summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndreas Sturmlechner <asturm@gentoo.org>2018-10-03 22:48:42 +0200
committerAndreas Sturmlechner <asturm@gentoo.org>2018-10-03 23:11:27 +0200
commita877b25c4d29e1e60df8af384725e83c093fa734 (patch)
treea3e36cf8afb82bb767dea905e9d3f93f980343b2
parentmedia-libs/libmp4v2: EAPI-7 bump, fix tag corruption (diff)
downloadgentoo-a877b25c4d29e1e60df8af384725e83c093fa734.tar.gz
gentoo-a877b25c4d29e1e60df8af384725e83c093fa734.tar.bz2
gentoo-a877b25c4d29e1e60df8af384725e83c093fa734.zip
media-libs/libmad: Fix vulnerabilities, EAPI-7 bump
Debian does it, so let's use it too. Bug: https://bugs.gentoo.org/618022 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> Package-Manager: Portage-2.3.50, Repoman-2.3.11
-rw-r--r--media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch197
-rw-r--r--media-libs/libmad/libmad-0.15.1b-r9.ebuild80
2 files changed, 277 insertions, 0 deletions
diff --git a/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch b/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch
new file mode 100644
index 00000000000..9cc8913e159
--- /dev/null
+++ b/media-libs/libmad/files/libmad-0.15.1b-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch
@@ -0,0 +1,197 @@
+; You can calculate where the next frame will start depending on things
+; like the bitrate. See mad_header_decode(). It seems that when decoding
+; the frame you can go past that boundary. This attempts to catch those cases,
+; but might not catch all of them.
+; For more info see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508133
+Index: libmad-0.15.1b/layer12.c
+===================================================================
+--- a/layer12.c 2008-12-23 21:38:07.000000000 +0100
++++ b/layer12.c 2008-12-23 21:38:12.000000000 +0100
+@@ -134,6 +134,12 @@
+ for (sb = 0; sb < bound; ++sb) {
+ for (ch = 0; ch < nch; ++ch) {
+ nb = mad_bit_read(&stream->ptr, 4);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ if (nb == 15) {
+ stream->error = MAD_ERROR_BADBITALLOC;
+@@ -146,6 +152,12 @@
+
+ for (sb = bound; sb < 32; ++sb) {
+ nb = mad_bit_read(&stream->ptr, 4);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ if (nb == 15) {
+ stream->error = MAD_ERROR_BADBITALLOC;
+@@ -162,6 +174,12 @@
+ for (ch = 0; ch < nch; ++ch) {
+ if (allocation[ch][sb]) {
+ scalefactor[ch][sb] = mad_bit_read(&stream->ptr, 6);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ # if defined(OPT_STRICT)
+ /*
+@@ -187,6 +205,12 @@
+ frame->sbsample[ch][s][sb] = nb ?
+ mad_f_mul(I_sample(&stream->ptr, nb),
+ sf_table[scalefactor[ch][sb]]) : 0;
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+ }
+ }
+
+@@ -195,6 +219,12 @@
+ mad_fixed_t sample;
+
+ sample = I_sample(&stream->ptr, nb);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ for (ch = 0; ch < nch; ++ch) {
+ frame->sbsample[ch][s][sb] =
+@@ -403,7 +433,15 @@
+ nbal = bitalloc_table[offsets[sb]].nbal;
+
+ for (ch = 0; ch < nch; ++ch)
++ {
+ allocation[ch][sb] = mad_bit_read(&stream->ptr, nbal);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
++ }
+ }
+
+ for (sb = bound; sb < sblimit; ++sb) {
+@@ -411,6 +449,13 @@
+
+ allocation[0][sb] =
+ allocation[1][sb] = mad_bit_read(&stream->ptr, nbal);
++
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+ }
+
+ /* decode scalefactor selection info */
+@@ -419,6 +464,12 @@
+ for (ch = 0; ch < nch; ++ch) {
+ if (allocation[ch][sb])
+ scfsi[ch][sb] = mad_bit_read(&stream->ptr, 2);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+ }
+ }
+
+@@ -442,6 +493,12 @@
+ for (ch = 0; ch < nch; ++ch) {
+ if (allocation[ch][sb]) {
+ scalefactor[ch][sb][0] = mad_bit_read(&stream->ptr, 6);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ switch (scfsi[ch][sb]) {
+ case 2:
+@@ -452,11 +509,23 @@
