Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446

https://nvd.nist.gov/vuln/detail/CVE-2018-14403
  https://nvd.nist.gov/vuln/detail/CVE-2018-14379
  https://nvd.nist.gov/vuln/detail/CVE-2018-14326
  https://nvd.nist.gov/vuln/detail/CVE-2018-14325
  https://nvd.nist.gov/vuln/detail/CVE-2018-14054
  based on https://github.com/TechSmith/mp4v2/pull/27
  and https://github.com/sergiomb2/libmp4v2/
Update spec

0001-Fix-make-dist.patch

@@ -1,7 +1,7 @@
 From 60e346211e53257d2fd0b39d4b89ce60c9053409 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
 Date: Wed, 7 Oct 2015 03:59:59 +0100
-Subject: [PATCH 1/4] Fix make dist.
+Subject: [PATCH 01/10] Fix make dist.
 
 Makes fail because make doc fails .
 for more information please see :
@@ -276,5 +276,5 @@ index 9087853..e3b27dd 100644
 +@COMMANDinstall{}
  @end example
 -- 
-2.7.4
+2.21.0
 

0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch

@@ -1,12 +1,12 @@
 From fc65e21b1fe12cb3d51a8bc8152efbebedabbd6f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
 Date: Wed, 7 Oct 2015 04:25:20 +0100
-Subject: [PATCH 2/4] Install man/man3/, BTW like in libmp4v2-1.5.0.1
+Subject: [PATCH 02/10] Install man/man3/, BTW like in libmp4v2-1.5.0.1
 
 And fix 30 annoying warnings "target x given more than once in the same
 rule"
 ---
- GNUmakefile.am     | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ GNUmakefile.am     | 73 ++++++++++++++++++++++++++++++++++++++++++++++
  doc/GNUmakefile.mk |  2 +-
  2 files changed, 74 insertions(+), 1 deletion(-)
 
@@ -108,5 +108,5 @@ index dadb234..1e6188e 100644
  DOC.texi.includes = \
      doc/texi/base/project.texi \
 -- 
-2.7.4
+2.21.0
 

0003-Fix-out-of-tree-builds-182.patch

@@ -1,12 +1,12 @@
 From d7de4350e9fb40c296798f2d0b5197aa760dd417 Mon Sep 17 00:00:00 2001
 From: Sam Thursfield <ssssam@gmail.com>
 Date: Mon, 6 Feb 2017 06:23:19 +0100
-Subject: [PATCH 3/4] Fix out-of-tree builds (#182)
+Subject: [PATCH 03/10] Fix out-of-tree builds (#182)
 
 Building with srcdir!=builddir was failing with a "no rule to create
 doc/MP4.3" error.
 ---
- GNUmakefile.am | 144 ++++++++++++++++++++++++++++-----------------------------
+ GNUmakefile.am | 144 ++++++++++++++++++++++++-------------------------
  1 file changed, 72 insertions(+), 72 deletions(-)
 
 diff --git a/GNUmakefile.am b/GNUmakefile.am
@@ -165,5 +165,5 @@ index ea45d75..4b30ee6 100644
  endif
  
 -- 
-2.7.4
+2.21.0
 

0004-Fix-GCC7-build.patch

@@ -1,7 +1,7 @@
 From 855e9674232808ff3be7191b697dfb56917db21f Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
 Date: Wed, 8 Feb 2017 00:56:32 +0000
-Subject: [PATCH 4/4] Fix GCC7 build
+Subject: [PATCH 04/10] Fix GCC7 build
 
 if (*pSlash != '\0') {
 
@@ -26,5 +26,5 @@ index e07309d..1eb01f5 100644
                          *ppEncodingParams = (char *)MP4Calloc(length + 1);
                          strncpy(*ppEncodingParams, pSlash, length);
 -- 
-2.7.4
+2.21.0
 

