diff --git a/sources b/sources index 4bd97bd..2071c95 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (vorbis-tools-1.4.2.tar.gz) = 31681560434054706981aef64406975295eb405a9d2d7c0468af789d6c23edb7cfc1c19d26a28fa7061835524289cdc6d217a4669c43a2eb828189370cc6fcaf +SHA512 (vorbis-tools-1.4.3.tar.gz) = 096cb82073ca697fd3556e11c09e8296f60d4abc3cdfee6296fe8643f2e39edcf093704453901fe34d03c7818f59d665d665504a217c1399079df1d936d763e4 diff --git a/vorbis-tools-1.4.2-CVE-2023-43361.patch b/vorbis-tools-1.4.2-CVE-2023-43361.patch deleted file mode 100644 index 7e50570..0000000 --- a/vorbis-tools-1.4.2-CVE-2023-43361.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/oggenc/platform.c b/oggenc/platform.c -index 6d9f4ef..c63304b 100644 ---- a/oggenc/platform.c -+++ b/oggenc/platform.c -@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8) - start = start+2; - #endif - -- while((end = strpbrk(start+1, PATH_SEPS)) != NULL) -+ while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL) - { - int rv; - memcpy(segment, fn, end-fn); diff --git a/vorbis-tools-1.4.3-CVE-2026-34253.patch b/vorbis-tools-1.4.3-CVE-2026-34253.patch new file mode 100644 index 0000000..70018c2 --- /dev/null +++ b/vorbis-tools-1.4.3-CVE-2026-34253.patch @@ -0,0 +1,248 @@ +From 4bb4fb33b25949178179f689db9afb477abeb572 Mon Sep 17 00:00:00 2001 +From: "Timothy B. Terriberry" +Date: Tue, 24 Jun 2025 09:14:13 -0700 +Subject: [PATCH] Do not assume fgets result is non-empty + +If a file contains an embedded NUL ('\0') character, strlen() on + the result of fgets() can be 0, even when we have not reached the + end of the file. +Therefore we cannot access index [strlen(buf)-1] to check a + character at the end of the string. + +Thanks to Momoko Shiraishi for the report. + +Fixes #2332 +--- + ogg123/playlist.c | 8 ++++++-- + ogg123/remote.c | 2 +- + vorbiscomment/vcomment.c | 2 +- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/ogg123/playlist.c b/ogg123/playlist.c +index afcf5d7..3d3bc8f 100644 +--- a/ogg123/playlist.c ++++ b/ogg123/playlist.c +@@ -265,10 +265,14 @@ int playlist_append_from_file(playlist_t *list, char *playlist_filename) + + /* Crop off trailing newlines if present. Handle DOS (\r\n), Unix (\n) + * and MacOS<9 (\r) line endings. */ +- if (filename[length - 2] == '\r' && filename[length - 1] == '\n') ++ if (length >= 2 && filename[length - 2] == '\r' ++ && filename[length - 1] == '\n') { + filename[length - 2] = '\0'; +- else if (filename[length - 1] == '\n' || filename[length - 1] == '\r') ++ } ++ else if (length >= 1 && ( ++ filename[length - 1] == '\n' || filename[length - 1] == '\r')) { + filename[length - 1] = '\0'; ++ } + + if (stat(filename, &stat_buf) == 0) { + +diff --git a/ogg123/remote.c b/ogg123/remote.c +index 30f9787..1107174 100644 +--- a/ogg123/remote.c ++++ b/ogg123/remote.c +@@ -150,7 +150,7 @@ static void * remotethread(void * arg) { + #endif + + fgets(buf, MAXBUF, stdin); +- buf[strlen(buf)-1] = 0; ++ buf[strcspn(buf, "\n")] = 0; + + /* Lock on */ + pthread_mutex_lock (&main_lock); +diff --git a/vorbiscomment/vcomment.c b/vorbiscomment/vcomment.c +index 2f1e17a..9c93f05 100644 +--- a/vorbiscomment/vcomment.c ++++ b/vorbiscomment/vcomment.c +@@ -123,7 +123,7 @@ char * read_line (FILE *input) + buffers[buffer_count] = buffer; + buffer_count++; + +- if (retval[strlen (retval) - 1] == '\n') ++ if (strchr(retval, '\n') != NULL) + { + /* End of the line */ + break; +-- +2.54.0 + +From cfc497a442f51fb4885e132deaf2e0ba067bd280 Mon Sep 17 00:00:00 2001 +From: "Timothy B. Terriberry" +Date: Tue, 24 Jun 2025 09:38:56 -0700 +Subject: [PATCH] ogg123: Handle EOF/error in remote interface + +Previously, if there was an error or EOF reading commands for the + remote interface, the reader would loop infinitely trying to read + another command that will never come. +Instead, treat error or EOF as a Quit command. + +We manually send an error message / log, instead of using the + existing error path, because we still want the main thread to + process the Quit. +--- + ogg123/remote.c | 128 ++++++++++++++++++++++++++---------------------- + 1 file changed, 69 insertions(+), 59 deletions(-) + +diff --git a/ogg123/remote.c b/ogg123/remote.c +index 1107174..b0416a5 100644 +--- a/ogg123/remote.c ++++ b/ogg123/remote.c +@@ -139,6 +139,7 @@ static void * remotethread(void * arg) { + buf[MAXBUF]=0; + + while(!done) { ++ char *ret; + /* Read a line */ + buf[0] = 0; + send_log("Waiting for input: ..."); +@@ -149,77 +150,86 @@ static void * remotethread(void * arg) { + select (1, &fd, NULL, NULL, NULL); + #endif + +- fgets(buf, MAXBUF, stdin); +- buf[strcspn(buf, "\n")] = 0; ++ ret = fgets(buf, MAXBUF, stdin); + + /* Lock on */ + pthread_mutex_lock (&main_lock); + +- send_log("Input: %s", buf); +- error = 0; +- +- if (!strncasecmp(buf,"l",1)) { +- /* prepare to load */ +- if ((b=strchr(buf,' ')) != NULL) { +- /* Prepare to load a new song */ +- strcpy((char*)arg, b+1); ++ if (ret != NULL) { ++ buf[strcspn(buf, "\n")] = 0; ++ send_log("Input: %s", buf); ++ error = 0; ++ ++ if (!strncasecmp(buf,"l",1)) { ++ /* prepare to load */ ++ if ((b=strchr(buf,' ')) != NULL) { ++ /* Prepare to load a new song */ ++ strcpy((char*)arg, b+1); ++ setstatus(NEXT); ++ } ++ else { ++ /* Invalid load command */ ++ error = 1; ++ } ++ } ++ else ++ if (!strncasecmp(buf,"p",1)) { ++ /* Prepare to (un)pause */ ++ invertpause(); ++ } ++ else ++ if (!strncasecmp(buf,"j",1)) { ++ /* Prepare to seek */ ++ if ((b=strchr(buf,' ')) != NULL) { ++ set_seek_opt(&options, b+1); ++ } ++ ignore = 1; ++ } ++ else ++ if (!strncasecmp(buf,"s",1)) { ++ /* Prepare to stop */ ++ setstatus(STOP); ++ } ++ else ++ if (!strncasecmp(buf,"r",1)) { ++ /* Prepare to reload */ + setstatus(NEXT); +- } ++ } ++ else ++ if (!strncasecmp(buf,"h",1)) { ++ /* Send help */ ++ send_msg("H +----------------------------------------------------+"); ++ send_msg("H | Ogg123 remote interface |"); ++ send_msg("H |----------------------------------------------------|"); ++ send_msg("H | Load - load a file and starts playing |"); ++ send_msg("H | Pause - pause or unpause playing |"); ++ send_msg("H | Jump [+|-] - jump seconds forth or back |"); ++ send_msg("H | Stop - stop playing |"); ++ send_msg("H | Reload - reload last song |"); ++ send_msg("H | Quit - quit ogg123 |"); ++ send_msg("H |----------------------------------------------------|"); ++ send_msg("H | refer to README.remote for documentation |"); ++ send_msg("H +----------------------------------------------------+"); ++ ignore = 1; ++ } ++ else ++ if (!strncasecmp(buf,"q",1)) { ++ /* Prepare to quit */ ++ setstatus(QUIT); ++ done = 1; ++ } + else { +- /* Invalid load command */ ++ /* Unknown input received */ + error = 1; + } + } +- else +- if (!strncasecmp(buf,"p",1)) { +- /* Prepare to (un)pause */ +- invertpause(); +- } +- else +- if (!strncasecmp(buf,"j",1)) { +- /* Prepare to seek */ +- if ((b=strchr(buf,' ')) != NULL) { +- set_seek_opt(&options, b+1); +- } +- ignore = 1; +- } +- else +- if (!strncasecmp(buf,"s",1)) { +- /* Prepare to stop */ +- setstatus(STOP); +- } +- else +- if (!strncasecmp(buf,"r",1)) { +- /* Prepare to reload */ +- setstatus(NEXT); +- } +- else +- if (!strncasecmp(buf,"h",1)) { +- /* Send help */ +- send_msg("H +----------------------------------------------------+"); +- send_msg("H | Ogg123 remote interface |"); +- send_msg("H |----------------------------------------------------|"); +- send_msg("H | Load - load a file and starts playing |"); +- send_msg("H | Pause - pause or unpause playing |"); +- send_msg("H | Jump [+|-] - jump seconds forth or back |"); +- send_msg("H | Stop - stop playing |"); +- send_msg("H | Reload - reload last song |"); +- send_msg("H | Quit - quit ogg123 |"); +- send_msg("H |----------------------------------------------------|"); +- send_msg("H | refer to README.remote