fix out-of-bounds read in oggenc

Resolves: CVE-2023-43361

sources

@@ -1 +1 @@
-SHA512 (vorbis-tools-1.4.3.tar.gz) = 096cb82073ca697fd3556e11c09e8296f60d4abc3cdfee6296fe8643f2e39edcf093704453901fe34d03c7818f59d665d665504a217c1399079df1d936d763e4
+SHA512 (vorbis-tools-1.4.2.tar.gz) = 31681560434054706981aef64406975295eb405a9d2d7c0468af789d6c23edb7cfc1c19d26a28fa7061835524289cdc6d217a4669c43a2eb828189370cc6fcaf

vorbis-tools-1.4.2-CVE-2023-43361.patch

@@ -0,0 +1,13 @@
+diff --git a/oggenc/platform.c b/oggenc/platform.c
+index 6d9f4ef..c63304b 100644
+--- a/oggenc/platform.c
++++ b/oggenc/platform.c
+@@ -147,7 +147,7 @@ int create_directories(char *fn, int isutf8)
+         start = start+2;
+ #endif
+ 
+-    while((end = strpbrk(start+1, PATH_SEPS)) != NULL)
++    while((end = strpbrk(start + strspn(start, PATH_SEPS), PATH_SEPS)) != NULL)
+     {
+         int rv;
+         memcpy(segment, fn, end-fn);

