The package rpms/wavpack.git has added or updated architecture specific content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/wavpack.git/commit/?id=abbd04c47f....
Change:
+%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl
Thanks.
Full change:
============
commit abbd04c47f9e222fb1c2c0c0345f45f7b83b9d5b
Author: Peter Lemenkov <lemenkov(a)gmail.com>
Date: Wed Apr 10 12:03:42 2019 +0300
Fix for CVE-2018-19840, CVE-2018-19841
Signed-off-by: Peter Lemenkov <lemenkov(a)gmail.com>
diff --git a/.gitignore b/.gitignore
index 9d153c0..ebd4f21 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,2 @@
-wavpack-4.60.0.tar.bz2
-/wavpack-4.60.1.tar.bz2
-/wavpack-4.70.0.tar.bz2
-/wavpack-4.75.2.tar.bz2
-/wavpack-4.80.0.tar.bz2
-/wavpack-5.1.0.tar.bz2
+*~
+/wavpack-[0-9]*.[0-9]*.[0-9]*.tar.bz2
diff --git a/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch
b/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch
index 421ef50..52fc237 100644
--- a/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch
+++ b/wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch
@@ -1,14 +1,7 @@
-From 6f8bb34c2993a48ab9afbe353e6d0cff7c8d821d Mon Sep 17 00:00:00 2001
From: David Bryant <david(a)wavpack.com>
Date: Tue, 24 Apr 2018 17:27:01 -0700
-Subject: [PATCH 1/2] issue #33, sanitize size of unknown chunks before
- malloc()
+Subject: [PATCH] issue #33, sanitize size of unknown chunks before malloc()
----
- cli/dsdiff.c | 9 ++++++++-
- cli/riff.c | 9 ++++++++-
- cli/wave64.c | 9 ++++++++-
- 3 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/cli/dsdiff.c b/cli/dsdiff.c
index c016df9..fa56bbb 100644
@@ -70,6 +63,3 @@ index 591d640..fa928a0 100644
if (debug_logging_mode)
error_line ("extra unknown chunk \"%c%c%c%c\" of %d
bytes",
---
-2.14.3
-
diff --git a/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch
b/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch
index 1bd1d2f..b1f4afd 100644
--- a/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch
+++ b/wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch
@@ -1,13 +1,8 @@
-From 26cb47f99d481ad9b93eeff80d26e6b63bbd7e15 Mon Sep 17 00:00:00 2001
From: David Bryant <david(a)wavpack.com>
Date: Tue, 24 Apr 2018 22:18:07 -0700
-Subject: [PATCH 2/2] issue #30 issue #31 issue #32: no multiple format chunks
- in WAV or W64
+Subject: [PATCH] issue #30 issue #31 issue #32: no multiple format chunks in
+ WAV or W64
----
- cli/riff.c | 7 ++++++-
- cli/wave64.c | 6 ++++++
- 2 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/cli/riff.c b/cli/riff.c
index 7bddf63..5d6452e 100644
@@ -58,6 +53,3 @@ index fa928a0..0388dc7 100644
chunk_header.ckSize = (chunk_header.ckSize + 7) & ~7L;
if (chunk_header.ckSize < 16 || chunk_header.ckSize > sizeof
(WaveHeader) ||
---
-2.14.3
-
diff --git a/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch
b/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch
new file mode 100644
index 0000000..0dd06d6
--- /dev/null
+++ b/wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch
@@ -0,0 +1,21 @@
+From: David Bryant <david(a)wavpack.com>
+Date: Thu, 29 Nov 2018 21:00:42 -0800
+Subject: [PATCH] issue #53: error out on zero sample rate
+
+
+diff --git a/src/pack_utils.c b/src/pack_utils.c
+index 1918c18..ee3debf 100644
+--- a/src/pack_utils.c
++++ b/src/pack_utils.c
+@@ -195,6 +195,11 @@ int WavpackSetConfiguration64 (WavpackContext *wpc, WavpackConfig
*config, int64
+ int num_chans = config->num_channels;
+ int i;
+
++ if (!config->sample_rate) {
++ strcpy (wpc->error_message, "sample rate cannot be zero!");
++ return FALSE;
++ }
++
+ wpc->stream_version = (config->flags & CONFIG_COMPATIBLE_WRITE) ?
