From c94f39b85e25dd8b1a534dcf9d2822dc1da3b9ca Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 12:06:07 +0000 Subject: [PATCH 01/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 0fe5146..9fc2576 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -62,6 +62,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 1:1.4.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sat Jan 22 2022 Fedora Release Engineering - 1:1.4.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 960f7342cd859a7b46ce6f282033ce71b33b85cb Mon Sep 17 00:00:00 2001 From: Michel Alexandre Salim Date: Wed, 14 Sep 2022 17:42:41 -0500 Subject: [PATCH 02/17] Rebuilt for flac 1.4.0 Signed-off-by: Michel Alexandre Salim --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 9fc2576..94790ab 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -62,6 +62,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Wed Sep 14 2022 Michel Alexandre Salim - 1:1.4.2-6 +- Rebuilt for flac 1.4.0 + * Sat Jul 23 2022 Fedora Release Engineering - 1:1.4.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From 066ef1c79eda9c18b383ddf1918d9776644df899 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 06:29:35 +0000 Subject: [PATCH 03/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 94790ab..930738b 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -62,6 +62,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 1:1.4.2-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Wed Sep 14 2022 Michel Alexandre Salim - 1:1.4.2-6 - Rebuilt for flac 1.4.0 From 8ddea44dc96711504d41d32539f621027af407e7 Mon Sep 17 00:00:00 2001 From: Florian Weimer Date: Tue, 7 Feb 2023 09:05:59 +0100 Subject: [PATCH 04/17] Fix C99 compatibility issue Related to: --- vorbis-tools-c99.patch | 20 ++++++++++++++++++++ vorbis-tools.spec | 6 +++++- 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 vorbis-tools-c99.patch diff --git a/vorbis-tools-c99.patch b/vorbis-tools-c99.patch new file mode 100644 index 0000000..76b69e2 --- /dev/null +++ b/vorbis-tools-c99.patch @@ -0,0 +1,20 @@ +Include "utf8.h" for a prototype of the utf8_decode function. This +avoids an implicit function declaration and build issues with future +compilers. + +Submitted upstream: + + + +diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c +index a27f8da8307872bb..0709860ab096c942 100644 +--- a/ogginfo/codec_skeleton.c ++++ b/ogginfo/codec_skeleton.c +@@ -25,6 +25,7 @@ + #include + + #include "i18n.h" ++#include "utf8.h" + + #include "private.h" + diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 930738b..fb2e9ee 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 7%{?dist} +Release: 8%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -10,6 +10,7 @@ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar. # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html Patch1: vorbis-tools-1.4.2-man-page.patch +Patch2: vorbis-tools-c99.patch BuildRequires: flac-devel BuildRequires: gettext @@ -62,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Tue Feb 07 2023 Florian Weimer - 1:1.4.2-8 +- Fix C99 compatibility issue + * Sat Jan 21 2023 Fedora Release Engineering - 1:1.4.2-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From b4a9ef08fb49af589acd236b14e8ee81b6270532 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 17:51:40 +0000 Subject: [PATCH 05/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index fb2e9ee..c2a8aed 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 8%{?dist} +Release: 9%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -63,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 1:1.4.2-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Tue Feb 07 2023 Florian Weimer - 1:1.4.2-8 - Fix C99 compatibility issue From 62bedf258226b84bff30a1b6d3ad3940d377e92e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= Date: Thu, 18 Jan 2024 13:28:59 +0100 Subject: [PATCH 06/17] fix out-of-bounds read in oggenc Resolves: CVE-2023-43361 --- vorbis-tools-1.4.2-CVE-2023-43361.patch | 13 +++++++++++++ vorbis-tools.spec | 7 ++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 vorbis-tools-1.4.2-CVE-2023-43361.patch diff --git a/vorbis-tools-1.4.2-CVE-2023-43361.patch b/vorbis-tools-1.4.2-CVE-2023-43361.patch new file mode 100644 index 0000000..7e50570 --- /dev/null +++ b/vorbis-tools-1.4.2-CVE-2023-43361.patch @@ -0,0 +1,13 @@ +diff --git a/oggenc/platform.c b/oggenc/platform.c +index 6d9f4ef..c63304b 100644 +--- a/oggenc/platform.c ++++ b/oggenc/platform.c +@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8) + start = start+2; + #endif + +- while((end = strpbrk(start+1, PATH_SEPS)) != NULL) ++ while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL) + { + int rv; + memcpy(segment, fn, end-fn); diff --git a/vorbis-tools.spec b/vorbis-tools.spec index c2a8aed..35ceeca 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 9%{?dist} +Release: 10%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -11,6 +11,8 @@ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar. # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html Patch1: vorbis-tools-1.4.2-man-page.patch Patch2: vorbis-tools-c99.patch +# fix out-of-bounds read in oggenc (CVE-2023-43361) +Patch3: vorbis-tools-1.4.2-CVE-2023-43361.patch BuildRequires: flac-devel BuildRequires: gettext @@ -63,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Thu Jan 18 2024 Lukáš Zaoral - 1:1.4.2-10 +- fix out-of-bounds read in oggenc (CVE-2023-43361) + * Sat Jul 22 2023 Fedora Release Engineering - 1:1.4.2-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From ad19adbf78104aa793a03b342b63c881ca76d153 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 08:11:38 +0000 Subject: [PATCH 07/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 35ceeca..2279a55 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 10%{?dist} +Release: 11%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -65,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 1:1.4.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 18 2024 Lukáš Zaoral - 1:1.4.2-10 - fix out-of-bounds read in oggenc (CVE-2023-43361) From f1c86ae18fca84f31e391bbcd27400c8abb66336 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 09:00:20 +0000 Subject: [PATCH 08/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 2279a55..7e2c452 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 11%{?dist} +Release: 12%{?dist} Epoch: 1 License: GPLv2 URL: https://www.xiph.org/ @@ -65,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 1:1.4.2-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jan 27 2024 Fedora Release Engineering - 1:1.4.2-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 956aadcde4b359fb32a30baa6870421a7ba857bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Mon, 29 Jul 2024 12:29:19 +0200 Subject: [PATCH 09/17] convert GPLv2 license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- vorbis-tools.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 7e2c452..0854755 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,9 +1,10 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 12%{?dist} +Release: 13%{?dist} Epoch: 1 -License: GPLv2 +# Automatically converted from old format: GPLv2 - review is highly recommended. +License: GPL-2.0-only URL: https://www.xiph.org/ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar.gz @@ -65,6 +66,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Mon Jul 29 2024 Miroslav Suchý - 1:1.4.2-13 +- convert license to SPDX + * Sat Jul 20 2024 Fedora Release Engineering - 1:1.4.2-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From c44c8bfb231c0986814ee6d2e70ae17f547702a5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 14:36:39 +0000 Subject: [PATCH 10/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 0854755..3e4cd01 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.2 -Release: 13%{?dist} +Release: 14%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -66,6 +66,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 1:1.4.2-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Jul 29 2024 Miroslav Suchý - 1:1.4.2-13 - convert license to SPDX From e98b75dd31430117115e31c0784aa19e1a47f976 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= Date: Mon, 14 Apr 2025 10:38:34 +0200 Subject: [PATCH 11/17] rebase to latest upstream release Resolves: rhbz#2359292 --- sources | 2 +- vorbis-tools-1.4.2-CVE-2023-43361.patch | 13 ------------- vorbis-tools-c99.patch | 20 -------------------- vorbis-tools.spec | 10 +++++----- 4 files changed, 6 insertions(+), 39 deletions(-) delete mode 100644 vorbis-tools-1.4.2-CVE-2023-43361.patch delete mode 100644 vorbis-tools-c99.patch diff --git a/sources b/sources index 4bd97bd..2071c95 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (vorbis-tools-1.4.2.tar.gz) = 31681560434054706981aef64406975295eb405a9d2d7c0468af789d6c23edb7cfc1c19d26a28fa7061835524289cdc6d217a4669c43a2eb828189370cc6fcaf +SHA512 (vorbis-tools-1.4.3.tar.gz) = 096cb82073ca697fd3556e11c09e8296f60d4abc3cdfee6296fe8643f2e39edcf093704453901fe34d03c7818f59d665d665504a217c1399079df1d936d763e4 diff --git a/vorbis-tools-1.4.2-CVE-2023-43361.patch b/vorbis-tools-1.4.2-CVE-2023-43361.patch deleted file mode 100644 index 7e50570..0000000 --- a/vorbis-tools-1.4.2-CVE-2023-43361.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/oggenc/platform.c b/oggenc/platform.c -index 6d9f4ef..c63304b 100644 ---- a/oggenc/platform.c -+++ b/oggenc/platform.c -@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8) - start = start+2; - #endif - -- while((end = strpbrk(start+1, PATH_SEPS)) != NULL) -+ while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL) - { - int rv; - memcpy(segment, fn, end-fn); diff --git a/vorbis-tools-c99.patch b/vorbis-tools-c99.patch deleted file mode 100644 index 76b69e2..0000000 --- a/vorbis-tools-c99.patch +++ /dev/null @@ -1,20 +0,0 @@ -Include "utf8.h" for a prototype of the utf8_decode function. This -avoids an implicit function declaration and build issues with future -compilers. - -Submitted upstream: - - - -diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c -index a27f8da8307872bb..0709860ab096c942 100644 ---- a/ogginfo/codec_skeleton.c -+++ b/ogginfo/codec_skeleton.c -@@ -25,6 +25,7 @@ - #include - - #include "i18n.h" -+#include "utf8.h" - - #include "private.h" - diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 3e4cd01..b62e49d 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools -Version: 1.4.2 -Release: 14%{?dist} +Version: 1.4.3 +Release: 1%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -11,9 +11,6 @@ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar. # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html Patch1: vorbis-tools-1.4.2-man-page.patch -Patch2: vorbis-tools-c99.patch -# fix out-of-bounds read in oggenc (CVE-2023-43361) -Patch3: vorbis-tools-1.4.2-CVE-2023-43361.patch BuildRequires: flac-devel BuildRequires: gettext @@ -66,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Mon Apr 14 2025 Lukáš Zaoral - 1:1.4.3-1 +- rebase to latest upstream release (rhbz#2359292) + * Sun Jan 19 2025 Fedora Release Engineering - 1:1.4.2-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From df87b5f969a68ff8ae3255c6364857f8f8be658c Mon Sep 17 00:00:00 2001 From: Jitka Plesnikova Date: Tue, 27 May 2025 17:13:56 +0200 Subject: [PATCH 12/17] Rebuilt for flac 1.5.0 --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index b62e49d..35f1ce8 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -63,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Tue May 27 2025 Jitka Plesnikova - 1:1.4.3-2 +- Rebuilt for flac 1.5.0 + * Mon Apr 14 2025 Lukáš Zaoral - 1:1.4.3-1 - rebase to latest upstream release (rhbz#2359292) From bb69cdb44799e4a5d6e6eca2eb14930f9283d8db Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 20:13:22 +0000 Subject: [PATCH 13/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 35f1ce8..cd56bbb 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -63,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 1:1.4.