Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild

Resolves: rhbz#2479549

sources

@@ -1 +1 @@
-SHA512 (vorbis-tools-1.4.2.tar.gz) = 31681560434054706981aef64406975295eb405a9d2d7c0468af789d6c23edb7cfc1c19d26a28fa7061835524289cdc6d217a4669c43a2eb828189370cc6fcaf
+SHA512 (vorbis-tools-1.4.3.tar.gz) = 096cb82073ca697fd3556e11c09e8296f60d4abc3cdfee6296fe8643f2e39edcf093704453901fe34d03c7818f59d665d665504a217c1399079df1d936d763e4

vorbis-tools-1.4.2-CVE-2023-43361.patch

@@ -1,13 +0,0 @@
-diff --git a/oggenc/platform.c b/oggenc/platform.c
-index 6d9f4ef..c63304b 100644
---- a/oggenc/platform.c
-+++ b/oggenc/platform.c
-@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8)
-         start = start+2;
- #endif
- 
--    while((end = strpbrk(start+1, PATH_SEPS)) != NULL)
-+    while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL)
-     {
-         int rv;
-         memcpy(segment, fn, end-fn);

vorbis-tools-1.4.3-CVE-2026-34253.patch

@@ -0,0 +1,248 @@
+From 4bb4fb33b25949178179f689db9afb477abeb572 Mon Sep 17 00:00:00 2001
+From: "Timothy B. Terriberry" <tterribe@xiph.org>
+Date: Tue, 24 Jun 2025 09:14:13 -0700
+Subject: [PATCH] Do not assume fgets result is non-empty
+
+If a file contains an embedded NUL ('\0') character, strlen() on
+ the result of fgets() can be 0, even when we have not reached the
+ end of the file.
+Therefore we cannot access index [strlen(buf)-1] to check a
+ character at the end of the string.
+
+Thanks to Momoko Shiraishi for the report.
+
+Fixes #2332
+---
+ ogg123/playlist.c        | 8 ++++++--
+ ogg123/remote.c          | 2 +-
+ vorbiscomment/vcomment.c | 2 +-
+ 3 files changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/ogg123/playlist.c b/ogg123/playlist.c
+index afcf5d7..3d3bc8f 100644
+--- a/ogg123/playlist.c
++++ b/ogg123/playlist.c
+@@ -265,10 +265,14 @@ int playlist_append_from_file(playlist_t *list, char *playlist_filename)
+ 
+     /* Crop off trailing newlines if present. Handle DOS (\r\n), Unix (\n)
+      * and MacOS<9 (\r) line endings. */
+-    if (filename[length - 2] == '\r' && filename[length - 1] == '\n')
++    if (length >= 2 && filename[length - 2] == '\r'
++     && filename[length - 1] == '\n') {
+       filename[length - 2] = '\0';
+-    else if (filename[length - 1] == '\n' || filename[length - 1] == '\r')
++    }
++    else if (length >= 1 && (
++     filename[length - 1] == '\n' || filename[length - 1] == '\r')) {
+       filename[length - 1] = '\0';
++    }
+ 
+     if (stat(filename, &stat_buf) == 0) {
+ 
+diff --git a/ogg123/remote.c b/ogg123/remote.c
+index 30f9787..1107174 100644
+--- a/ogg123/remote.c
++++ b/ogg123/remote.c
+@@ -150,7 +150,7 @@ static void * remotethread(void * arg) {
+ #endif
+ 
+     fgets(buf, MAXBUF, stdin);
+-    buf[strlen(buf)-1] = 0;
++    buf[strcspn(buf, "\n")] = 0;
+ 
+     /* Lock on */
+     pthread_mutex_lock (&main_lock);
+diff --git a/vorbiscomment/vcomment.c b/vorbiscomment/vcomment.c
+index 2f1e17a..9c93f05 100644
+--- a/vorbiscomment/vcomment.c
++++ b/vorbiscomment/vcomment.c
+@@ -123,7 +123,7 @@ char * read_line (FILE *input)
+                         buffers[buffer_count] = buffer;
+                         buffer_count++;
+ 
+-                        if (retval[strlen (retval) - 1] == '\n')
++                        if (strchr(retval, '\n') != NULL)
+                         {
+                                 /* End of the line */
+                                 break;
+-- 
+2.54.0
+
+From cfc497a442f51fb4885e132deaf2e0ba067bd280 Mon Sep 17 00:00:00 2001
+From: "Timothy B. Terriberry" <tterribe@xiph.org>
+Date: Tue, 24 Jun 2025 09:38:56 -0700
+Subject: [PATCH] ogg123: Handle EOF/error in remote interface
+
+Previously, if there was an error or EOF reading commands for the
+ remote interface, the reader would loop infinitely trying to read
+ another command that will never come.
+Instead, treat error or EOF as a Quit command.
+
+We manually send an error message / log, instead of using the
+ existing error path, because we still want the main thread to
+ process the Quit.
+---
+ ogg123/remote.c | 128 ++++++++++++++++++++++++++----------------------
+ 1 file changed, 69 insertions(+), 59 deletions(-)
+
+diff --git a/ogg123/remote.c b/ogg123/remote.c
+index 1107174..b0416a5 100644
+--- a/ogg123/remote.c
++++ b/ogg123/remote.c
+@@ -139,6 +139,7 @@ static void * remotethread(void * arg) {
+   buf[MAXBUF]=0;
+ 
+   while(!done) {
++    char *ret;
+     /* Read a line */
+     buf[0] = 0;
+     send_log("Waiting for input: ...");
+@@ -149,77 +150,86 @@ static void * remotethread(void * arg) {
+     select (1, &fd, NULL, NULL, NULL);
+ #endif
+ 
+-    fgets(buf, MAXBUF, stdin);
+-    buf[strcspn(buf, "\n")] = 0;