+
+ case 0:
+ scalefactor[ch][sb][1] = mad_bit_read(&stream->ptr, 6);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+ /* fall through */
+
+ case 1:
+ case 3:
+ scalefactor[ch][sb][2] = mad_bit_read(&stream->ptr, 6);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+ }
+
+ if (scfsi[ch][sb] & 1)
+@@ -488,6 +557,12 @@
+ index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+
+ II_samples(&stream->ptr, &qc_table[index], samples);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ for (s = 0; s < 3; ++s) {
+ frame->sbsample[ch][3 * gr + s][sb] =
+@@ -506,6 +581,12 @@
+ index = offset_table[bitalloc_table[offsets[sb]].offset][index - 1];
+
+ II_samples(&stream->ptr, &qc_table[index], samples);
++ if (mad_bit_nextbyte(&stream->ptr) > stream->next_frame)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ for (ch = 0; ch < nch; ++ch) {
+ for (s = 0; s < 3; ++s) {
+Index: libmad-0.15.1b/layer3.c
+===================================================================
+--- a/layer3.c 2008-12-23 21:38:07.000000000 +0100
++++ b/layer3.c 2008-12-23 21:38:12.000000000 +0100
+@@ -2608,6 +2608,12 @@
+ next_md_begin = 0;
+
+ md_len = si.main_data_begin + frame_space - next_md_begin;
++ if (md_len + MAD_BUFFER_GUARD > MAD_BUFFER_MDLEN)
++ {
++ stream->error = MAD_ERROR_LOSTSYNC;
++ stream->sync = 0;
++ return -1;
++ }
+
+ frame_used = 0;
+
diff --git a/media-libs/libmad/libmad-0.15.1b-r9.ebuild b/media-libs/libmad/libmad-0.15.1b-r9.ebuild
new file mode 100644
index 00000000000..2740db06857
--- /dev/null
+++ b/media-libs/libmad/libmad-0.15.1b-r9.ebuild
@@ -0,0 +1,80 @@
+# Copyright 1999-2018 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+
+inherit autotools flag-o-matic multilib-minimal
+
+DESCRIPTION="\"M\"peg \"A\"udio \"D\"ecoder library"
+HOMEPAGE="http://mad.sourceforge.net"
+SRC_URI="mirror://sourceforge/mad/${P}.tar.gz"
+
+LICENSE="GPL-2"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~ppc-aix ~amd64-fbsd ~x86-fbsd ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x86-solaris"
+IUSE="debug static-libs"
+
+DEPEND=""
+RDEPEND=""
+
+DOCS=( CHANGES CREDITS README TODO VERSION )
+
+MULTILIB_WRAPPED_HEADERS=(
+ /usr/include/mad.h
+)
+
+PATCHES=(
+ "${FILESDIR}"/${P}-cflags.patch
+ "${FILESDIR}"/${P}-cflags-O2.patch
+ "${FILESDIR}"/${P}-gcc44-mips-h-constraint-removal.patch
+ "${FILESDIR}"/${P}-CVE-2017-8372_CVE-2017-8373_CVE-2017-8374.patch
+)
+
+src_prepare() {
+ default
+
+ # bug 467002
+ sed -e 's/AM_CONFIG_HEADER/AC_CONFIG_HEADERS/' -i configure.ac || die
+
+ eautoreconf
+}
+
+multilib_src_configure() {
+ # --enable-speed optimize for speed over accuracy
+ # --enable-accuracy optimize for accuracy over speed
+ # --enable-experimental enable code using the EXPERIMENTAL
+ # preprocessor define
+ local myconf=(
+ --enable-accuracy
+ $(use_enable debug debugging)
+ $(use_enable static-libs static)
+ )
+
+ # Fix for b0rked sound on sparc64 (maybe also sparc32?)
+ # default/approx is also possible, uses less cpu but sounds worse
+ use sparc && myconf+=( --enable-fpm=64bit )
+
+ [[ $(tc-arch) == "amd64" ]] && myconf+=( --enable-fpm=64bit )
+ [[ $(tc-arch) == "x86" ]] && myconf+=( --enable-fpm=intel )
+ [[ $(tc-arch) == "ppc" ]] && myconf+=( --enable-fpm=default )
+ [[ $(tc-arch) == "ppc64" ]] && myconf+=( --enable-fpm=64bit )
+
+ ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_install() {
+ emake DESTDIR="${D}" install
+
+ # This file must be updated with each version update
+ insinto /usr/$(get_libdir)/pkgconfig
+ doins "${FILESDIR}"/mad.pc
+
+ # Use correct libdir in pkgconfig file
+ sed -e "s:^libdir.*:libdir=${EPREFIX}/usr/$(get_libdir):" \
+ -i "${ED}"/usr/$(get_libdir)/pkgconfig/mad.pc
+}
+
+multilib_src_install_all() {
+ einstalldocs
+ find "${D}" -name '*.la' -delete || die
+}