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue May 27 2025 Jitka Plesnikova - 1:1.4.3-2 - Rebuilt for flac 1.5.0 From 4d80fdccb6d6b7f9cd8c5d125f3fc6f3fbd503d5 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 20:03:09 +0000 Subject: [PATCH 14/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index cd56bbb..f3b6dcd 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -63,6 +63,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 1:1.4.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jul 25 2025 Fedora Release Engineering - 1:1.4.3-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From a795b77aa380064afe6b1a580a0f2c053190661d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zaoral?= Date: Tue, 9 Jun 2026 10:27:51 +0200 Subject: [PATCH 15/17] CVE-2026-34253 - fix arbitrary code execution via buffer underflow Resolves: rhbz#2479549 --- vorbis-tools-1.4.3-CVE-2026-34253.patch | 248 ++++++++++++++++++++++++ vorbis-tools.spec | 12 +- 2 files changed, 256 insertions(+), 4 deletions(-) create mode 100644 vorbis-tools-1.4.3-CVE-2026-34253.patch diff --git a/vorbis-tools-1.4.3-CVE-2026-34253.patch b/vorbis-tools-1.4.3-CVE-2026-34253.patch new file mode 100644 index 0000000..70018c2 --- /dev/null +++ b/vorbis-tools-1.4.3-CVE-2026-34253.patch @@ -0,0 +1,248 @@ +From 4bb4fb33b25949178179f689db9afb477abeb572 Mon Sep 17 00:00:00 2001 +From: "Timothy B. Terriberry" +Date: Tue, 24 Jun 2025 09:14:13 -0700 +Subject: [PATCH] Do not assume fgets result is non-empty + +If a file contains an embedded NUL ('\0') character, strlen() on + the result of fgets() can be 0, even when we have not reached the + end of the file. +Therefore we cannot access index [strlen(buf)-1] to check a + character at the end of the string. + +Thanks to Momoko Shiraishi for the report. + +Fixes #2332 +--- + ogg123/playlist.c | 8 ++++++-- + ogg123/remote.c | 2 +- + vorbiscomment/vcomment.c | 2 +- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/ogg123/playlist.c b/ogg123/playlist.c +index afcf5d7..3d3bc8f 100644 +--- a/ogg123/playlist.c ++++ b/ogg123/playlist.c +@@ -265,10 +265,14 @@ int playlist_append_from_file(playlist_t *list, char *playlist_filename) + + /* Crop off trailing newlines if present. Handle DOS (\r\n), Unix (\n) + * and MacOS<9 (\r) line endings. */ +- if (filename[length - 2] == '\r' && filename[length - 1] == '\n') ++ if (length >= 2 && filename[length - 2] == '\r' ++ && filename[length - 1] == '\n') { + filename[length - 2] = '\0'; +- else if (filename[length - 1] == '\n' || filename[length - 1] == '\r') ++ } ++ else if (length >= 1 && ( ++ filename[length - 1] == '\n' || filename[length - 1] == '\r')) { + filename[length - 1] = '\0'; ++ } + + if (stat(filename, &stat_buf) == 0) { + +diff --git a/ogg123/remote.c b/ogg123/remote.c +index 30f9787..1107174 100644 +--- a/ogg123/remote.c ++++ b/ogg123/remote.c +@@ -150,7 +150,7 @@ static void * remotethread(void * arg) { + #endif + + fgets(buf, MAXBUF, stdin); +- buf[strlen(buf)-1] = 0; ++ buf[strcspn(buf, "\n")] = 0; + + /* Lock on */ + pthread_mutex_lock (&main_lock); +diff --git a/vorbiscomment/vcomment.c b/vorbiscomment/vcomment.c +index 2f1e17a..9c93f05 100644 +--- a/vorbiscomment/vcomment.c ++++ b/vorbiscomment/vcomment.c +@@ -123,7 +123,7 @@ char * read_line (FILE *input) + buffers[buffer_count] = buffer; + buffer_count++; + +- if (retval[strlen (retval) - 