Skip to contentSkip to conversation

libvorbis: security bump to version 1.3.6

PATCH New Peter Korsgaard 1 participant 3 messages Mar 16, 2018 – Apr 6, 2018

lore
Share & tools
lore

Peter Korsgaard

author
#0 lore raw

PATCH 1/1 libvorbis: security bump to version 1.3.6

Fixes CVE-2018-5146: Prevent out-of-bounds write in codebook decoding.

Drop 0001-CVE-2017-14633-Don-t-allow-for-more-than-256-channel.patch and 0002-CVE-2017-14632-vorbis_analysis_header_out-Don-t-clea.patch as they are now upstream, and add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>
---
 ...633-Don-t-allow-for-more-than-256-channel.patch | 36 --------------
 ...632-vorbis_analysis_header_out-Don-t-clea.patch | 56 ----------------------
 package/libvorbis/libvorbis.hash                   |  4 +-
 package/libvorbis/libvorbis.mk                     |  2 +-
 4 files changed, 4 insertions(+), 94 deletions(-)
 delete mode 100644 package/libvorbis/0001-CVE-2017-14633-Don-t-allow-for-more-than-256-channel.patch
 delete mode 100644 package/libvorbis/0002-CVE-2017-14632-vorbis_analysis_header_out-Don-t-clea.patch
package/libvorbis/0001-CVE-2017-14633-Don-t-allow-for-more-than-256-channel.patch deleted +0 -36
deleted file mode 100644
index 416aa66ddf..0000000000
@@ -1,36 +0,0 @@
-From a79ec216cd119069c68b8f3542c6a425a74ab993 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Guido=20G=C3=BCnther?= <[email protected]>
-Date: Tue, 31 Oct 2017 18:32:46 +0100
-Subject: [PATCH] CVE-2017-14633: Don't allow for more than 256 channels
-
-Otherwise
-
- for(i=0;i<vi->channels;i++){
-      /* the encoder setup assumes that all the modes used by any
-         specific bitrate tweaking use the same floor */
-      int submap=info->chmuxlist[i];
-
-overreads later in mapping0_forward since chmuxlist is a fixed array of
-256 elements max.
-
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- lib/info.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/info.c b/lib/info.c
-index fe759ed..7bc4ea4 100644
---- a/lib/info.c
-+++ b/lib/info.c
-@@ -588,7 +588,7 @@ int vorbis_analysis_headerout(vorbis_dsp_state *v,
-   oggpack_buffer opb;
-   private_state *b=v->backend_state;
- 
--  if(!b||vi->channels<=0){
-+  if(!b||vi->channels<=0||vi->channels>256){
-     ret=OV_EFAULT;
-     goto err_out;
-   }
--- 
-2.11.0
-
package/libvorbis/0002-CVE-2017-14632-vorbis_analysis_header_out-Don-t-clea.patch deleted +0 -56

56 lines not on this page · raw message

package/libvorbis/libvorbis.hash +3 -1
index e990f4d74f..15bd01f22a 100644
@@ -1,2 +1,4 @@
 # From http://www.xiph.org/downloads/
-sha256 54f94a9527ff0a88477be0a71c0bab09a4c3febe0ed878b24824906cd4b0e1d1 libvorbis-1.3.5.tar.xz
+sha256 af00bb5a784e7c9e69f56823de4637c350643deedaf333d0fa86ecdba6fcb415 libvorbis-1.3.6.tar.xz
+# License files, locally calculated
+sha256 29e9914e6173b7061b7d48c25e6159fc1438326738bc047cc7248abc01b271f6  COPYING
package/libvorbis/libvorbis.mk +1 -1
index 98ec97bfd6..ae2c1efffe 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBVORBIS_VERSION = 1.3.5
+LIBVORBIS_VERSION = 1.3.6
 LIBVORBIS_SOURCE = libvorbis-$(LIBVORBIS_VERSION).tar.xz
 LIBVORBIS_SITE = http://downloads.xiph.org/releases/vorbis
 LIBVORBIS_INSTALL_STAGING = YES
Signature · 1 line
2.11.0
author
#1 lore raw

PATCH 1/1 libvorbis: security bump to version 1.3.6

Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2018-5146: Prevent out-of-bounds write in codebook decoding. Drop 0001-CVE-2017-14633-Don-t-allow-for-more-than-256-channel.patch and 0002-CVE-2017-14632-vorbis_analysis_header_out-Don-t-clea.patch as they are now upstream, and add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

Committed, thanks.

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 libvorbis: security bump to version 1.3.6

In reply to Peter Korsgaard
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Korsgaard <[email protected]> writes:

Fixes CVE-2018-5146: Prevent out-of-bounds write in codebook decoding. Drop 0001-CVE-2017-14633-Don-t-allow-for-more-than-256-channel.patch and 0002-CVE-2017-14632-vorbis_analysis_header_out-Don-t-clea.patch as they are now upstream, and add a hash for the license file while we're at it.

Signed-off-by Peter Korsgaard <[email protected]>

Committed to 2018.02.x, thanks.

Signature · 1 line
Bye, Peter Korsgaard