++    ret = fgets(buf, MAXBUF, stdin);
+ 
+     /* Lock on */
+     pthread_mutex_lock (&main_lock);
+ 
+-    send_log("Input: %s", buf);
+-    error = 0;
+-
+-    if (!strncasecmp(buf,"l",1)) {
+-	/* prepare to load */
+-      if ((b=strchr(buf,' ')) != NULL) {
+-        /* Prepare to load a new song */
+-        strcpy((char*)arg, b+1);
++    if (ret != NULL) {
++      buf[strcspn(buf, "\n")] = 0;
++      send_log("Input: %s", buf);
++      error = 0;
++
++      if (!strncasecmp(buf,"l",1)) {
++          /* prepare to load */
++        if ((b=strchr(buf,' ')) != NULL) {
++          /* Prepare to load a new song */
++          strcpy((char*)arg, b+1);
++          setstatus(NEXT);
++        }
++        else {
++          /* Invalid load command */
++          error = 1;
++        }
++      }
++      else
++      if (!strncasecmp(buf,"p",1)) {
++        /* Prepare to (un)pause */
++        invertpause();
++      }
++      else
++      if (!strncasecmp(buf,"j",1)) {
++        /* Prepare to seek */
++        if ((b=strchr(buf,' ')) != NULL) {
++          set_seek_opt(&options, b+1);
++        }
++        ignore = 1;
++      }
++      else
++      if (!strncasecmp(buf,"s",1)) {
++        /* Prepare to stop */
++        setstatus(STOP);
++      }
++          else
++      if (!strncasecmp(buf,"r",1)) {
++        /* Prepare to reload */
+         setstatus(NEXT);
+-      } 
++      }
++      else
++      if (!strncasecmp(buf,"h",1)) {
++        /* Send help */
++        send_msg("H +----------------------------------------------------+");
++        send_msg("H | Ogg123 remote interface                            |");
++        send_msg("H |----------------------------------------------------|");
++        send_msg("H | Load <file>     -  load a file and starts playing  |");
++        send_msg("H | Pause           -  pause or unpause playing        |");
++        send_msg("H | Jump [+|-]<f>   -  jump <f> seconds forth or back  |");
++        send_msg("H | Stop            -  stop playing                    |");
++        send_msg("H | Reload          -  reload last song                |");
++        send_msg("H | Quit            -  quit ogg123                     |");
++        send_msg("H |----------------------------------------------------|");
++        send_msg("H | refer to README.remote for documentation           |");
++        send_msg("H +----------------------------------------------------+");
++        ignore = 1;
++      }
++      else
++      if (!strncasecmp(buf,"q",1)) {
++        /* Prepare to quit */
++        setstatus(QUIT);
++        done = 1;
++      }
+       else {
+-        /* Invalid load command */
++        /* Unknown input received */
+         error = 1;
+       }
+     }
+-    else
+-    if (!strncasecmp(buf,"p",1)) {
+-      /* Prepare to (un)pause */
+-      invertpause();
+-    }
+-	else
+-    if (!strncasecmp(buf,"j",1)) {
+-      /* Prepare to seek */
+-      if ((b=strchr(buf,' ')) != NULL) {
+-        set_seek_opt(&options, b+1);
+-	  }
+-      ignore = 1;
+-    }
+-    else
+-    if (!strncasecmp(buf,"s",1)) {
+-      /* Prepare to stop */
+-      setstatus(STOP);
+-    }
+-	else
+-    if (!strncasecmp(buf,"r",1)) {
+-      /* Prepare to reload */
+-      setstatus(NEXT);
+-    }
+-    else
+-    if (!strncasecmp(buf,"h",1)) {
+-      /* Send help */
+-	  send_msg("H +----------------------------------------------------+");
+-	  send_msg("H | Ogg123 remote interface                            |");
+-	  send_msg("H |----------------------------------------------------|");
+-	  send_msg("H | Load <file>     -  load a file and starts playing  |");
+-	  send_msg("H | Pause           -  pause or unpause playing        |");
+-	  send_msg("H | Jump [+|-]<f>   -  jump <f> seconds forth or back  |");
+-	  send_msg("H | Stop            -  stop playing                    |");
+-	  send_msg("H | Reload          -  reload last song                |");
+-	  send_msg("H | Quit            -  quit ogg123                     |");
+-	  send_msg("H |----------------------------------------------------|");
+-	  send_msg("H | refer to README.remote for documentation           |");
+-	  send_msg("H +----------------------------------------------------+");
+-	  ignore = 1;
+-    }
+-    else
+-    if (!strncasecmp(buf,"q",1)) {
+-      /* Prepare to quit */
++    else {
++      send_err("E EOF or error reading commands");
++      send_log("EOF or error reading commands");
++      /* Treat EOF or error as a quit command. */
+       setstatus(QUIT);
+       done = 1;
+     }
+-    else {
+-      /* Unknown input received */
+-      error = 1;
+-    }
+ 
+     if (ignore) {
+       /* Unlock */
+-- 
+2.54.0
+

