[gentoo-commits] repo/gentoo:master commit in: media-libs/libvorbis/files/, media-libs/libvorbis/

[gentoo-commits] repo/gentoo:master commit in: media-libs/libvorbis/files/, media-libs/libvorbis/

[Thomas Deutschmann]

commit:     733260c31ddf36bc2450e9675eddc93329ab171d
Author:     Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
AuthorDate: Tue Dec  3 00:25:04 2019 +0000
Commit:     Thomas Deutschmann <whissi <AT> gentoo <DOT> org>
CommitDate: Tue Dec  3 00:25:19 2019 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=733260c3

media-libs/libvorbis: security bump

Bug: https://bugs.gentoo.org/631646
Bug: https://bugs.gentoo.org/699862
Package-Manager: Portage-2.3.80, Repoman-2.3.19
Signed-off-by: Thomas Deutschmann <whissi <AT> gentoo.org>

 .../files/libvorbis-1.3.6-CVE-2017-14160.patch     | 29 +++++++++++
 .../files/libvorbis-1.3.6-CVE-2018-10392.patch     | 25 +++++++++
 media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild     | 60 ++++++++++++++++++++++
 3 files changed, 114 insertions(+)

diff --git a/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch
new file mode 100644
index 00000000000..7759e2eb2a6
--- /dev/null
+++ b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2017-14160.patch
@@ -0,0 +1,29 @@
+This is also the patch for CVE-2018-10393.
+
+From 018ca26dece618457dd13585cad52941193c4a25 Mon Sep 17 00:00:00 2001
+From: Thomas Daede <daede003@umn.edu>
+Date: Wed, 9 May 2018 14:56:59 -0700
+Subject: [PATCH] CVE-2017-14160: fix bounds check on very low sample rates.
+
+---
+ lib/psy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/lib/psy.c b/lib/psy.c
+index 422c6f1..1310123 100644
+--- a/lib/psy.c
++++ b/lib/psy.c
+@@ -602,8 +602,9 @@ static void bark_noise_hybridmp(int n,const long *b,
+   for (i = 0, x = 0.f;; i++, x += 1.f) {
+ 
+     lo = b[i] >> 16;
+-    if( lo>=0 ) break;
+     hi = b[i] & 0xffff;
++    if( lo>=0 ) break;
++    if( hi>=n ) break;
+ 
+     tN = N[hi] + N[-lo];
+     tX = X[hi] - X[-lo];
+-- 
+2.22.0
+

diff --git a/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch
new file mode 100644
index 00000000000..a12038a9423
--- /dev/null
+++ b/media-libs/libvorbis/files/libvorbis-1.3.6-CVE-2018-10392.patch
@@ -0,0 +1,25 @@
+From 112d3bd0aaacad51305e1464d4b381dabad0e88b Mon Sep 17 00:00:00 2001
+From: Thomas Daede <daede003@umn.edu>
+Date: Thu, 17 May 2018 16:19:19 -0700
+Subject: [PATCH] Sanity check number of channels in setup.
+
+Fixes #2335.
+---
+ lib/vorbisenc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/lib/vorbisenc.c b/lib/vorbisenc.c
+index 4fc7b62..64a51b5 100644
+--- a/lib/vorbisenc.c
++++ b/lib/vorbisenc.c
+@@ -684,6 +684,7 @@ int vorbis_encode_setup_init(vorbis_info *vi){
+   highlevel_encode_setup *hi=&ci->hi;
+ 
+   if(ci==NULL)return(OV_EINVAL);
++  if(vi->channels<1||vi->channels>255)return(OV_EINVAL);
+   if(!hi->impulse_block_p)i0=1;
+ 
+   /* too low/high an ATH floater is nonsensical, but doesn't break anything */
+-- 
+2.22.0
+