CUR_STREAM_VERS : MAX_STREAM_VERS;
+
+ if ((config->qmode & QMODE_DSD_AUDIO) && config->bytes_per_sample
== 1 && config->bits_per_sample == 8) {
diff --git a/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch
b/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch
new file mode 100644
index 0000000..a915641
--- /dev/null
+++ b/wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch
@@ -0,0 +1,25 @@
+From: David Bryant <david(a)wavpack.com>
+Date: Thu, 29 Nov 2018 21:53:51 -0800
+Subject: [PATCH] issue #54: fix potential out-of-bounds heap read
+
+
+diff --git a/src/open_utils.c b/src/open_utils.c
+index fc9440c..ce0879c 100644
+--- a/src/open_utils.c
++++ b/src/open_utils.c
+@@ -1258,13 +1258,13 @@ int WavpackVerifySingleBlock (unsigned char *buffer, int
verify_checksum)
+ #endif
+
+ if (meta_bc == 4) {
+- if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) &
0xff) || *dp++ != ((csum >> 16) & 0xff) || *dp++ != ((csum >> 24) &
0xff))
++ if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) & 0xff)
|| dp[2] != ((csum >> 16) & 0xff) || dp[3] != ((csum >> 24) & 0xff))
+ return FALSE;
+ }
+ else {
+ csum ^= csum >> 16;
+
+- if (*dp++ != (csum & 0xff) || *dp++ != ((csum >> 8) &
0xff))
++ if (*dp != (csum & 0xff) || dp[1] != ((csum >> 8) &
0xff))
+ return FALSE;
+ }
+
diff --git a/wavpack.spec b/wavpack.spec
index 914fc6c..d4e27ea 100644
--- a/wavpack.spec
+++ b/wavpack.spec
@@ -1,7 +1,7 @@
Name: wavpack
Summary: A completely open audiocodec
Version: 5.1.0
-Release: 11%{?dist}
+Release: 12%{?dist}
License: BSD
Url:
http://www.wavpack.com/
Source:
http://www.wavpack.com/%{name}-%{version}.tar.bz2
@@ -10,6 +10,8 @@
Patch2: wavpack-0002-issue-28-do-not-overwrite-heap-on-corrupt-DSDIFF-fil.patch
Patch3: wavpack-0003-issue-28-fix-buffer-overflows-and-bad-allocs-on-corr.patch
Patch4: wavpack-0004-issue-33-sanitize-size-of-unknown-chunks-before-mall.patch
Patch5: wavpack-0005-issue-30-issue-31-issue-32-no-multiple-format-chunks.patch
+Patch6: wavpack-0006-issue-53-error-out-on-zero-sample-rate.patch
+Patch7: wavpack-0007-issue-54-fix-potential-out-of-bounds-heap-read.patch
# For autoreconf
BuildRequires: autoconf
BuildRequires: automake
@@ -38,17 +40,17 @@ autoreconf -ivf
# Debian and Buildroot recomendation:
# WavPack "autodetects" CPU type to enable ASM code. However, the assembly
code
# for ARM is written for ARMv7 only and building WavPack for an ARM-non-v7
-# architecture will fail.
+# architecture will fail.
#
http://lists.busybox.net/pipermail/buildroot/2015-October/142117.html
%configure --disable-static \
-%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl
+%ifarch armv3l armv4b armv4l armv4tl armv5tel armv5tejl armv6l armv6hl
--disable-asm \
%endif
make %{?_smp_mflags}
%install
-make DESTDIR=%{buildroot} install
+%make_install
rm -f %{buildroot}/%{_libdir}/*.la
%ldconfig_scriptlets
@@ -60,7 +62,8 @@ rm -f %{buildroot}/%{_libdir}/*.la
%{_mandir}/man1/wvgain.1*
%{_mandir}/man1/wvunpack.1*
%{_mandir}/man1/wvtag.1*
-%doc AUTHORS COPYING
+%doc AUTHORS
+%license COPYING
%files devel
%{_includedir}/*
@@ -69,6 +72,9 @@ rm -f %{buildroot}/%{_libdir}/*.la
%doc ChangeLog README
%changelog
+* Wed Apr 10 2019 Peter Lemenkov <lemenkov(a)gmail.com> - 5.1.0-12
+- Fix for CVE-2018-19840, CVE-2018-19841
+
* Thu Feb 28 2019 Srgio Basto <sergio(a)serjux.com> - 5.1.0-11
- Make the manual pages decompression format agnostic
commit 41d2bb624bef4cfc1e9b6a71892cf3d44aca51a4
Author: Srgio M. Basto <sergio(a)serjux.com>
Date: Thu Feb 28 23:11:13 2019 +0000
Make the manual pages decompression format agnostic
diff --git a/wavpack.spec b/wavpack.spec
index 8aec986..914fc6c 100644
--- a/wavpack.spec
+++ b/wavpack.spec
@@ -1,7 +1,7 @@
Name: wavpack
Summary: A completely open audiocodec
Version: 5.1.0
-Release: 10%{?dist}
+Release: 11%{?dist}
License: BSD
Url:
http://www.wavpack.com/
Source:
http://www.wavpack.com/%{name}-%{version}.tar.bz2
@@ -69,6 +69,9 @@ rm -f %{buildroot}/%{_libdir}/*.la
%doc ChangeLog README
%changelog
+* Thu Feb 28 2019 Srgio Basto <sergio(a)serjux.com> - 5.1.0-11
+- Make the manual pages decompression format agnostic
+
* Sun Feb 03 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.1.0-10
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
commit 12994bcd69b0eaf53540bc665cfe610af6bf1c32
Merge: 7afc12b 88a53b2
Author: Srgio Monteiro Basto <sergiomb(a)fedoraproject.org>
Date: Thu Feb 28 21:38:52 2019 +0000
Merge #1 `Make the manual pages decompression format agnostic`
commit 88a53b2c995f65fbace639262890f92e0517f59a
Author: Felipe Borges <feborges(a)redhat.com>
Date: Thu Feb 28 11:19:21 2019 +0100
Make the manual pages decompression format agnostic
It is recommended in the Fedora packaging guidelines to have
%{_mandir}/man1/<command>.1*
which is more robust against future changes to the RPM scritps
to use different compression.
diff --git a/wavpack.spec b/wavpack.spec
index 29b7014..2c46eff 100644
--- a/wavpack.spec
+++ b/wavpack.spec
@@ -61,7 +61,7 @@ rm -f %{buildroot}/%{_libdir}/*.la
%{_mandir}/man1/wavpack.1*
%{_mandir}/man1/wvgain.1*
%{_mandir}/man1/wvunpack.1*
-%{_mandir}/man1/wvtag.1.*
+%{_mandir}/man1/wvtag.1*
%doc AUTHORS COPYING
%files devel
commit 7afc12b732435b0efed57d5cabeee2f3898ac4e8
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Sun Feb 3 11:33:42 2019 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/wavpack.spec b/wavpack.spec
index 4ae3fe4..946c280 100644
--- a/wavpack.spec
+++ b/wavpack.spec
@@ -1,7 +1,7 @@
Name: wavpack
Summary: A completely open audiocodec
Version: 5.1.0
-Release: 9%{?dist}
+Release: 10%{?dist}
License: BSD
Url:
http://www.wavpack.com/
Source:
http://www.wavpack.com/%{name}-%{version}.tar.bz2
@@ -69,6 +69,9 @@ rm -f %{buildroot}/%{_libdir}/*.la
%doc ChangeLog README
%changelog
+* Sun Feb 03 2019 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.1.0-10
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
* Sat Jul 14 2018 Fedora Release Engineering <releng(a)fedoraproject.org> - 5.1.0-9
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
commit ba87f01dcec5c6af186a6d78f0d4775fe4ba16b4
Author: Igor Gnatenko <ignatenkobrain(a)fedoraproject.org>
Date: Mon Jan 28 20:18:30 2019 +0100
Remove obsolete Group tag
References:
https://fedoraproject.org/wiki/Changes/Remove_Group_Tag
diff --git a/wavpack.spec b/wavpack.spec
index 29b7014..4ae3fe4 100644
--- a/wavpack.spec
+++ b/wavpack.spec
@@ -3,7 +3,6 @@ Summary: A completely open audiocodec
Version: 5.1.0
Release: 9%{?dist}
License: BSD
-Group: Applications/Multimedia
Url:
http://www.wavpack.com/
Source:
http://www.wavpack.com/%{name}-%{version}.tar.bz2
Patch1: wavpack-0001-issue-27-do-not-overwrite-stack-on-corrupt-RF64-file.patch
@@ -25,7 +24,6 @@ performance and functionality.
%package devel
Summary: WavPack - development files
-Group: Development/Libraries
Requires: %{name}%{?_isa} = %{version}-%{release}
Requires: pkgconfig