  d->sampleRate = d->data.mid(pos, 4).toUInt(false);
-  pos += 4;
+    d->bitsPerSample = d->data.mid(pos, 2).toShort(false);
+    pos += 2;
 
-  unsigned long samples = d->data.mid(pos, 4).toUInt(false);
-  d->length = samples / d->sampleRate;
+    d->sampleRate = d->data.mid(pos, 4).toUInt(false);
+    pos += 4;
 
-  d->bitrate = d->length > 0 ? ((d->streamLength * 8L) / d->length) / 1000 : 0;
+    uint sampleFrames = d->data.mid(pos, 4).toUInt(false);
+    d->length = d->sampleRate > 0 ? sampleFrames / d->sampleRate : 0;
+
+    d->bitrate = d->length > 0 ? ((d->streamLength * 8L) / d->length) / 1000 : 
0;
+  }
 }
Files old/taglib-1.7/tests/data/zero-size-chunk.wav and 
new/taglib-1.7.2/tests/data/zero-size-chunk.wav differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/tests/test_flac.cpp 
new/taglib-1.7.2/tests/test_flac.cpp
--- old/taglib-1.7/tests/test_flac.cpp  2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/tests/test_flac.cpp        2012-04-20 17:57:13.000000000 
+0200
@@ -5,6 +5,7 @@
 #include <tstringlist.h>
 #include <tbytevectorlist.h>
 #include <flacfile.h>
+#include <xiphcomment.h>
 #include "utils.h"
 
 using namespace std;
@@ -20,6 +21,7 @@
   CPPUNIT_TEST(testReplacePicture);
   CPPUNIT_TEST(testRemoveAllPictures);
   CPPUNIT_TEST(testRepeatedSave);
+  CPPUNIT_TEST(testSaveMultipleValues);
   CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -186,6 +188,26 @@
     CPPUNIT_ASSERT_EQUAL(String("NEW TITLE 2"), tag->title());
   }
 
+  void testSaveMultipleValues()
+  {
+    ScopedFileCopy copy("silence-44-s", ".flac", false);
+    string newname = copy.fileName();
+
+    FLAC::File *f = new FLAC::File(newname.c_str());
+    Ogg::XiphComment* c = f->xiphComment(true);
+    c->addField("ARTIST", "artist 1", true);
+    c->addField("ARTIST", "artist 2", false);
+    f->save();
+    delete f;
+
+    f = new FLAC::File(newname.c_str());
+    c = f->xiphComment(true);
+    Ogg::FieldListMap m = c->fieldListMap();
+    CPPUNIT_ASSERT_EQUAL(TagLib::uint(2), m["ARTIST"].size());
+    CPPUNIT_ASSERT_EQUAL(String("artist 1"), m["ARTIST"][0]);
+    CPPUNIT_ASSERT_EQUAL(String("artist 2"), m["ARTIST"][1]);
+  }
+
 };
 
 CPPUNIT_TEST_SUITE_REGISTRATION(TestFLAC);
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' 
'--exclude=.svnignore' old/taglib-1.7/tests/test_wav.cpp 
new/taglib-1.7.2/tests/test_wav.cpp
--- old/taglib-1.7/tests/test_wav.cpp   2011-03-11 14:15:38.000000000 +0100
+++ new/taglib-1.7.2/tests/test_wav.cpp 2012-04-20 17:57:13.000000000 +0200
@@ -13,6 +13,7 @@
 {
   CPPUNIT_TEST_SUITE(TestWAV);
   CPPUNIT_TEST(testLength);
+  CPPUNIT_TEST(testZeroSizeDataChunk);
   CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -20,9 +21,16 @@
   void testLength()
   {
     RIFF::WAV::File f("data/empty.wav");
+    CPPUNIT_ASSERT_EQUAL(true, f.isValid());
     CPPUNIT_ASSERT_EQUAL(3, f.audioProperties()->length());
   }
 
+  void testZeroSizeDataChunk()
+  {
+    RIFF::WAV::File f("data/zero-size-chunk.wav");
+    CPPUNIT_ASSERT_EQUAL(false, f.isValid());
+  }
+
 };
 
 CPPUNIT_TEST_SUITE_REGISTRATION(TestWAV);

-- 
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to