Hello community,

here is the log from the commit of package vorbis-tools for openSUSE:Factory 
checked in at 2015-10-03 20:29:14
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/vorbis-tools (Old)
 and      /work/SRC/openSUSE:Factory/.vorbis-tools.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Package is "vorbis-tools"

Changes:
--------
--- /work/SRC/openSUSE:Factory/vorbis-tools/vorbis-tools.changes        
2015-03-16 06:55:26.000000000 +0100
+++ /work/SRC/openSUSE:Factory/.vorbis-tools.new/vorbis-tools.changes   
2015-10-03 20:29:37.000000000 +0200
@@ -1,0 +2,6 @@
+Thu Sep 24 17:46:49 CEST 2015 - ti...@suse.de
+
+- Fix buffer overflow in aiff_open() (CVE-2015-6749, bsc#943795):
+  oggenc-Fix-large-alloca-on-bad-AIFF-input.patch
+
+-------------------------------------------------------------------

New:
----
  oggenc-Fix-large-alloca-on-bad-AIFF-input.patch

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Other differences:
------------------
++++++ vorbis-tools.spec ++++++
--- /var/tmp/diff_new_pack.IGXrE7/_old  2015-10-03 20:29:37.000000000 +0200
+++ /var/tmp/diff_new_pack.IGXrE7/_new  2015-10-03 20:29:37.000000000 +0200
@@ -34,6 +34,8 @@
 Patch3:         vorbis-tools-r19117-CVE-2014-9640.patch
 # PATCH-FIX-SUSE vorbis-tools-oggenc-CVE-2014-9639.patch bnc#914439 bnc#914441 
CVE-2014-9638 CVE-2014-9639
 Patch4:         vorbis-tools-oggenc-CVE-2014-9639.patch
+# PATCH-FIX-SUSE oggenc-Fix-large-alloca-on-bad-AIFF-input.patch bsc#943795 
CVE-2015-6749
+Patch5:         oggenc-Fix-large-alloca-on-bad-AIFF-input.patch
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 
 BuildRequires:  flac-devel
@@ -77,6 +79,7 @@
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
+%patch5 -p1
 # automake 1.13 deprecated AM_CONFIG_HEADER
 sed -i 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' configure.ac
 

++++++ oggenc-Fix-large-alloca-on-bad-AIFF-input.patch ++++++
>From 04815d3e1bfae3a6cdfb2c25358a5a72b61299f7 Mon Sep 17 00:00:00 2001
From: Mark Harris <mark....@gmail.com>
Date: Sun, 30 Aug 2015 05:54:46 -0700
Subject: [PATCH] oggenc: Fix large alloca on bad AIFF input

Fixes #2212
---
 oggenc/audio.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/oggenc/audio.c b/oggenc/audio.c
index 477da8c..4921fb9 100644
--- a/oggenc/audio.c
+++ b/oggenc/audio.c
@@ -245,8 +245,8 @@ static int aiff_permute_matrix[6][6] =
 int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char *buf, int buflen)
 {
     int aifc; /* AIFC or AIFF? */
-    unsigned int len;
-    unsigned char *buffer;
+    unsigned int len, readlen;
+    unsigned char buffer[22];
     unsigned char buf2[8];
     aiff_fmt format;
     aifffile *aiff = malloc(sizeof(aifffile));
@@ -269,9 +269,9 @@ int aiff_open(FILE *in, oe_enc_opt *opt, unsigned char 
*buf, int buflen)
         return 0; /* Weird common chunk */
     }
 
-    buffer = alloca(len);
-
-    if(fread(buffer,1,len,in) < len)
+    readlen = len < sizeof(buffer) ? len : sizeof(buffer);
+    if(fread(buffer,1,readlen,in) < readlen ||
+       (len > readlen && !seek_forward(in, len-readlen)))
     {
         fprintf(stderr, _("Warning: Unexpected EOF in reading AIFF header\n"));
         return 0;
-- 
2.5.0


Reply via email to