vorbis-tools-1.4.3-CVE-2026-34253.patch

@@ -1,248 +0,0 @@
-From 4bb4fb33b25949178179f689db9afb477abeb572 Mon Sep 17 00:00:00 2001
-From: "Timothy B. Terriberry" <tterribe@xiph.org>
-Date: Tue, 24 Jun 2025 09:14:13 -0700
-Subject: [PATCH] Do not assume fgets result is non-empty
-
-If a file contains an embedded NUL ('\0') character, strlen() on
- the result of fgets() can be 0, even when we have not reached the
- end of the file.
-Therefore we cannot access index [strlen(buf)-1] to check a
- character at the end of the string.
-
-Thanks to Momoko Shiraishi for the report.
-
-Fixes #2332
----
- ogg123/playlist.c        | 8 ++++++--
- ogg123/remote.c          | 2 +-
- vorbiscomment/vcomment.c | 2 +-
- 3 files changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/ogg123/playlist.c b/ogg123/playlist.c
-index afcf5d7..3d3bc8f 100644
---- a/ogg123/playlist.c
-+++ b/ogg123/playlist.c
-@@ -265,10 +265,14 @@ int playlist_append_from_file(playlist_t *list, char *playlist_filename)
- 
-     /* Crop off trailing newlines if present. Handle DOS (\r\n), Unix (\n)
-      * and MacOS<9 (\r) line endings. */
--    if (filename[length - 2] == '\r' && filename[length - 1] == '\n')
-+    if (length >= 2 && filename[length - 2] == '\r'
-+     && filename[length - 1] == '\n') {
-       filename[length - 2] = '\0';
--    else if (filename[length - 1] == '\n' || filename[length - 1] == '\r')
-+    }
-+    else if (length >= 1 && (
-+     filename[length - 1] == '\n' || filename[length - 1] == '\r')) {
-       filename[length - 1] = '\0';
-+    }
- 
-     if (stat(filename, &stat_buf) == 0) {
- 
-diff --git a/ogg123/remote.c b/ogg123/remote.c
-index 30f9787..1107174 100644
---- a/ogg123/remote.c
-+++ b/ogg123/remote.c
-@@ -150,7 +150,7 @@ static void * remotethread(void * arg) {
- #endif
- 
-     fgets(buf, MAXBUF, stdin);
--    buf[strlen(buf)-1] = 0;
-+    buf[strcspn(buf, "\n")] = 0;
- 
-     /* Lock on */
-     pthread_mutex_lock (&main_lock);
-diff --git a/vorbiscomment/vcomment.c b/vorbiscomment/vcomment.c
-index 2f1e17a..9c93f05 100644
---- a/vorbiscomment/vcomment.c
-+++ b/vorbiscomment/vcomment.c
-@@ -123,7 +123,7 @@ char * read_line (FILE *input)
-                         buffers[buffer_count] = buffer;
-                         buffer_count++;
- 
--                        if (retval[strlen (retval) - 1] == '\n')
-+                        if (strchr(retval, '\n') != NULL)
-                         {
-                                 /* End of the line */
-                                 break;
--- 
-2.54.0
-
-From cfc497a442f51fb4885e132deaf2e0ba067bd280 Mon Sep 17 00:00:00 2001
-From: "Timothy B. Terriberry" <tterribe@xiph.org>
-Date: Tue, 24 Jun 2025 09:38:56 -0700
-Subject: [PATCH] ogg123: Handle EOF/error in remote interface
-
-Previously, if there was an error or EOF reading commands for the
- remote interface, the reader would loop infinitely trying to read
- another command that will never come.
-Instead, treat error or EOF as a Quit command.
-
-We manually send an error message / log, instead of using the
- existing error path, because we still want the main thread to
- process the Quit.
----
- ogg123/remote.c | 128 ++++++++++++++++++++++++++----------------------
- 1 file changed, 69 insertions(+), 59 deletions(-)
-
-diff --git a/ogg123/remote.c b/ogg123/remote.c
-index 1107174..b0416a5 100644
---- a/ogg123/remote.c
-+++ b/ogg123/remote.c
-@@ -139,6 +139,7 @@ static void * remotethread(void * arg) {
-   buf[MAXBUF]=0;
- 
-   while(!done) {
-+    char *ret;
-     /* Read a line */
-     buf[0] = 0;
-     send_log("Waiting for input: ...");
-@@ -149,77 +150,86 @@ static void * remotethread(void * arg) {
-     select (1, &fd, NULL, NULL, NULL);
- #endif
- 
--    fgets(buf, MAXBUF, stdin);
--    buf[strcspn(buf, "\n")] = 0;
-+    ret = fgets(buf, MAXBUF, stdin);
- 
-     /* Lock on */
-     pthread_mutex_lock (&main_lock);
- 
--    send_log("Input: %s", buf);
--    error = 0;
--
--    if (!strncasecmp(buf,"l",1)) {
--	/* prepare to load */
--      if ((b=strchr(buf,' ')) != NULL) {
--        /* Prepare to load a new song */
--        strcpy((char*)arg, b+1);
-+    if (ret != NULL) {
-+      buf[strcspn(buf, "\n")] = 0;
-+      send_log("Input: %s", buf);
-+      error = 0;
-+
-+      if (!strncasecmp(buf,"l",1)) {
-+          /* prepare to load */
-+        if ((b=strchr(buf,' ')) != NULL) {
-+          /* Prepare to load a new song */
-+          strcpy((char*)arg, b+1);
-+          setstatus(NEXT);
-+        }
-+        else {
-+          /* Invalid load command */
-+          error = 1;
-+        }
-+      }
-+      else
-+      if (!strncasecmp(buf,"p",1)) {
-+        /* Prepare to (un)pause */
-+        invertpause();
-+      }
-+      else
-+      if (!strncasecmp(buf,"j",1)) {
-+        /* Prepare to seek */
-+        if ((b=strchr(buf,' ')) != NULL) {
-+          set_seek_opt(&options, b+1);
-+        }
-+        ignore = 1;
-+      }
-+      else
-+      if (!strncasecmp(buf,"s",1)) {
-+        /* Prepare to stop */
-+        setstatus(STOP);
-+      }
-+          else
-+      if (!strncasecmp(buf,"r",1)) {
-+        /* Prepare to reload */
-         setstatus(NEXT);
--      } 
-+      }
-+      else
-+      if (!strncasecmp(buf,"h",1)) {
-+        /* Send help */
-+        send_msg("H +----------------------------------------------------+");
-+        send_msg("H | Ogg123 remote interface                            |");
-+        send_msg("H |----------------------------------------------------|");
-+        send_msg("H | Load <file>     -  load a file and starts playing  |");
-+        send_msg("H | Pause           -  pause or unpause playing        |");
-+        send_msg("H | Jump [+|-]<f>   -  jump <f> seconds forth or back  |");
-+        send_msg("H | Stop            -  stop playing                    |");
-+        send_msg("H | Reload          -  reload last song                |");
-+        send_msg("H | Quit            -  quit ogg123                     |");
-+        send_msg("H |----------------------------------------------------|");
-+        send_msg("H | refer to README.remote for documentation           |");
-+        send_msg("H +----------------------------------------------------+");
-+        ignore = 1;
-+      }
-+      else
-+      if (!strncasecmp(buf,"q",1)) {
-+        /* Prepare to quit */
-+        setstatus(QUIT);
-+        done = 1;
-+      }
-       else {
--        /* Invalid load command */
-+        /* Unknown input received */
-         error = 1;
-       }
-     }
--    else
--    if (!strncasecmp(buf,"p",1)) {
--      /* Prepare to (un)pause */
--      invertpause();
--    }
--	else
--    if (!strncasecmp(buf,"j",1)) {
--      /* Prepare to seek */
--      if ((b=strchr(buf,' ')) != NULL) {
--        set_seek_opt(&options, b+1);
--	  }
--      ignore = 1;
--    }
--    else
--    if (!strncasecmp(buf,"s",1)) {
--      /* Prepare to stop */
--      setstatus(STOP);
--    }
--	else
--    if (!strncasecmp(buf,"r",1)) {
--      /* Prepare to reload */
--      setstatus(NEXT);
--    }
--    else
--    if (!strncasecmp(buf,"h",1)) {
--      /* Send help */
--	  send_msg("H +----------------------------------------------------+");
--	  send_msg("H | Ogg123 remote interface                            |");
--	  send_msg("H |----------------------------------------------------|");
--	  send_msg("H | Load <file>     -  load a file and starts playing  |");
--	  send_msg("H | Pause           -  pause or unpause playing        |");
--	  send_msg("H | Jump [+|-]<f>   -  jump <f> seconds forth or back  |");
--	  send_msg("H | Stop            -  stop playing                    |");
--	  send_msg("H | Reload          -  reload last song                |");
--	  send_msg("H | Quit            -  quit ogg123                     |");
--	  send_msg("H |----------------------------------------------------|");
--	  send_msg("H | refer to README.remote for documentation           |");
--	  send_msg("H +----------------------------------------------------+");
--	  ignore = 1;
--    }
--    else
--    if (!strncasecmp(buf,"q",1)) {
--      /* Prepare to quit */
-+    else {
-+      send_err("E EOF or error reading commands");
-+      send_log("EOF or error reading commands");
-+      /* Treat EOF or error as a quit command. */
-       setstatus(QUIT);
-       done = 1;
-     }
--    else {
--      /* Unknown input received */
--      error = 1;
--    }
- 
-     if (ignore) {
-       /* Unlock */
--- 
-2.54.0
-

