fix out-of-bounds read in oggenc

Resolves: CVE-2023-43361

vorbis-tools-1.4.2-CVE-2023-43361.patch

@@ -0,0 +1,13 @@
+diff --git a/oggenc/platform.c b/oggenc/platform.c
+index 6d9f4ef..c63304b 100644
+--- a/oggenc/platform.c
++++ b/oggenc/platform.c
+@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8)
+         start = start+2;
+ #endif
+ 
+-    while((end = strpbrk(start+1, PATH_SEPS)) != NULL)
++    while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL)
+     {
+         int rv;
+         memcpy(segment, fn, end-fn);

vorbis-tools.spec

@@ -1,7 +1,7 @@
 Summary:	The Vorbis General Audio Compression Codec tools
 Name:		vorbis-tools
 Version:	1.4.2
-Release:	9%{?dist}
+Release:	10%{?dist}
 Epoch:		1
 License:	GPLv2
 URL:		https://www.xiph.org/
@@ -11,6 +11,8 @@ Source:		https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar.
 # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html
 Patch1:		vorbis-tools-1.4.2-man-page.patch
 Patch2:		vorbis-tools-c99.patch
+# fix out-of-bounds read in oggenc (CVE-2023-43361)
+Patch3:		vorbis-tools-1.4.2-CVE-2023-43361.patch
 
 BuildRequires:	flac-devel
 BuildRequires:	gettext
@@ -63,6 +65,9 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}*
 
 
 %changelog
+* Thu Jan 18 2024 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.2-10
+- fix out-of-bounds read in oggenc (CVE-2023-43361)
+
 * Sat Jul 22 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-9
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild