Mirror of git.yoctoproject.org/poky https://git.enea.com/cgit/linux/poky.git/atom?h=master 2022-02-25T12:41:24+00:00 2022-02-25T12:41:24+00:00 Alexandru Ardelean ardeleanalex@gmail.com 2022-02-24T15:30:33+00:00 urn:sha1:fd2c86b06963345683ac5dc4f47f9da8e0c8c69d It seems that the homepage has moved (for a while now) from http://www.mega-nerd.com/libsndfile/ to https://libsndfile.github.io/libsndfile/ On Github, the development group seems to include Erik de Castro Lopo (the original author of libsndfile1). Link: https://github.com/orgs/libsndfile/people All backported CVE patches are in version 1.0.31 (I've checked). The supported format page [1], mentions that Ogg/Opus is supported since 1.0.29, however that isn't currently added in this patch. And it may require libopus. And mp3 is supported at around version 1.1.0, but that version is in beta. This change focuses solely on updating to 1.0.31 and removing all backported patches. [1] https://libsndfile.github.io/libsndfile/formats.html (From OE-Core rev: 6e12ee5f7871150c11dac754145d146ed364b506) Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> 2017-08-18T22:46:38+00:00 Jackie Huang jackie.huang@windriver.com 2017-08-17T06:44:29+00:00 urn:sha1:3577a8277e151b00e63825f9154f19e91496bbaf Backport the patch to fix CVE-2017-8363: The flac_buffer_copy function in flac.c in libsndfile 1.0.28 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-8363 (From OE-Core rev: 9cc9956c5ed09f9016cb23bd763652e5ab55f3cd) Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>