for documentation |"); +- send_msg("H +----------------------------------------------------+"); +- ignore = 1; +- } +- else +- if (!strncasecmp(buf,"q",1)) { +- /* Prepare to quit */ ++ else { ++ send_err("E EOF or error reading commands"); ++ send_log("EOF or error reading commands"); ++ /* Treat EOF or error as a quit command. */ + setstatus(QUIT); + done = 1; + } +- else { +- /* Unknown input received */ +- error = 1; +- } + + if (ignore) { + /* Unlock */ +-- +2.54.0 + diff --git a/vorbis-tools-c99.patch b/vorbis-tools-c99.patch deleted file mode 100644 index 76b69e2..0000000 --- a/vorbis-tools-c99.patch +++ /dev/null @@ -1,20 +0,0 @@ -Include "utf8.h" for a prototype of the utf8_decode function. This -avoids an implicit function declaration and build issues with future -compilers. - -Submitted upstream: - - - -diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c -index a27f8da8307872bb..0709860ab096c942 100644 ---- a/ogginfo/codec_skeleton.c -+++ b/ogginfo/codec_skeleton.c -@@ -25,6 +25,7 @@ - #include - - #include "i18n.h" -+#include "utf8.h" - - #include "private.h" - diff --git a/vorbis-tools.spec b/vorbis-tools.spec index 35ceeca..c055f17 100644 --- a/vorbis-tools.spec +++ b/vorbis-tools.spec @@ -1,18 +1,20 @@ Summary: The Vorbis General Audio Compression Codec tools Name: vorbis-tools -Version: 1.4.2 -Release: 10%{?dist} +Version: 1.4.3 +Release: 7%{?dist} Epoch: 1 -License: GPLv2 +# Automatically converted from old format: GPLv2 - review is highly recommended. +License: GPL-2.0-only URL: https://www.xiph.org/ Source: https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar.gz # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html Patch1: vorbis-tools-1.4.2-man-page.patch -Patch2: vorbis-tools-c99.patch -# fix out-of-bounds read in oggenc (CVE-2023-43361) -Patch3: vorbis-tools-1.4.2-CVE-2023-43361.patch +# CVE-2026-34253 +# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/4bb4fb33b25949178179f689db9afb477abeb572 +# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/cfc497a442f51fb4885e132deaf2e0ba067bd280 +Patch2: vorbis-tools-1.4.3-CVE-2026-34253.patch BuildRequires: flac-devel BuildRequires: gettext @@ -21,6 +23,7 @@ BuildRequires: libao-devel BuildRequires: libcurl-devel BuildRequires: libvorbis-devel BuildRequires: make +BuildRequires: opusfile-devel BuildRequires: speex-devel Obsoletes: vorbis < %{epoch}:%{version}-%{release} Provides: vorbis = %{epoch}:%{version}-%{release} @@ -42,9 +45,6 @@ comment editor. %build -# fix FTBFS if "-Werror=format-security" flag is used (#1025257) -export CFLAGS="$RPM_OPT_FLAGS -Wno-error=format-security" - # uncomment this when debugging #CFLAGS="$CFLAGS -O0" @@ -65,6 +65,39 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}* %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 1:1.4.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + +* Tue Jun 09 2026 Leigh Scott - 1:1.4.3-6 +- enable opusfile support + +* Tue Jun 09 2026 Lukáš Zaoral - 1:1.4.3-5 +- CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549) + +* Sat Jan 17 2026 Fedora Release Engineering - 1:1.4.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jul 25 2025 Fedora Release Engineering - 1:1.4.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue May 27 2025 Jitka Plesnikova - 1:1.4.3-2 +- Rebuilt for flac 1.5.0 + +* Mon Apr 14 2025 Lukáš Zaoral - 1:1.4.3-1 +- rebase to latest upstream release (rhbz#2359292) + +* Sun Jan 19 2025 Fedora Release Engineering - 1:1.4.2-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Mon Jul 29 2024 Miroslav Suchý - 1:1.4.2-13 +- convert license to SPDX + +* Sat Jul 20 2024 Fedora Release Engineering - 1:1.4.2-12 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Sat Jan 27 2024 Fedora Release Engineering - 1:1.4.2-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Thu Jan 18 2024 Lukáš Zaoral - 1:1.4.2-10 - fix out-of-bounds read in oggenc (CVE-2023-43361)