diff --git a/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild b/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild
new file mode 100644
index 00000000000..92f52227407
--- /dev/null
+++ b/media-libs/libvorbis/libvorbis-1.3.6-r1.ebuild
@@ -0,0 +1,60 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit autotools multilib-minimal
+
+DESCRIPTION="The Ogg Vorbis sound file format library"
+HOMEPAGE="https://xiph.org/vorbis/"
+SRC_URI="https://downloads.xiph.org/releases/vorbis/${P}.tar.xz"
+
+LICENSE="BSD"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sh ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris"
+IUSE="static-libs test"
+
+RESTRICT="!test? ( test )"
+
+BDEPEND="virtual/pkgconfig"
+
+RDEPEND=">=media-libs/libogg-1.3.0[${MULTILIB_USEDEP}]"
+
+DEPEND="${RDEPEND}"
+
+PATCHES=(
+	"${FILESDIR}"/${P}-CVE-2017-14160.patch
+	"${FILESDIR}"/${P}-CVE-2018-10392.patch
+)
+
+src_prepare() {
+	default
+
+	sed -i \
+		-e '/CFLAGS/s:-O20::' \
+		-e '/CFLAGS/s:-mcpu=750::' \
+		-e '/CFLAGS/s:-mno-ieee-fp::' \
+		configure.ac || die
+
+	# Un-hack docdir redefinition.
+	find -name 'Makefile.am' \
+		-exec sed -i \
+			-e 's:$(datadir)/doc/$(PACKAGE)-$(VERSION):@docdir@/html:' \
+			{} + || die
+
+	eautoreconf
+}
+
+multilib_src_configure() {
+	local myconf=(
+		--enable-shared
+		$(use_enable static-libs static)
+		$(use_enable test oggtest)
+	)
+
+	einfo "Running configure in ${BUILD_DIR}"
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_install_all() {
+	find "${ED}" -name '*.la' -delete || die
+}

[gentoo-commits] repo/gentoo:master commit in: media-libs/libvorbis/files/, media-libs/libvorbis/

[Sam James]

commit:     265a9a1fd14588b70e669e1ee5407d766618a321
Author:     Sam James <sam <AT> gentoo <DOT> org>
AuthorDate: Wed Nov 23 03:29:38 2022 +0000
Commit:     Sam James <sam <AT> gentoo <DOT> org>
CommitDate: Wed Nov 23 03:29:38 2022 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=265a9a1f

media-libs/libvorbis: EAPI 8, fix -Wstrict-prototypes in configure

We may well have people proactively trying to use it and it's cheap to fix & build.

Signed-off-by: Sam James <sam <AT> gentoo.org>

 .../libvorbis-1.3.7-macro-wstrict-prototypes.patch   | 20 ++++++++++++++++++++
 ...vorbis-1.3.7.ebuild => libvorbis-1.3.7-r1.ebuild} | 10 ++++++----
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/media-libs/libvorbis/files/libvorbis-1.3.7-macro-wstrict-prototypes.patch b/media-libs/libvorbis/files/libvorbis-1.3.7-macro-wstrict-prototypes.patch
new file mode 100644
index 000000000000..24e163d5adf8
--- /dev/null
+++ b/media-libs/libvorbis/files/libvorbis-1.3.7-macro-wstrict-prototypes.patch
@@ -0,0 +1,20 @@
+https://gitlab.xiph.org/xiph/vorbis/-/merge_requests/25
+
+From 63132c52ee4694171f663ecf536ab1236b6c46ba Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Wed, 23 Nov 2022 03:27:44 +0000
+Subject: [PATCH] vorbis.m4: fix -Wstrict-prototypes
+
+Signed-off-by: Sam James <sam@gentoo.org>
+--- a/vorbis.m4
++++ b/vorbis.m4
+@@ -67,7 +67,7 @@ dnl
+ #include <vorbis/codec.h>
+ #include <vorbis/vorbisenc.h>
+ 
+-int main ()
++int main (void)
+ {
+     vorbis_block 	vb;
+     vorbis_dsp_state	vd;
+GitLab

diff --git a/media-libs/libvorbis/libvorbis-1.3.7.ebuild b/media-libs/libvorbis/libvorbis-1.3.7-r1.ebuild
similarity index 94%
rename from media-libs/libvorbis/libvorbis-1.3.7.ebuild
rename to media-libs/libvorbis/libvorbis-1.3.7-r1.ebuild
index 9b1d80665e32..f90fe66fd547 100644
--- a/media-libs/libvorbis/libvorbis-1.3.7.ebuild
+++ b/media-libs/libvorbis/libvorbis-1.3.7-r1.ebuild
@@ -1,7 +1,8 @@
 # Copyright 1999-2022 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
+
 inherit autotools multilib-minimal
 
 DESCRIPTION="The Ogg Vorbis sound file format library"
@@ -16,11 +17,13 @@ IUSE="static-libs test"
 RESTRICT="!test? ( test )"
 
 BDEPEND="virtual/pkgconfig"
-
 RDEPEND=">=media-libs/libogg-1.3.0[${MULTILIB_USEDEP}]"
-
 DEPEND="${RDEPEND}"
 
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.3.7-macro-wstrict-prototypes.patch
+)
+
 src_prepare() {
 	default
 
@@ -46,7 +49,6 @@ multilib_src_configure() {
 		$(use_enable test oggtest)
 	)
 
-	einfo "Running configure in ${BUILD_DIR}"
 	ECONF_SOURCE="${S}" econf "${myconf[@]}"
 }