1] == '\n') ++ if (strchr(retval, '\n') != NULL) + { + /* End of the line */ + break; +-- +2.54.0 + +From cfc497a442f51fb4885e132deaf2e0ba067bd280 Mon Sep 17 00:00:00 2001 +From: "Timothy B. Terriberry" +Date: Tue, 24 Jun 2025 09:38:56 -0700 +Subject: [PATCH] ogg123: Handle EOF/error in remote interface + +Previously, if there was an error or EOF reading commands for the + remote interface, the reader would loop infinitely trying to read + another command that will never come. +Instead, treat error or EOF as a Quit command. + +We manually send an error message / log, instead of using the + existing error path, because we still want the main thread to + process the Quit. +--- + ogg123/remote.c | 128 ++++++++++++++++++++++++++---------------------- + 1 file changed, 69 insertions(+), 59 deletions(-) + +diff --git a/ogg123/remote.c b/ogg123/remote.c +index 1107174..b0416a5 100644 +--- a/ogg123/remote.c ++++ b/ogg123/remote.c +@@ -139,6 +139,7 @@ static void * remotethread(void * arg) { + buf[MAXBUF]=0; + + while(!done) { ++ char *ret; + /* Read a line */ + buf[0] = 0; + send_log("Waiting for input: ..."); +@@ -149,77 +150,86 @@ static void * remotethread(void * arg) { + select (1, &fd, NULL, NULL, NULL); + #endif + +- fgets(buf, MAXBUF, stdin); +- buf[strcspn(buf, "\n")] = 0; ++ ret = fgets(buf, MAXBUF, stdin); + + /* Lock on */ + pthread_mutex_lock (&main_lock); + +- send_log("Input: %s", buf); +- error = 0; +- +- if (!strncasecmp(buf,"l",1)) { +- /* prepare to load */ +- if ((b=strchr(buf,' ')) != NULL) { +- /* Prepare to load a new song */ +- strcpy((char*)arg, b+1); ++ if (ret != NULL) { ++ buf[strcspn(buf, "\n")] = 0; ++ send_log("Input: %s", buf); ++ error = 0; ++ ++ if (!strncasecmp(buf,"l",1)) { ++ /* prepare to load */ ++ if ((b=strchr(buf,' ')) != NULL) { ++ /* Prepare to load a new song */ ++ strcpy((char*)arg, b+1); ++ setstatus(NEXT); ++ } ++ else { ++ /* Invalid load command */ ++ error = 1; ++ } ++ } ++ else ++ if (!strncasecmp(buf,"p",1)) { ++ /* Prepare to (un)pause */ ++ invertpause(); ++ } ++ else ++ if (!strncasecmp(buf,"j",1)) { ++ /* Prepare to seek */ ++ if ((b=strchr(buf,' ')) != NULL) { ++ set_seek_opt(&options, b+1); ++ } ++ ignore = 1; ++ } ++ else ++ if (!strncasecmp(buf,"s",1)) { ++ /* Prepare to stop */ ++ setstatus(STOP); ++ } ++ else ++ if (!strncasecmp(buf,"r",1)) { ++ /* Prepare to reload */ + setstatus(NEXT); +- } ++ } ++ else ++ if (!strncasecmp(buf,"h",1)) { ++ /* Send help */ ++ send_msg("H +----------------------------------------------------+"); ++ send_msg("H | Ogg123 remote interface |"); ++ send_msg("H |----------------------------------------------------|"); ++ send_msg("H | Load - load a file and starts playing |"); ++ send_msg("H | Pause - pause or unpause playing |"); ++ send_msg("H | Jump [+|-] - jump seconds forth or back |"); ++ send_msg("H | Stop - stop playing |"); ++ send_msg("H | Reload - reload last song |"); ++ send_msg("H | Quit - quit ogg123 |"); ++ send_msg("H |----------------------------------------------------|"); ++ send_msg("H | refer to README.remote for documentation |"); ++ send_msg("H +----------------------------------------------------+"); ++ ignore = 1; ++ } ++ else ++ if (!strncasecmp(buf,"q",1)) { ++ /* Prepare to quit */ ++ setstatus(QUIT); ++ done = 1; ++ } + else { +- /* Invalid load command */ ++ /* Unknown input received */ + error = 1; + } + } +- else +- if (!strncasecmp(buf,"p",1)) { +- /* Prepare to (un)pause */ +- invertpause(); +- } +- else +- if (!strncasecmp(buf,"j",1)) { +- /* Prepare to seek */ +- if ((b=strchr(buf,' ')) != NULL) { +- set_seek_opt(&options, b+1); +- } +- ignore = 1; +- } +- else +- if (!strncasecmp(buf,"s",1)) { +- /* Prepare to stop */ +- setstatus(STOP); +- } +- else +- if (!strncasecmp(buf,"r",1)) { +- /* Prepare to reload */ +- setstatus(NEXT); +- } +- else +- if (!strncasecmp(buf,"h",1)) { +- /* Send help */ +- send_msg("H +----------------------------------------------------+"); +- send_msg("H | Ogg123 remote interface |"); +- send_msg("H |----------------------------------------------------|"); +- send_msg("H | Load - load a file and starts playing |"); +- send_msg("H | Pause - pause or unpause playing |"); +- send_msg("H | Jump [+|-] - jump seconds forth or back |"); +- send_msg("H | Stop - stop playing |"); +- send_msg("H | Reload - reload last song |"); +- send_msg("H | Quit - quit ogg123 |"); +- send_msg("H |----------------------------------------------------|"); +- send_msg("H | refer to README.remote for documentation |"); +- send_msg("H +----------------------------------------------------+"); +- ignore = 1; +- } +- else +- if (!strncasecmp(buf,"q",1)) { +- /* Prepare to quit */ ++ else { ++ send_err("E EOF or error reading commands"); ++ send_log("EOF or error reading commands"); ++ /* Treat EOF or error as a quit command. */ + setstatus(QUIT); + done = 1; + } +- else { +- /* Unknown input received */ +- error = 1; +- } + + if (ignore) { + /* Unlock */ +-- +2.54.0 + diff --git a/vorbis-tools.spec b/vorbis-tools.spec index f3b6dcd..f74708b 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -11,6 +11,10 @@ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar. # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html Patch1: vorbis-tools-1.4.2-man-page.patch +# CVE-2026-34253 +# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/4bb4fb33b25949178179f689db9afb477abeb572 +# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/cfc497a442f51fb4885e132deaf2e0ba067bd280 +Patch2: vorbis-tools-1.4.3-CVE-2026-34253.patch BuildRequires: flac-devel BuildRequires: gettext @@ -40,9 +44,6 @@ comment editor. %build -# fix FTBFS if "-Werror=format-security" flag is used (#1025257) -export CFLAGS="$RPM_OPT_FLAGS -Wno-error=format-security" - # uncomment this when debugging #CFLAGS="$CFLAGS -O0" @@ -63,6 +64,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Tue Jun 09 2026 Lukáš Zaoral - 1:1.4.3-5 +- CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549) + * Sat Jan 17 2026 Fedora Release Engineering - 1:1.4.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 3c15dbcce7ffd64602e77e99b174656202ac2999 Mon Sep 17 00:00:00 2001 From: Leigh Scott Date: Tue, 9 Jun 2026 12:15:16 +0200 Subject: [PATCH 16/17] enable opusfile support --- vorbis-tools.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index f74708b..a2ee50b 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -23,6 +23,7 @@ BuildRequires: libao-devel BuildRequires: libcurl-devel BuildRequires: libvorbis-devel BuildRequires: make +BuildRequires: opusfile-devel BuildRequires: speex-devel Obsoletes: vorbis < %{epoch}:%{version}-%{release} Provides: vorbis = %{epoch}:%{version}-%{release} @@ -64,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Tue Jun 09 2026 Leigh Scott - 1:1.4.3-6 +- enable opusfile support + * Tue Jun 09 2026 Lukáš Zaoral - 1:1.4.3-5 - CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549) From 415a5976130605b6e0578862d329d4a47d52676b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 08:37:16 +0000 Subject: [PATCH 17/17] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- vorbis-tools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/vorbis-tools.spec b/vorbis-tools.spec index a2ee50b..c055f17 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,7 +1,7 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools Version: 1.4.3 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 1 # Automatically converted from old format: GPLv2 - review is highly recommended. License: GPL-2.0-only @@ -65,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1:1.4.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Tue Jun 09 2026 Leigh Scott - 1:1.4.3-6 - enable opusfile support