0005-Fix-clang-compilation.patch

@@ -0,0 +1,39 @@
+From edc4f0ad8f37bb8aeae4e3ea34766dc6cdbb2f15 Mon Sep 17 00:00:00 2001
+From: David Carlos Manuelda <StormByte@gmail.com>
+Date: Tue, 7 Aug 2018 05:42:28 +0200
+Subject: [PATCH 05/10] Fix clang compilation
+
+---
+ src/mp4.cpp   | 2 +-
+ src/mp4util.h | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/mp4.cpp b/src/mp4.cpp
+index 1016f79..d576103 100644
+--- a/src/mp4.cpp
++++ b/src/mp4.cpp
+@@ -896,7 +896,7 @@ MP4FileHandle MP4ReadProvider( const char* fileName, const MP4FileProvider* file
+         }
+ 
+         catch (...) {
+-            return MP4_INVALID_TRACK_ID;
++            return (mp4v2_ismacrypParams *)MP4_INVALID_TRACK_ID;
+         }
+     }
+ 
+diff --git a/src/mp4util.h b/src/mp4util.h
+index 1fbbd81..b33bb44 100644
+--- a/src/mp4util.h
++++ b/src/mp4util.h
+@@ -33,7 +33,7 @@ namespace mp4v2 { namespace impl {
+ #ifndef ASSERT
+ #   define ASSERT(expr) \
+         if (!(expr)) { \
+-            throw new Exception("assert failure: "LIBMPV42_STRINGIFY((expr)), __FILE__, __LINE__, __FUNCTION__ ); \
++            throw new Exception("assert failure: " LIBMPV42_STRINGIFY((expr)), __FILE__, __LINE__, __FUNCTION__ ); \
+         }
+ #endif
+ 
+-- 
+2.21.0
+

0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch

@@ -0,0 +1,28 @@
+From a94a3372c6ef66a2276cc6cd92f7ec07a9c8bb6b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
+Date: Wed, 17 Oct 2018 16:13:06 +0100
+Subject: [PATCH 07/10] Fix Out-of-bounds memory access in MP4v2 2.0.0
+
+The bug can be fixed by more checks when doing type comparison.
+Reference: https://www.openwall.com/lists/oss-security/2018/07/18/3
+
+Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14403
+---
+ src/mp4util.cpp | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/mp4util.cpp b/src/mp4util.cpp
+index 47bd74e..696dab4 100644
+--- a/src/mp4util.cpp
++++ b/src/mp4util.cpp
+@@ -46,6 +46,7 @@ bool MP4NameFirstMatches(const char* s1, const char* s2)
+         s1++;
+         s2++;
+     }
++    if(*s2 != '[' && *s2 != '.' && *s2 != '\0') return false;
+     return true;
+ }
+ 
+-- 
+2.21.0
+

0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch

@@ -0,0 +1,33 @@
+From bb920de948c85e3db4a52292ac7250a50e3bfc86 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
+Date: Sat, 2 Nov 2019 04:19:27 +0000
+Subject: [PATCH 08/10] Fix v2 Type confusion in MP4v2 2.0.0
+
+The bug is caused by the wrong assumption that the child of an `ilst`
+can never be an `ilst`. So we could fix it by simply adding an ASSERT.
+
+Reference: https://www.openwall.com/lists/oss-security/2018/07/17/1
+Addresses: https://nvd.nist.gov/vuln/detail/CVE-2018-14379
+---
+ src/mp4atom.cpp | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/src/mp4atom.cpp b/src/mp4atom.cpp
+index 520cbc8..7a0a53f 100644
+--- a/src/mp4atom.cpp
++++ b/src/mp4atom.cpp
+@@ -778,8 +778,10 @@ MP4Atom::factory( MP4File &file, MP4Atom* parent, const char* type )
+         const char* const ptype = parent->GetType();
+ 
+         if( descendsFrom( parent, "ilst" )) {
+-            if( ATOMID( ptype ) == ATOMID( "ilst" ))
++            if( ATOMID( ptype ) == ATOMID( "ilst" )) {
++                ASSERT(ATOMID( type ) != ATOMID( "ilst" ));
+                 return new MP4ItemAtom( file, type );
++            }
+ 
+             if( ATOMID( type ) == ATOMID( "data" ))
+                 return new MP4DataAtom(file);
+-- 
+2.21.0
+

