CaROS/poky
3
1
Fork 0
mirror of https://git.yoctoproject.org/git/poky synced 2026-01-04 16:10:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

libsndfile1: fix CVE-2021-4156

Browse Source 
(From OE-Core rev: 6566b64a55079aab8fa9b252e919a158bc595615)

Signed-off-by: Changqing Li <changqing.li@windriver.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
Changqing Li 2022-01-13 17:00:52 +08:00 committed by Richard Purdie
parent f1f159e1e5
commit f31a661847
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
meta/recipes-multimedia/libsndfile/libsndfile1/CVE-2021-4156.patch Normal file
View File

@ -0,0 +1,32 @@
From 5adbc377cd90aa40f0cd56ae325ca70065a8aa19 Mon Sep 17 00:00:00 2001
From: Changqing Li <changqing.li@windriver.com>
Date: Thu, 13 Jan 2022 16:45:59 +0800
Subject: [PATCH] flac: Fix improper buffer reusing
CVE: CVE-2021-4156.patch
Upstream-Status: Backport [https://github.com/libsndfile/libsndfile/issues/731]
Signed-off-by: Changqing Li <changqing.li@windriver.com>
---
src/flac.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/flac.c b/src/flac.c
index 0be82ac..6548bba 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -952,7 +952,11 @@ flac_read_loop (SF_PRIVATE *psf, unsigned len)
/* Decode some more. */
while (pflac->pos < pflac->len)
{ if (FLAC__stream_decoder_process_single (pflac->fsd) == 0)
+ { psf_log_printf (psf, "FLAC__stream_decoder_process_single returned false\n") ;
+ /* Current frame is busted, so NULL the pointer. */
+ pflac->frame = NULL ;
break ;
+ }
state = FLAC__stream_decoder_get_state (pflac->fsd) ;
if (state >= FLAC__STREAM_DECODER_END_OF_STREAM)
{ psf_log_printf (psf, "FLAC__stream_decoder_get_state returned %s\n", FLAC__StreamDecoderStateString [state]) ;
--
2.17.1

1
meta/recipes-multimedia/libsndfile/libsndfile1_1.0.28.bb
View File

@ -20,6 +20,7 @@ SRC_URI = "http://www.mega-nerd.com/libsndfile/files/libsndfile-${PV}.tar.gz \
file://CVE-2017-12562.patch \
file://CVE-2018-19758.patch \
file://CVE-2019-3832.patch \
file://CVE-2021-4156.patch \
"
SRC_URI[md5sum] = "646b5f98ce89ac60cdb060fcd398247c"