The package rpms/wavpack.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/wavpack.git/commit/?id=abbd04c47f9e2....
Change: +%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl
Thanks.
Full change: ============
commit abbd04c47f9e222fb1c2c0c0345f45f7b83b9d5b Author: Peter Lemenkov lemenkov@gmail.com Date: Wed Apr 10 12:03:42 2019 +0300
Fix for CVE-2018-19840, CVE-2018-19841
Signed-off-by: Peter Lemenkov lemenkov@gmail.com
diff --git a/.gitignore b/.gitignore index 9d153c0..ebd4f21 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,2 @@ -wavpack-4.60.0.tar.bz2 -/wavpack-4.60.1.tar.bz2 -/wavpack-4.70.0.tar.bz2 -/wavpack-4.75.2.tar.bz2 -/wavpack-4.80.0.tar.bz2 -/wavpack-5.1.0.tar.bz2 +*~ +/wavpack-[0-9]*.[0-9]*.[0-9]*.tar.bz2 diff --git a/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch b/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch index 421ef50..52fc237 100644 --- a/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch +++ b/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch @@ -1,14 +1,7 @@ -From 6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d Mon Sep 17 00:00:00 2001 From: David Bryant david@wavpack.com Date: Tue, 24 Apr 2018 17:27:01 -0700 -Subject: [PATCH 1/2] issue #33, sanitize size of unknown chunks before - malloc() +Subject: [PATCH] issue #33, sanitize size of unknown chunks before malloc()
---- - cli/dsdiff.c | 9 ++++++++- - cli/riff.c | 9 ++++++++- - cli/wave64.c | 9 ++++++++- - 3 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/cli/dsdiff.c b/cli/dsdiff.c index c016df9..fa56bbb 100644 @@ -70,6 +63,3 @@ index 591d640..fa928a0 100644
if (debug_logging_mode) error_line ("extra unknown chunk "%c%c%c%c" of %d bytes", --- -2.14.3 - diff --git a/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch b/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch index 1bd1d2f..b1f4afd 100644 --- a/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch +++ b/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch @@ -1,13 +1,8 @@ -From 26cb47f99d481ad9b93eeff80d26e6b63bbd7e15 Mon Sep 17 00:00:00 2001 From: David Bryant david@wavpack.com Date: Tue, 24 Apr 2018 22:18:07 -0700 -Subject: [PATCH 2/2] issue #30 issue #31 issue #32: no multiple format chunks - in WAV or W64 +Subject: [PATCH] issue #30 issue #31 issue #32: no multiple format chunks in + WAV or W64
---- - cli/riff.c | 7 ++++++- - cli/wave64.c | 6 ++++++ - 2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/cli/riff.c b/cli/riff.c index 7bddf63..5d6452e 100644 @@ -58,6 +53,3 @@ index fa928a0..0388dc7 100644 chunk_header.ckSize = (chunk_header.ckSize + 7) & ~7L;
if (chunk_header.ckSize < 16 || chunk_header.ckSize > sizeof (WaveHeader) || --- -2.14.3 - diff --git a/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch b/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch new file mode 100644 index 0000000..0dd06d6 --- /dev/null +++ b/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch @@ -0,0 +1,21 @@ +From: David Bryant david@wavpack.com +Date: Thu, 29 Nov 2018 21:00:42 -0800 +Subject: [PATCH] issue #53: error out on zero sample rate + + +diff --git a/src/pack_utils.c b/src/pack_utils.c +index 1918c18..ee3debf 100644 +--- a/src/pack_utils.c ++++ b/src/pack_utils.c +@@ -195,6 +195,11 @@ int WavpackSetConfiguration64 (WavpackContext *wpc, WavpackConfig *config, int64 + int num_chans = config->num_channels; + int i; + ++ if (!config->sample_rate) { ++ strcpy (wpc->error_message, "sample rate