diff options
Diffstat (limited to 'meta/recipes-support/taglib')
-rw-r--r-- | meta/recipes-support/taglib/taglib/CVE-2017-12678.patch | 40 | ||||
-rw-r--r-- | meta/recipes-support/taglib/taglib/CVE-2018-11439.patch | 51 | ||||
-rw-r--r-- | meta/recipes-support/taglib/taglib_2.0.1.bb (renamed from meta/recipes-support/taglib/taglib_1.11.1.bb) | 20 |
3 files changed, 9 insertions, 102 deletions
diff --git a/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch b/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch deleted file mode 100644 index 4bd9f2be17..0000000000 --- a/meta/recipes-support/taglib/taglib/CVE-2017-12678.patch +++ /dev/null | |||
@@ -1,40 +0,0 @@ | |||
1 | From eb9ded1206f18f2c319157337edea2533a40bea6 Mon Sep 17 00:00:00 2001 | ||
2 | From: "Stephen F. Booth" <me@sbooth.org> | ||
3 | Date: Sun, 23 Jul 2017 10:11:09 -0400 | ||
4 | Subject: [PATCH] Don't assume TDRC is an instance of TextIdentificationFrame | ||
5 | |||
6 | If TDRC is encrypted, FrameFactory::createFrame() returns UnknownFrame | ||
7 | which causes problems in rebuildAggregateFrames() when it is assumed | ||
8 | that TDRC is a TextIdentificationFrame | ||
9 | |||
10 | Upstream-Status: Backport | ||
11 | [https://github.com/taglib/taglib/pull/831/commits/eb9ded1206f18f2c319157337edea2533a40bea6] | ||
12 | |||
13 | CVE: CVE-2017-12678 | ||
14 | |||
15 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
16 | --- | ||
17 | taglib/mpeg/id3v2/id3v2framefactory.cpp | 5 +++-- | ||
18 | 1 file changed, 3 insertions(+), 2 deletions(-) | ||
19 | |||
20 | diff --git a/taglib/mpeg/id3v2/id3v2framefactory.cpp b/taglib/mpeg/id3v2/id3v2framefactory.cpp | ||
21 | index 759a9b7b..9347ab86 100644 | ||
22 | --- a/taglib/mpeg/id3v2/id3v2framefactory.cpp | ||
23 | +++ b/taglib/mpeg/id3v2/id3v2framefactory.cpp | ||
24 | @@ -334,10 +334,11 @@ void FrameFactory::rebuildAggregateFrames(ID3v2::Tag *tag) const | ||
25 | tag->frameList("TDAT").size() == 1) | ||
26 | { | ||
27 | TextIdentificationFrame *tdrc = | ||
28 | - static_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front()); | ||
29 | + dynamic_cast<TextIdentificationFrame *>(tag->frameList("TDRC").front()); | ||
30 | UnknownFrame *tdat = static_cast<UnknownFrame *>(tag->frameList("TDAT").front()); | ||
31 | |||
32 | - if(tdrc->fieldList().size() == 1 && | ||
33 | + if(tdrc && | ||
34 | + tdrc->fieldList().size() == 1 && | ||
35 | tdrc->fieldList().front().size() == 4 && | ||
36 | tdat->data().size() >= 5) | ||
37 | { | ||
38 | -- | ||
39 | 2.13.5 | ||
40 | |||
diff --git a/meta/recipes-support/taglib/taglib/CVE-2018-11439.patch b/meta/recipes-support/taglib/taglib/CVE-2018-11439.patch deleted file mode 100644 index cdd66e67f7..0000000000 --- a/meta/recipes-support/taglib/taglib/CVE-2018-11439.patch +++ /dev/null | |||
@@ -1,51 +0,0 @@ | |||
1 | From 272648ccfcccae30e002ccf34a22e075dd477278 Mon Sep 17 00:00:00 2001 | ||
2 | From: Scott Gayou <github.scott@gmail.com> | ||
3 | Date: Mon, 4 Jun 2018 11:34:36 -0400 | ||
4 | Subject: [PATCH] Fixed OOB read when loading invalid ogg flac file. (#868) | ||
5 | |||
6 | This CVE is caused by a failure to check the minimum length | ||
7 | of a ogg flac header. This header is detailed in full at: | ||
8 | https://xiph.org/flac/ogg_mapping.html. Added more strict checking | ||
9 | for entire header. | ||
10 | |||
11 | Upstream-Status: Backport | ||
12 | [https://github.com/taglib/taglib/pull/869/commits/272648ccfcccae30e002ccf34a22e075dd477278] | ||
13 | |||
14 | CVE: CVE-2018-11439 | ||
15 | |||
16 | Signed-off-by: Yi Zhao <yi.zhao@windriver.com> | ||
17 | --- | ||
18 | taglib/ogg/flac/oggflacfile.cpp | 14 ++++++++++++-- | ||
19 | 1 file changed, 12 insertions(+), 2 deletions(-) | ||
20 | |||
21 | diff --git a/taglib/ogg/flac/oggflacfile.cpp b/taglib/ogg/flac/oggflacfile.cpp | ||
22 | index 53d0450..07ea9dc 100644 | ||
23 | --- a/taglib/ogg/flac/oggflacfile.cpp | ||
24 | +++ b/taglib/ogg/flac/oggflacfile.cpp | ||
25 | @@ -231,11 +231,21 @@ void Ogg::FLAC::File::scan() | ||
26 | |||
27 | if(!metadataHeader.startsWith("fLaC")) { | ||