0009-Null-out-pointer-after-free-to-prevent-double-free.patch

@@ -0,0 +1,35 @@
+From 3410bc66fb91f46325ab1d008b6a421dd8240949 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
+Date: Sat, 2 Nov 2019 04:21:17 +0000
+Subject: [PATCH 09/10] Null out pointer after free to prevent double free
+
+If an exception occurs (because of a crafted MP4) before the value is reassigned, then a double free can occur.  By setting the pointer to NULL after the first free, we prevent the double free in this case.
+Addresses: https://nvd.nist.gov/vuln/detail/CVE-2018-14054
+
+copied form https://github.com/TechSmith/mp4v2/commit/f09cceeee5bd7f783fd31f10e8b3c440ccf4c743
+From: Dave O'Rourke
+Date: Wed, 20 Mar 2019 08:57:29 -0400
+---
+ src/mp4property.cpp | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/mp4property.cpp b/src/mp4property.cpp
+index 9a5b1e3..1b8e1d2 100644
+--- a/src/mp4property.cpp
++++ b/src/mp4property.cpp
+@@ -391,8 +391,10 @@ void MP4StringProperty::Read( MP4File& file, uint32_t index )
+         char*& value = m_values[i];
+ 
+         // Generally a default atom setting, e.g. see atom_avc1.cpp, "JVT/AVC Coding"; we'll leak this string if
+-        // we don't free.  Note that MP4Free checks for null.
+-        MP4Free(value); 
++        // we don't free.  Note that this code checks for null before calling free and sets the pointer to null
++        // after freeing it, to prevent a double free in case an exception occurs before the value is reassigned.
++        MP4Free( value );
++        value = NULL;
+ 
+         if( m_useCountedFormat ) {
+             value = file.ReadCountedString( (m_useUnicode ? 2 : 1), m_useExpandedCount, m_fixedLength );
+-- 
+2.21.0
+

0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch

@@ -0,0 +1,59 @@
+From f5f814801ecd312a1418e2226dadfea72badec49 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
+Date: Sat, 2 Nov 2019 04:37:15 +0000
+Subject: [PATCH 10/10] Fix v2 Integer underflow/overflow in MP4v2 2.0.0
+
+Reference: https://www.openwall.com/lists/oss-security/2018/07/16/1
+
+For the overflow, we could check the result of the integer multiplication:
+
+Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14326 and https://nvd.nist.gov/vuln/detail/CVE-2018-14446
+
+For the underflow, we could check if `dataSize >= hdrSize` satisfies:
+Throw exception when invalid atom size would cause integer underflow
+The calculation `hdrSize - dataSize` can underflow the 64-bit unsigned int dataSize type, which can lead to incorrect results.  We throw an exception to stop the code from going any further.
+
+Addresses https://nvd.nist.gov/vuln/detail/CVE-2018-14325
+Based on https://github.com/TechSmith/mp4v2/commit/e475013c6ef78093055a02b0d035eda0f9f01451
+---
+ src/mp4array.h  | 5 ++++-
+ src/mp4atom.cpp | 6 ++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/mp4array.h b/src/mp4array.h
+index c49d59b..340d74d 100644
+--- a/src/mp4array.h
++++ b/src/mp4array.h
+@@ -102,8 +102,11 @@ protected:
+         void Resize(MP4ArrayIndex newSize) { \
+             m_numElements = newSize; \
+             m_maxNumElements = newSize; \
++            uint32_t mul = newSize * sizeof(type); \
++            if(mul / newSize != sizeof(type)) \
++                throw new Exception("multiplication overflow", __FILE__, __LINE__, __FUNCTION__);\
+             m_elements = (type*)MP4Realloc(m_elements, \
+-                m_maxNumElements * sizeof(type)); \
++                mul); \
+         } \
+         \
+         type& operator[](MP4ArrayIndex index) { \
+diff --git a/src/mp4atom.cpp b/src/mp4atom.cpp
+index 7a0a53f..f5d5dc0 100644
+--- a/src/mp4atom.cpp
++++ b/src/mp4atom.cpp
+@@ -143,6 +143,12 @@ MP4Atom* MP4Atom::ReadAtom(MP4File& file, MP4Atom* pParentAtom)
+         dataSize = file.GetSize() - pos;
+     }
+ 
++    if(dataSize < hdrSize) {
++        ostringstream oss;
++        oss << "Invalid atom size in '" << type << "' atom, dataSize = " << dataSize << " cannot be less than hdrSize = " << static_cast<unsigned>( hdrSize );
++        log.errorf( "%s: \"%s\": %s", __FUNCTION__, file.GetFilename().c_str(), oss.str().c_str() );
++        throw new Exception( oss.str().c_str(), __FILE__, __LINE__, __FUNCTION__ );
++    }
+     dataSize -= hdrSize;
+ 
+     log.verbose1f("\"%s\": type = \"%s\" data-size = %" PRIu64 " (0x%" PRIx64 ") hdr %u",
+-- 
+2.21.0
+