vorbis-tools-c99.patch

@@ -1,20 +0,0 @@
-Include "utf8.h" for a prototype of the utf8_decode function.  This
-avoids an implicit function declaration and build issues with future
-compilers.
-
-Submitted upstream:
-
-  <https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/6>
-
-diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c
-index a27f8da8307872bb..0709860ab096c942 100644
---- a/ogginfo/codec_skeleton.c
-+++ b/ogginfo/codec_skeleton.c
-@@ -25,6 +25,7 @@
- #include <ogg/ogg.h>
- 
- #include "i18n.h"
-+#include "utf8.h"
- 
- #include "private.h"
- 

vorbis-tools.spec

@@ -1,18 +1,20 @@
 Summary:	The Vorbis General Audio Compression Codec tools
 Name:		vorbis-tools
-Version:	1.4.2
-Release:	10%{?dist}
+Version:	1.4.3
+Release:	7%{?dist}
 Epoch:		1
-License:	GPLv2
+# Automatically converted from old format: GPLv2 - review is highly recommended.
+License:	GPL-2.0-only
 URL:		https://www.xiph.org/
 Source:		https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar.gz
 
 # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html
 # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html
 Patch1:		vorbis-tools-1.4.2-man-page.patch
-Patch2:		vorbis-tools-c99.patch
-# fix out-of-bounds read in oggenc (CVE-2023-43361)
-Patch3:		vorbis-tools-1.4.2-CVE-2023-43361.patch
+# CVE-2026-34253
+# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/4bb4fb33b25949178179f689db9afb477abeb572
+# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/cfc497a442f51fb4885e132deaf2e0ba067bd280
+Patch2:		vorbis-tools-1.4.3-CVE-2026-34253.patch
 
 BuildRequires:	flac-devel
 BuildRequires:	gettext
@@ -21,6 +23,7 @@ BuildRequires:	libao-devel
 BuildRequires:	libcurl-devel
 BuildRequires:	libvorbis-devel
 BuildRequires:	make
+BuildRequires:	opusfile-devel
 BuildRequires:	speex-devel
 Obsoletes:	vorbis < %{epoch}:%{version}-%{release}
 Provides:	vorbis = %{epoch}:%{version}-%{release}
@@ -42,9 +45,6 @@ comment editor.
 
 
 %build
-# fix FTBFS if "-Werror=format-security" flag is used (#1025257)
-export CFLAGS="$RPM_OPT_FLAGS -Wno-error=format-security"
-
 # uncomment this when debugging
 #CFLAGS="$CFLAGS -O0"
 
@@ -65,6 +65,39 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}*
 
 
 %changelog
+* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
+
+* Tue Jun 09 2026 Leigh Scott <leigh123linux@gmail.com> - 1:1.4.3-6
+- enable opusfile support
+
+* Tue Jun 09 2026 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.3-5
+- CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549)
+
+* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
+
+* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Tue May 27 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:1.4.3-2
+- Rebuilt for flac 1.5.0
+
+* Mon Apr 14 2025 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.3-1
+- rebase to latest upstream release (rhbz#2359292)
+
+* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 1:1.4.2-13
+- convert license to SPDX
+
+* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
 * Thu Jan 18 2024 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.2-10
 - fix out-of-bounds read in oggenc (CVE-2023-43361)