28 | // FLAC 1.1.2+ | ||
29 | + // See https://xiph.org/flac/ogg_mapping.html for the header specification. | ||
30 | + if(metadataHeader.size() < 13) | ||
31 | + return; | ||
32 | + | ||
33 | + if(metadataHeader[0] != 0x7f) | ||
34 | + return; | ||
35 | + | ||
36 | if(metadataHeader.mid(1, 4) != "FLAC") | ||
37 | return; | ||
38 | |||
39 | - if(metadataHeader[5] != 1) | ||
40 | - return; // not version 1 | ||
41 | + if(metadataHeader[5] != 1 && metadataHeader[6] != 0) | ||
42 | + return; // not version 1.0 | ||
43 | + | ||
44 | + if(metadataHeader.mid(9, 4) != "fLaC") | ||
45 | + return; | ||
46 | |||
47 | metadataHeader = metadataHeader.mid(13); | ||
48 | } | ||
49 | -- | ||
50 | 2.7.4 | ||
51 | |||
diff --git a/meta/recipes-support/taglib/taglib_1.11.1.bb b/meta/recipes-support/taglib/taglib_2.0.1.bb index f4e288295d..14f99aabbc 100644 --- a/meta/recipes-support/taglib/taglib_1.11.1.bb +++ b/meta/recipes-support/taglib/taglib_2.0.1.bb | |||
@@ -1,29 +1,27 @@ | |||
1 | SUMMARY = "Library for reading and editing the meta-data of popular audio formats" | 1 | SUMMARY = "Library for reading and editing the meta-data of popular audio formats" |
2 | DESCRIPTION = "Platform-independent library (tested on Windows/Linux) for reading and writing metadata in media files, including video, audio, and photo formats. This is a convenient one-stop-shop to present or tag all your media collection, regardless of which format/container these might use. You can read/write the standard or more common tags/properties of a media, or you can also create and retrieve your own custom tags." | ||
2 | SECTION = "libs/multimedia" | 3 | SECTION = "libs/multimedia" |
3 | HOMEPAGE = "http://taglib.github.io/" | 4 | HOMEPAGE = "http://taglib.github.io/" |
4 | LICENSE = "LGPLv2.1 | MPL-1.1" | 5 | LICENSE = "LGPL-2.1-only | MPL-1.1" |
5 | LIC_FILES_CHKSUM = "file://COPYING.LGPL;md5=4fbd65380cdd255951079008b364516c \ | 6 | LIC_FILES_CHKSUM = "file://COPYING.LGPL;md5=4fbd65380cdd255951079008b364516c \ |
6 | file://COPYING.MPL;md5=bfe1f75d606912a4111c90743d6c7325 \ | 7 | file://COPYING.MPL;md5=bfe1f75d606912a4111c90743d6c7325 \ |
7 | file://taglib/audioproperties.h;beginline=1;endline=24;md5=9df2c7399519b7310568a7c55042ecee" | 8 | file://taglib/audioproperties.h;beginline=1;endline=24;md5=9df2c7399519b7310568a7c55042ecee" |
8 | 9 | ||
9 | DEPENDS = "zlib" | 10 | DEPENDS = "zlib utfcpp" |
10 | 11 | ||
11 | SRC_URI = "http://taglib.github.io/releases/${BP}.tar.gz \ | 12 | SRC_URI = "http://taglib.github.io/releases/${BP}.tar.gz" |
12 | file://CVE-2017-12678.patch \ | ||
13 | file://CVE-2018-11439.patch \ | ||
14 | " | ||
15 | 13 | ||
16 | SRC_URI[md5sum] = "cee7be0ccfc892fa433d6c837df9522a" | 14 | SRC_URI[sha256sum] = "08c0a27b96aa5c4e23060fe0b6f93102ee9091a9385257b9d0ddcf467de0d925" |
17 | SRC_URI[sha256sum] = "b6d1a5a610aae6ff39d93de5efd0fdc787aa9e9dc1e7026fa4c961b26563526b" | ||
18 | 15 | ||
19 | UPSTREAM_CHECK_URI = "http://github.com/taglib/taglib/releases/" | 16 | UPSTREAM_CHECK_URI = "https://taglib.org/" |
17 | UPSTREAM_CHECK_REGEX = "taglib-(?P<pver>\d+(\.\d+)+)\.tar" | ||
20 | 18 | ||
21 | BINCONFIG = "${bindir}/taglib-config" | 19 | BINCONFIG = "${bindir}/taglib-config" |
22 | 20 | ||
23 | inherit cmake pkgconfig binconfig-disabled | 21 | inherit cmake pkgconfig binconfig-disabled |
24 | 22 | ||
25 | PACKAGES =+ "${PN}-c" | 23 | PACKAGES =+ "${PN}-c" |
26 | FILES_${PN}-c = "${libdir}/libtag_c.so.*" | 24 | FILES:${PN}-c = "${libdir}/libtag_c.so.*" |
27 | 25 | ||
28 | EXTRA_OECMAKE = "-DBUILD_SHARED_LIBS=ON \ | 26 | EXTRA_OECMAKE = "-DBUILD_SHARED_LIBS=ON \ |
29 | -DCMAKE_DISABLE_FIND_PACKAGE_Boost=TRUE \ | 27 | -DCMAKE_DISABLE_FIND_PACKAGE_Boost=TRUE \ |
@@ -34,7 +32,7 @@ EXTRA_OECMAKE = "-DBUILD_SHARED_LIBS=ON \ | |||
34 | " | 32 | " |
35 | CXXFLAGS += "-std=c++11" | 33 | CXXFLAGS += "-std=c++11" |
36 | 34 | ||
37 | do_configure_prepend () { | 35 | do_configure:prepend () { |
38 | rm -f ${S}/admin/ltmain.sh | 36 | rm -f ${S}/admin/ltmain.sh |
39 | rm -f ${S}/admin/libtool.m4.in | 37 | rm -f ${S}/admin/libtool.m4.in |
40 | } | 38 | } |