libmp4v2.spec

@@ -4,7 +4,7 @@
 Summary: Library for working with files using the mp4 container format
 Name: libmp4v2
 Version: 2.1.0
-Release: 0.17%{gver}%{?dist}
+Release: 0.18%{gver}%{?dist}
 License: MPLv1.1
 URL: http://code.google.com/p/mp4v2
 # mp4v2-trunk-r507.tar.bz2 made with ./make-svn-snapshot.sh
@@ -16,6 +16,11 @@ Patch1: 0001-Fix-make-dist.patch
 Patch2: 0002-Install-man-man3-BTW-like-in-libmp4v2-1.5.0.1.patch
 Patch3: 0003-Fix-out-of-tree-builds-182.patch
 Patch4: 0004-Fix-GCC7-build.patch
+Patch5: 0005-Fix-clang-compilation.patch
+Patch7: 0007-Fix-Out-of-bounds-memory-access-in-MP4v2-2.0.0.patch
+Patch8: 0008-Fix-v2-Type-confusion-in-MP4v2-2.0.0.patch
+Patch9: 0009-Null-out-pointer-after-free-to-prevent-double-free.patch
+Patch10:0010-Fix-v2-Integer-underflow-overflow-in-MP4v2-2.0.0.patch
 
 BuildRequires: gcc-c++
 BuildRequires: autoconf automake gettext-devel libtool texinfo svn
@@ -38,23 +43,19 @@ using the libmp4v2 library.
 
 
 %prep
-%setup -q -n mp4v2-trunk
-%patch1 -p1 -b .doc
-%patch2 -p1 -b .doc2
-%patch3 -p1 -b .doc3
-%patch4 -p1 -b .gcc7
+%autosetup -p1 -n mp4v2-trunk
 
 %build
 autoreconf --force --install --verbose
 %configure --disable-static
-%{__make} %{?_smp_mflags}
+%make_build
 %{__make} txt
 export LANG=en_US.utf8
 %{__make} api
 
 
 %install
-%{__make} install DESTDIR=%{buildroot}
+%make_install
 find %{buildroot} -name '*.la' -delete
 
 %ldconfig_scriptlets
@@ -75,6 +76,17 @@ find %{buildroot} -name '*.la' -delete
 
 
 %changelog
+* Sat Nov 02 2019 Sérgio Basto <sergio@serjux.com> - 2.1.0-0.18.trunkREV507
+- Fix https://nvd.nist.gov/vuln/detail/CVE-2018-14446
+  https://nvd.nist.gov/vuln/detail/CVE-2018-14403
+  https://nvd.nist.gov/vuln/detail/CVE-2018-14379
+  https://nvd.nist.gov/vuln/detail/CVE-2018-14326
+  https://nvd.nist.gov/vuln/detail/CVE-2018-14325
+  https://nvd.nist.gov/vuln/detail/CVE-2018-14054
+  based on https://github.com/TechSmith/mp4v2/pull/27
+  and https://github.com/sergiomb2/libmp4v2/
+- Update spec
+
 * Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.1.0-0.17.trunkREV507
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild