summaryrefslogtreecommitdiffstats
path: root/meta/recipes-multimedia/libsndfile/libsndfile1
Commit message (Collapse)AuthorAgeFilesLines
* libsndfile1: fix CVE-2019-3832Ross Burton2019-03-261-0/+37
| | | | | | | | | | The previous fix for CVE-2018-19758 wasn't complete, so backport another patch to solve it properly. (From OE-Core rev: aeaca9bb1b1c8bf44818945dc4b2cbd6d4b5cef2) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: update security patchesRoss Burton2019-03-065-141/+158
| | | | | | | | | | | | | | | | | Remove CVE-2017-14245-14246.patch, fix rejected upstream as it doesn't solve the underlying issue. Instead 0001-a-ulaw-fix-multiple-buffer-overflows-432 also solves CVE-2017-14245 and CVE-2017-14246 properly. Add patches for CVE-2017-12562 and CVE-2018-19758. Refresh CVE-2018-13139.patch. (From OE-Core rev: a5625df8031985e9c60c34068a4a01c36da40eec) Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Security fix CVE-2018-19432Changqing Li2019-02-251-0/+115
| | | | | | | | (From OE-Core rev: 6f010c9b7777aae5ce2108122d0c6d3b1d630a21) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Security fix CVE-2017-17456/17457 CVE-2018-19661/19662Changqing Li2019-01-081-0/+101
| | | | | | | | | | fix 4 CVEs, which is backport from https://github.com/erikd/libsndfile/commit/585cc28a93be27d6938f276af0011401b9f7c0ca (From OE-Core rev: 8f4af329df5373db8910726a6b954652623003dd) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: CVE-2018-13139Changqing Li2018-10-101-0/+35
| | | | | | | | | | | A stack-based buffer overflow in psf_memset in common.c in libsndfile 1.0.28. Fixed in https://github.com/erikd/libsndfile/issues/397 (From OE-Core rev: 6b5a9078a7c5035590ee4dc2e23582da94d4a104) Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: CVE-2017-14634Jagadeesh Krishnanjanappa2018-08-231-0/+42
| | | | | | | | | | | | | | | | | | | | | | | | double64_init: Check psf->sf.channels against upper bound This prevents division by zero later in the code. While the trivial case to catch this (i.e. sf.channels < 1) has already been covered, a crafted file may report a number of channels that is so high (i.e. > INT_MAX/sizeof(double)) that it "somehow" gets miscalculated to zero (if this makes sense) in the determination of the blockwidth. Since we only support a limited number of channels anyway, make sure to check here as well. CVE-2017-14634 Closes: #318 Affects libsndfile1 = 1.0.28 (From OE-Core rev: eee93149a49274dc3deed7d89754ee4bda240575) Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: CVE-2017-14245 CVE-2017-14246Jagadeesh Krishnanjanappa2018-08-231-0/+121
| | | | | | | | | | | | | | | | | | | sfe_copy_data_fp: check value of "max" variable for being normal and check elements of the data[] array for being finite. Both checks use functions provided by the <math.h> header as declared by the C99 standard. Fixes #317 CVE-2017-14245 CVE-2017-14246 Affects libsndfile1 = 1.0.28 (From OE-Core rev: ad842a3a0e6ef78fb9449362753ae3592c775192) Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Fix CVE-2017-8363Jackie Huang2017-08-181-0/+37
| | | | | | | | | | | | | | | | Backport the patch to fix CVE-2017-8363: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8363 (From OE-Core rev: 9cc9956c5ed09f9016cb23bd763652e5ab55f3cd) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Fix CVE-2017-8362Jackie Huang2017-08-181-0/+59
| | | | | | | | | | | | | | | | Backport the patch to fix CVE-2017-8362: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8362 (From OE-Core rev: 0c8da3f6f85962196f2ad54fffd839239f5c2274) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Fix CVE-2017-8361 and CVE-2017-8365Jackie Huang2017-08-181-0/+73
| | | | | | | | | | | | | | | | | | | | | | | | Backport the patch to fix two CVEs: CVE-2017-8361: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. CVE-2017-8365: The i2les_array function in pcm.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8361 https://nvd.nist.gov/vuln/detail/CVE-2017-8365 (From OE-Core rev: d92877ade8fd4dd9b548c6b664bf4357a1f9428a) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: Fix CVE-2017-6892Fan Xin2017-06-281-0/+34
| | | | | | | | | | | | Backport upstream patch to fix CVE-2017-6892. CVE: CVE-2017-6892 (From OE-Core rev: cc9b8d0afe64b83f585843f3aff1c077f69fd656) Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile1: upgrade to version 1.0.24Dongxiao Xu2011-04-282-44/+0
| | | | | | | (From OE-Core rev: 71794b266e3fcd9661f57a4ba70abc87e74b7326) Signed-off-by: Dongxiao Xu <dongxiao.xu@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libsndfile: Upgrade to 1.0.23Saul Wold2010-11-182-0/+44
Renamed and moved to recipes-multimedia Signed-off-by: Saul Wold <Saul.Wold@intel.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-06-16 03:53:12 +0000