vorbis-tools-c99.patch

@@ -0,0 +1,20 @@
+Include "utf8.h" for a prototype of the utf8_decode function.  This
+avoids an implicit function declaration and build issues with future
+compilers.
+
+Submitted upstream:
+
+  <https://gitlab.xiph.org/xiph/vorbis-tools/-/merge_requests/6>
+
+diff --git a/ogginfo/codec_skeleton.c b/ogginfo/codec_skeleton.c
+index a27f8da8307872bb..0709860ab096c942 100644
+--- a/ogginfo/codec_skeleton.c
++++ b/ogginfo/codec_skeleton.c
+@@ -25,6 +25,7 @@
+ #include <ogg/ogg.h>
+ 
+ #include "i18n.h"
++#include "utf8.h"
+ 
+ #include "private.h"
+ 

vorbis-tools.spec

@@ -1,20 +1,18 @@
 Summary:	The Vorbis General Audio Compression Codec tools
 Name:		vorbis-tools
-Version:	1.4.3
-Release:	7%{?dist}
+Version:	1.4.2
+Release:	10%{?dist}
 Epoch:		1
-# Automatically converted from old format: GPLv2 - review is highly recommended.
-License:	GPL-2.0-only
+License:	GPLv2
 URL:		https://www.xiph.org/
 Source:		https://ftp.osuosl.org/pub/xiph/releases/vorbis/%{name}-%{version}.tar.gz
 
 # http://lists.xiph.org/pipermail/vorbis-dev/2021-January/020538.html
 # http://lists.xiph.org/pipermail/vorbis-dev/2013-May/020336.html
 Patch1:		vorbis-tools-1.4.2-man-page.patch
-# CVE-2026-34253
-# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/4bb4fb33b25949178179f689db9afb477abeb572
-# https://gitlab.xiph.org/xiph/vorbis-tools/-/commit/cfc497a442f51fb4885e132deaf2e0ba067bd280
-Patch2:		vorbis-tools-1.4.3-CVE-2026-34253.patch
+Patch2:		vorbis-tools-c99.patch
+# fix out-of-bounds read in oggenc (CVE-2023-43361)
+Patch3:		vorbis-tools-1.4.2-CVE-2023-43361.patch
 
 BuildRequires:	flac-devel
 BuildRequires:	gettext
@@ -23,7 +21,6 @@ BuildRequires:	libao-devel
 BuildRequires:	libcurl-devel
 BuildRequires:	libvorbis-devel
 BuildRequires:	make
-BuildRequires:	opusfile-devel
 BuildRequires:	speex-devel
 Obsoletes:	vorbis < %{epoch}:%{version}-%{release}
 Provides:	vorbis = %{epoch}:%{version}-%{release}
@@ -45,6 +42,9 @@ comment editor.
 
 
 %build
+# fix FTBFS if "-Werror=format-security" flag is used (#1025257)
+export CFLAGS="$RPM_OPT_FLAGS -Wno-error=format-security"
+
 # uncomment this when debugging
 #CFLAGS="$CFLAGS -O0"
 
@@ -65,39 +65,6 @@ rm -rf $RPM_BUILD_ROOT%{_docdir}/%{name}*
 
 
 %changelog
-* Fri Jul 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-7
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild
-
-* Tue Jun 09 2026 Leigh Scott <leigh123linux@gmail.com> - 1:1.4.3-6
-- enable opusfile support
-
-* Tue Jun 09 2026 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.3-5
-- CVE-2026-34253 - fix arbitrary code execution via buffer underflow (rhbz#2479549)
-
-* Sat Jan 17 2026 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.3-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 27 2025 Jitka Plesnikova <jplesnik@redhat.com> - 1:1.4.3-2
-- Rebuilt for flac 1.5.0
-
-* Mon Apr 14 2025 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.3-1
-- rebase to latest upstream release (rhbz#2359292)
-
-* Sun Jan 19 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-14
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Mon Jul 29 2024 Miroslav Suchý <msuchy@redhat.com> - 1:1.4.2-13
-- convert license to SPDX
-
-* Sat Jul 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-12
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Sat Jan 27 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.4.2-11
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
 * Thu Jan 18 2024 Lukáš Zaoral <lzaoral@redhat.com> - 1:1.4.2-10
 - fix out-of-bounds read in oggenc (CVE-2023-43361)