cannot be zero!"); ++ return FALSE; ++ } ++ + wpc->stream_version = (config->flags & CONFIG_COMPATIBLE_WRITE) ? CUR_STREAM_VERS : MAX_STREAM_VERS; + + if ((config->qmode & QMODE_DSD_AUDIO) && config->bytes_per_sample == 1 && config->bits_per_sample == 8) { diff --git a/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch b/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch new file mode 100644 index 0000000..a915641 --- /dev/null +++ b/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch @@ -0,0 +1,25 @@ +From: David Bryant david@wavpack.com +Date: Thu, 29 Nov 2018 21:53:51 -0800 +Subject: [PATCH] issue #54: fix potential out-of-bounds heap read + + +diff --git a/src/open_utils.c b/src/open_utils.c +index fc9440c..ce0879c 100644 +--- a/src/open_utils.c ++++ b/src/open_utils.c +@@ -1258,13 +1258,13 @@ int WavpackVerifySingleBlock (unsigned char *buffer, int verify_checksum) + #endif + + if (meta_bc == 4) { +- if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) & 0xff)) ++ if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff) || dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff)) + return FALSE; + } + else { + csum ^= csum >> 16; + +- if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) & 0xff)) ++ if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff)) + return FALSE; + } + diff --git a/wavpack.spec b/wavpack.spec index 914fc6c..d4e27ea 100644 --- a/wavpack.spec +++ b/wavpack.spec @@ -1,7 +1,7 @@ Name: wavpack Summary: A completely open audiocodec Version: 5.1.0 -Release: 11%{?dist} +Release: 12%{?dist} License: BSD Url: http://www.wavpack.com/ Source: http://www.wavpack.com/%%7Bname%7D-%%7Bversion%7D.tar.bz2 @@ -10,6 +10,8 @@ Patch2: wavpack-0002-issue-28-do-not-overwrite-heap-on-corrupt-DSDIFF-fil.patch Patch3: wavpack-0003-issue-28-fix-buffer-overflows-and-bad-allocs-on-corr.patch Patch4: wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch Patch5: wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch +Patch6: wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch +Patch7: wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch # For autoreconf BuildRequires: autoconf BuildRequires: automake @@ -38,17 +40,17 @@ autoreconf -ivf # Debian and Buildroot recomendation: # WavPack "autodetects" CPU type to enable ASM code. However, the assembly code # for ARM is written for ARMv7 only and building WavPack for an ARM-non-v7 -# architecture will fail. +# architecture will fail. # http://lists.busybox.net/pipermail/buildroot/2015-October/142117.html %configure --disable-static \ -%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl +%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl --disable-asm \ %endif
make %{?_smp_mflags}
%install -make DESTDIR=%{buildroot} install +%make_install rm -f %{buildroot}/%{_libdir}/*.la
%ldconfig_scriptlets @@ -60,7 +62,8 @@ rm -f %{buildroot}/%{_libdir}/*.la %{_mandir}/man1/wvgain.1* %{_mandir}/man1/wvunpack.1* %{_mandir}/man1/wvtag.1* -%doc AUTHORS COPYING +%doc AUTHORS +%license COPYING
%files devel %{_includedir}/* @@ -69,6 +72,9 @@ rm -f %{buildroot}/%{_libdir}/*.la %doc ChangeLog README
%changelog +* Wed Apr 10 2019 Peter Lemenkov lemenkov@gmail.com - 5.1.0-12 +- Fix for CVE-2018-19840, CVE-2018-19841 + * Thu Feb 28 2019 Srgio Basto sergio@serjux.com - 5.1.0-11 - Make the manual pages decompression format agnostic
commit 41d2bb624bef4cfc1e9b6a71892cf3d44aca51a4 Author: Srgio M. Basto sergio@serjux.com Date: Thu Feb 28 23:11:13 2019 +0000
Make the manual pages decompression format agnostic
diff --git a/wavpack.spec b/wavpack.spec index 8aec986..914fc6c 100644 --- a/wavpack.spec +++ b/wavpack.spec @@ -1,7 +1,7 @@ Name: wavpack Summary: A completely open audiocodec Version: 5.1.0 -Release: 10%{?dist} +Release: 11%{?dist} License: BSD Url: http://www.wavpack.com/ Source: http://www.wavpack.com/%%7Bname%7D-%%7Bversion%7D.tar.bz2 @@ -69,6 +69,9 @@ rm -f %{buildroot}/%{_libdir}/*.la %doc ChangeLog README
%changelog +* Thu Feb 28 2019 Srgio Basto sergio@serjux.com - 5.1.0-11 +- Make the manual pages decompression format agnostic + * Sun Feb 03 2019 Fedora Release Engineering releng@fedoraproject.org - 5.1.0-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
commit 12994bcd69b0eaf53540bc665cfe610af6bf1c32 Merge: 7afc12b 88a53b2 Author: Srgio Monteiro Basto sergiomb@fedoraproject.org Date: Thu Feb 28 21:38:52 2019 +0000
Merge #1 `Make the manual pages decompression format agnostic`
commit 88a53b2c995f65fbace639262890f92e0517f59a Author: Felipe Borges feborges@redhat.com Date: Thu Feb 28 11:19:21 2019 +0100
Make the manual pages decompression format agnostic
It is recommended in the Fedora packaging guidelines to have
%{_mandir}/man1/<command>.1*
which is more robust against future changes to the RPM scritps to use different compression.
diff --git a/wavpack.spec b/wavpack.spec index 29b7014..2c46eff 100644 --- a/wavpack.spec +++ b/wavpack.spec @@ -61,7 +61,7 @@ rm -f %{buildroot}/%{_libdir}/*.la %{_mandir}/man1/wavpack.1* %{_mandir}/man1/wvgain.1* %{_mandir}/man1/wvunpack.1* -%{_mandir}/man1/wvtag.1.* +%{_mandir}/man1/wvtag.1* %doc AUTHORS COPYING
%files devel
commit 7afc12b732435b0efed57d5cabeee2f3898ac4e8 Author: Fedora Release Engineering releng@fedoraproject.org Date: Sun Feb 3 11:33:42 2019 +0000
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
Signed-off-by: Fedora Release Engineering releng@fedoraproject.org
diff --git a/wavpack.spec b/wavpack.spec index 4ae3fe4..946c280 100644 --- a/wavpack.spec +++ b/wavpack.spec @@ -1,7 +1,7 @@ Name: wavpack Summary: A completely open audiocodec Version: 5.1.0 -Release: 9%{?dist} +Release: 10%{?dist} License: BSD Url: http://www.wavpack.com/ Source: http://www.wavpack.com/%%7Bname%7D-%%7Bversion%7D.tar.bz2 @@ -69,6 +69,9 @@ rm -f %{buildroot}/%{_libdir}/*.la %doc ChangeLog README
%changelog +* Sun Feb 03 2019 Fedora Release Engineering releng@fedoraproject.org - 5.1.0-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Sat Jul 14 2018 Fedora Release Engineering releng@fedoraproject.org - 5.1.0-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
commit ba87f01dcec5c6af186a6d78f0d4775fe4ba16b4 Author: Igor Gnatenko ignatenkobrain@fedoraproject.org Date: Mon Jan 28 20:18:30 2019 +0100
Remove obsolete Group tag
References: https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
diff --git a/wavpack.spec b/wavpack.spec index 29b7014..4ae3fe4 100644 --- a/wavpack.spec +++ b/wavpack.spec @@ -3,7 +3,6 @@ Summary: A completely open audiocodec Version: 5.1.0 Release: 9%{?dist} License: BSD -Group: Applications/Multimedia Url: http://www.wavpack.com/ Source: http://www.wavpack.com/%%7Bname%7D-%%7Bversion%7D.tar.bz2 Patch1: wavpack-0001-issue-27-do-not-overwrite-stack-on-corrupt-RF64-file.patch @@ -25,7 +24,6 @@ performance and functionality.
%package devel Summary: WavPack - development files -Group: Development/Libraries Requires: %{name}%{?_isa} = %{version}-%{release} Requires: pkgconfig