From owner-freebsd-multimedia@FreeBSD.ORG Wed May 20 12:10:01 2009 Return-Path: Delivered-To: multimedia@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 70D211065AB5; Wed, 20 May 2009 12:10:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 3DC6D8FC08; Wed, 20 May 2009 12:10:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n4KCA1QC043804; Wed, 20 May 2009 12:10:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n4KCA1Ck043803; Wed, 20 May 2009 12:10:01 GMT (envelope-from gnats) Resent-Date: Wed, 20 May 2009 12:10:01 GMT Resent-Message-Id: <200905201210.n4KCA1Ck043803@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@freebsd.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Cc: multimedia@freebsd.org, ed@freebsd.org Resent-Reply-To: FreeBSD-gnats-submit@freebsd.org, Eygene Ryabinkin Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 8F06910656B2 for ; Wed, 20 May 2009 12:01:15 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from 0.mx.codelabs.ru (0.mx.codelabs.ru [144.206.177.45]) by mx1.freebsd.org (Postfix) with ESMTP id 43E7C8FC13 for ; Wed, 20 May 2009 12:01:15 +0000 (UTC) (envelope-from rea-fbsd@codelabs.ru) Received: from void.codelabs.ru (void.codelabs.ru [144.206.177.25]) by 0.mx.codelabs.ru with esmtps (TLSv1:CAMELLIA256-SHA:256) id 1M6kTy-000MsV-4q for FreeBSD-gnats-submit@freebsd.org; Wed, 20 May 2009 16:01:14 +0400 Message-Id: <20090520120114.140F7DA81E@void.codelabs.ru> Date: Wed, 20 May 2009 16:01:14 +0400 (MSD) From: Eygene Ryabinkin To: FreeBSD-gnats-submit@freebsd.org X-Send-Pr-Version: 3.113 X-GNATS-Notify: multimedia@freebsd.org, ed@freebsd.org Cc: Subject: ports/134751: [patch][vuxml] audio/libsndfile: upgrade to 1.0.20 and fix VOC/AIFF parsers overflows X-BeenThere: freebsd-multimedia@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: Eygene Ryabinkin List-Id: Multimedia discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 May 2009 12:10:12 -0000 >Number: 134751 >Category: ports >Synopsis: [patch][vuxml] audio/libsndfile: upgrade to 1.0.20 and fix VOC/AIFF parsers overflows >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed May 20 12:10:00 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 7.2-STABLE amd64 >Organization: Code Labs >Environment: System: FreeBSD 7.2-STABLE amd64 >Description: Tobias Klein found heap overflow in the VOC parser of libsndfile: [1], [2]. Libsndfile developers reported on the fixed heap overflow in the AIFF parser: [2]. >How-To-Repeat: [1] http://www.trapkit.de/advisories/TKADV2009-006.txt [2] http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/rel_20.html >Fix: The following patch updates the port to 1.0.20. I had verified that port builds fine and resulted sndfile-convert works fine. --- upgrade-to-1.0.20.diff begins here --- >From 0c044a85a2c0b69236015e0deaef3b7e5eca3e9a Mon Sep 17 00:00:00 2001 From: Eygene Ryabinkin Date: Wed, 20 May 2009 15:54:21 +0400 ...and fix VOC and AIFF parsers heap overflows. Signed-off-by: Eygene Ryabinkin --- audio/libsndfile/Makefile | 4 ++-- audio/libsndfile/distinfo | 6 +++--- audio/libsndfile/pkg-plist | 1 - 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/audio/libsndfile/Makefile b/audio/libsndfile/Makefile index bfb6ae8..8f64c1e 100644 --- a/audio/libsndfile/Makefile +++ b/audio/libsndfile/Makefile @@ -6,7 +6,7 @@ # PORTNAME= libsndfile -PORTVERSION= 1.0.19 +PORTVERSION= 1.0.20 CATEGORIES= audio MASTER_SITES= http://www.mega-nerd.com/libsndfile/ @@ -43,7 +43,7 @@ post-patch: post-install: .if !defined(NOPORTDOCS) @${MKDIR} ${DOCSDIR} -.for file in AUTHORS ChangeLog NEWS README TODO +.for file in AUTHORS ChangeLog NEWS README ${INSTALL_DATA} ${WRKSRC}/${file} ${DOCSDIR} .endfor ${TAR} -C ${WRKSRC}/doc --exclude "*Makefile*" --exclude "*.in" \ diff --git a/audio/libsndfile/distinfo b/audio/libsndfile/distinfo index 5e9e5a5..63e5c5e 100644 --- a/audio/libsndfile/distinfo +++ b/audio/libsndfile/distinfo @@ -1,3 +1,3 @@ -MD5 (libsndfile-1.0.19.tar.gz) = 8fa24b0c0a8758543427c9741ea06924 -SHA256 (libsndfile-1.0.19.tar.gz) = 4b567a02e15bcae25fa1aeb3361b4e2cb8b2ce08e9b53faa81f77a34fb2b5419 -SIZE (libsndfile-1.0.19.tar.gz) = 924368 +MD5 (libsndfile-1.0.20.tar.gz) = e0553e12c7a467af44693e95e2eac668 +SHA256 (libsndfile-1.0.20.tar.gz) = 7517eb966579f8814b5efe307cb919c5b4e7b5c6729209ba1da95f31e8368dc7 +SIZE (libsndfile-1.0.20.tar.gz) = 927422 diff --git a/audio/libsndfile/pkg-plist b/audio/libsndfile/pkg-plist index 8c0270a..e8d63f3 100644 --- a/audio/libsndfile/pkg-plist +++ b/audio/libsndfile/pkg-plist @@ -18,7 +18,6 @@ libdata/pkgconfig/sndfile.pc %%PORTDOCS%%%%DOCSDIR%%/FAQ.html %%PORTDOCS%%%%DOCSDIR%%/NEWS %%PORTDOCS%%%%DOCSDIR%%/README -%%PORTDOCS%%%%DOCSDIR%%/TODO %%PORTDOCS%%%%DOCSDIR%%/api.html %%PORTDOCS%%%%DOCSDIR%%/bugs.html %%PORTDOCS%%%%DOCSDIR%%/command.html -- 1.6.3.1 --- upgrade-to-1.0.20.diff ends here --- The following VuXML entry should be evaluated and added: --- vuln.xml begins here --- libsndfile -- heap overflows in VOC and AIFF parsers 1.0.20

Tobias Klein reports:

libsndfile contains a heap buffer overflow vulnerability while parsing malformed VOC (Creative Voice) media files. The vulnerability may be exploited by a (remote) attacker to execute arbitrary code in the context of an application using the libsndfile library.

Additionally, libsndfile developers report on the unspecified buffer overflow in the AIFF parser.

 34978 http://secunia.com/advisories/35076/ http://www.trapkit.de/advisories/TKADV2009-006.txt http://www.mega-nerd.com/erikd/Blog/CodeHacking/libsndfile/rel_20.html 2009-05-20 TODAY --- vuln.xml ends here --- >Release-Note: >Audit-Trail: >Unformatted: